--- title: "Governing outreach: who you contact, when, and why" description: "US practices need outreach governance, not more reminders: who is eligible, which channel, what HIPAA and TCPA allow, and what evidence you keep." url: https://www.getarbol.com/en/blog/governing-patient-outreach-us/ lang: en-US --- # Governing outreach: who you contact, when, and why US practices need outreach governance, not more reminders: who is eligible, which channel, what HIPAA and TCPA allow, and what evidence you keep. [**Emilia Santander** Physician · Health Data Scientist](https://www.getarbol.com/en/blog/authors/emilia-santander/) May 28, 2026 13 min read Governing patient outreach in the United States is not a marketing campaign with a clinical coat. It is an operating policy: **who** you may contact, **when** relative to the visit, **why** (purpose), on which **channel**, and what **evidence** you keep. HHS treats appointment reminders as part of treatment under HIPAA — so authorization is not the first question — while the FCC’s TCPA framework still constrains autodialed and prerecorded healthcare messages to wireless numbers. Practices that skip governance end up with either silence (lost access) or noise (compliance and trust debt). Takeaways - HHS states appointment reminders are part of treatment and can be made without a HIPAA authorization. - HIPAA permission is not the same as TCPA permission: channel, content, frequency, and opt-out still matter. - Governance means purpose, eligibility, window, channel, script limits, and an auditable outcome per attempt. - Drift from reminder into solicitation or advertising changes the legal and operational posture overnight. ## The real problem is not “more reminders” Most US practices already send something: a portal ping, an automated call, a text. The failure mode is rarely “zero contact.” It is **ungoverned contact** — different pods using different scripts, no record of who was reached, voicemails that over-disclose, and campaigns that blur reminder and promotion. That failure shows up as empty chairs, staff burnout on the phone, and compliance anxiety after the fact. It also shows up as the twin of unanswered phones: [after-hours demand that never becomes a booked visit](https://www.getarbol.com/en/blog/after-hours-calls-practice-cost/). Outreach without a policy is just another queue. If you operate in the [United States](https://www.getarbol.com/en/united-states/), the design question is sharper than “which vendor.” It is: **what is allowed, what is wise, and what you can prove.** ## What HIPAA already settles — and what it does not HHS is direct: [appointment reminders are considered part of treatment](https://www.hhs.gov/hipaa/for-professionals/faq/286/are-appointment-reminders-allowed-under-hipaa-without-authorization/index.html) and therefore can be made **without an authorization**. That FAQ is old (created 2002, last reviewed 2022) and still the backbone answer practices need when someone asks “do we need a signed form to remind?” The broader TPO frame matters too. HHS explains that covered entities may use and disclose protected health information for [treatment, payment, and health care operations](https://www.hhs.gov/hipaa/for-professionals/faq/treatment-payment-and-health-care-operations-disclosures/index.html) without prior consent in the sense many clinics assume. Treatment communications can happen by phone and other reasonable means when safeguards are in place. What HIPAA does **not** do: - It does not erase patient rights to request confidential communications by alternative means or locations. - It does not bless oversharing diagnosis, specialty, or lab detail on a household voicemail. - It does not replace TCPA, state telemarketing rules, or your own BAAs with vendors that persist PHI. For the voice-specific yes/no map, see [HIPAA voice appointment reminders](https://www.getarbol.com/en/blog/hipaa-voice-appointment-reminders/). This post zooms out to **governance**: the policy layer above any single channel. ## TCPA is a different question with different failure modes The FCC’s [TCPA Omnibus Declaratory Ruling and Order (FCC 15-72)](https://www.fcc.gov/document/tcpa-omnibus-declaratory-ruling-and-order) and later exemption guidance (including [FCC 20-186](https://docs.fcc.gov/public/attachments/FCC-20-186A1.pdf)) carve space for certain healthcare messages — appointment and exam confirmations and reminders among them — subject to conditions. The operational gist for a practice leader: - **Caller class**: by or on behalf of a healthcare provider. - **Purpose**: healthcare treatment / informational, not telemarketing or advertising. - **Volume limits** on exempt paths (the Commission has discussed conditions such as one message per day and a weekly cap on combined voice/texts for certain exemptions — treat counsel’s memo as authoritative for your stack). - **Opt-out**: interactive, honored, and recorded. When content or frequency drifts outside the exemption’s box, ordinary consent rules return. That is why [TCPA appointment-reminder compliance](https://www.getarbol.com/en/blog/tcpa-appointment-reminders-compliance/) is not a one-time checkbox: it is a living boundary on scripts and cadence. Two regimes HIPAA vs. TCPA for outreach decisions Question HIPAA (privacy) TCPA (calls/texts) Core question May we use/disclose PHI for this purpose? May we autodial / prerecord / text this number this way? Appointment reminder Treatment — authorization generally not required May fit healthcare exemption if conditions hold Marketing offer in the same message Often leaves the safe treatment lane Looks like telemarketing — consent posture changes Evidence you need Minimum necessary judgment + confidential-comms requests Consent/exemption path, opt-outs, attempt log Permission under one statute does not auto-satisfy the other. Fuente: HHS FAQ 286 · HHS TPO FAQs · FCC TCPA orders ## Who you contact: eligibility is a clinical-ops decision “Everyone with an appointment tomorrow” is a starting heuristic, not a policy. Eligibility should answer: - **Visit type** — new vs. return, procedure prep, behavioral health, pediatrics with caregiver. - **Risk of no-show** — prior miss history, long lead time, insurance or transportation flags (use carefully; avoid discriminatory proxies). - **Channel readiness** — valid number, preferred language, documented preference, STOP/opt-out status. - **Sensitivity** — specialties where a leave-behind message must stay generic. Outreach that ignores eligibility wastes staff time and increases complaint risk. Outreach that over-targets without documentation looks arbitrary when a patient asks why they were called and a neighbor was not. ## When you contact: windows that match the visit, not the vendor default Timing is governance. A seven-day call that enables concrete planning is a different intervention from a same-morning nudge. Evidence from primary-care trials (covered in the companion playbook on no-shows) shows that **early, purposeful** contact can move cancellations earlier — which is how you refill the slot. Late spam does not. A practical US default many practices can defend: - **T-7 to T-5** for high-risk or prep-heavy visits (planning call). - **T-72 to T-48** for standard confirmation. - **T-24** only if the first attempts failed or the visit is high value / high prep. - **Stop the sequence** once the patient confirms or reschedules. Write the windows into policy. Do not leave them in a salesperson’s slide. ## Why you contact: purpose statements beat “reminders” Every campaign needs a named purpose: 1. Confirm attendance. 2. Collect a cancellation early enough to refill. 3. Deliver prep instructions. 4. Offer a same-day or waitlist slot. 5. Route a clinical question to a human (not the agent’s invention). If the purpose is “fill the schedule with anyone,” you are in solicitation territory. If the purpose is “protect access for patients who already have a visit,” you stay closer to treatment and operations. Governance stack Purpose → eligibility → window → channel → evidence Purpose Name the job of the contact Confirm, cancel early, prep, offer refill — one primary purpose per sequence. Eligibility Decide who is in scope Visit type, risk flags, channel readiness, sensitivity. Window Set timing relative to the visit T-7 / T-72 / T-24 with stop-on-confirm. Channel Match channel to content risk Voice, SMS, portal — minimum necessary on each. Evidence Log attempt and outcome Who, when, channel, result, opt-out — auditable. Skip a layer and the stack fails as noise, silence, or a complaint. ## What you may say: minimum necessary in practice HIPAA’s treatment lane does not mean “say everything.” On SMS and voicemail, default to: - Patient first name or initials (per policy). - Date, time, location or department label that is not a diagnosis. - Callback number. - How to confirm, cancel, or opt out. Avoid: condition names, test results, medication details, “your psychiatry appointment,” or marketing for cosmetic or cash-pay add-ons in the same thread. Portal messages behind authentication can carry more detail; public channels should not. That discipline is the same operational mindset behind [front-desk overflow design](https://www.getarbol.com/en/blog/front-desk-overflow-ai-layer/): automation finishes the safe jobs; humans own the sensitive ones. ## Evidence: if it is not logged, it did not happen Governance without an attempt log is theater. Minimum fields: - Patient / appointment ID - Channel and destination (masked in reports) - Timestamp - Agent or system identity - Outcome (confirmed, canceled, rescheduled, left message, no answer, invalid, opted out) - Script version or purpose code Without those fields you cannot defend a complaint, improve a sequence, or prove you honored STOP. Policy artifacts What ‘governed’ looks like on paper 1 Written outreach policy Practice ops 5 Named purposes max per quarter Practice ops 100% Attempts with outcome codes Practice ops Counts are artifacts to maintain, not clinical outcomes. Fuente: Operational checklist · HIPAA/TCPA alignment ## Common failure modes in US practices 1. **Reminder + promo in one message** — “Confirm Tuesday and ask about our new wellness package.” 2. **Shared cell / household overshare** — detailed voicemail that another person hears. 3. **Ignoring confidential-communication requests** — calling a work number after the patient asked for mail only. 4. **Infinite retries** — burning trust and pushing past exemption frequency logic. 5. **Shadow channels** — staff texting from personal phones with no log. 6. **No owner** — “the front desk handles it” with no named accountable role. Each of these is cheaper to prevent in policy than to remediate after a complaint. ## Roles, RACI, and the weekly review Governance dies when it lives only in a PDF. Assign: - **Accountable** — practice manager or ops lead who owns the outreach policy. - **Responsible** — pod leads who run Layer A/B sequences and refill lists. - **Consulted** — compliance/privacy for script changes that touch PHI or marketing edges. - **Informed** — clinicians when specialty-specific language or prep instructions change. Hold a **30-minute weekly review**: ten random attempts, two opt-outs, one complaint (if any), refill rate of released slots. If you cannot sample attempts, you do not have governance — you have hope. ## Scripts as controlled documents Treat confirmation and voicemail scripts like controlled documents: version ID, owner, effective date, and a change log. Staff should not “improve” wording on the fly for sensitive specialties. Marketing should not insert offers into treatment sequences without a new purpose code and a new compliance pass. When you introduce an AI voice layer for overflow, the same rule applies: the model speaks a **published** script family, not free improvisation. That is how you keep the treatment lane HHS described for reminders while still answering the phone. ## How governance connects to access economics Empty chairs and abandoned calls are the same access problem on different clocks. Ungoverned outreach fixes neither: it adds contact cost without recovering capacity. Governed outreach recovers capacity when early cancels refill and when high-risk patients get a planning conversation before the day of the visit. That is why this guide sits next to [front-desk overflow](https://www.getarbol.com/en/blog/front-desk-overflow-ai-layer/) and [after-hours cost](https://www.getarbol.com/en/blog/after-hours-calls-practice-cost/): channel capacity without purpose still wastes demand. ## What your practice can do this week Outreach governance sprint - Write a one-page purpose list Confirm, early cancel, prep, waitlist offer — nothing else in v1. - Map HIPAA lane vs. TCPA lane Counsel or compliance lead signs off; do not DIY the exemption edges. - Freeze scripts for voicemail and SMS Minimum necessary; no diagnosis; opt-out language where required. - Turn on outcome codes If the EHR or dialer cannot log, fix that before volume. - Publish stop-on-confirm rules Confirmed patients leave the sequence immediately. 1. 1 Inventory every outbound path Portal, autodialer, SMS, manual staff calls, after-hours answering — list owners. 2. 2 Classify each path by purpose Treatment reminder vs. operations vs. marketing. Split any mixed campaign. 3. 3 Align windows to visit risk High-risk and prep-heavy get earlier contact; routine visits get a simpler stack. 4. 4 Train for handoff Automation confirms; humans handle clinical questions, threats, and sensitive specialties. 5. 5 Review opt-outs weekly Sample ten contacts; verify STOP and confidential-comms requests were honored. ## Closing In US primary and specialty care, outreach that works is outreach that is **governed**. HHS already told you reminders can sit inside treatment. The FCC told you channel rules still bind. Your job is to decide who, when, and why — and to keep the evidence. That is how access improves without turning the phone into a liability. Write the policy. Version the scripts. Sample the attempts. Refill the slots. Everything else is decoration. For market context on how Arbol frames US practice operations, see [United States](https://www.getarbol.com/en/united-states/). ## Appendix: decision tree for a new campaign Before any new outbound sequence ships: 1. **Purpose?** If you cannot name one primary purpose, stop. 2. **Treatment vs marketing?** If marketing, leave the reminder lane; get the consent posture right. 3. **Eligibility?** List inclusion/exclusion in one paragraph. 4. **Window?** T-7 / T-72 / T-24 — written, not implied. 5. **Channel?** Match content risk; voicemail stays generic. 6. **Opt-out / confidential communications?** Path tested end-to-end. 7. **Evidence?** Outcome codes live in production before volume. 8. **Owner?** Named human for weekly sample review. If any step is “TBD,” the campaign is not ready. That tree is the operational expression of HHS’s reminder-as-treatment answer plus the FCC’s channel constraints — without pretending one statute answers both. ## What “good” looks like after 90 days - Written policy approved and findable. - ≤5 active purposes. - ≥95% of attempts coded. - STOP and confidential-comms requests sampled with zero silent failures. - Early-cancel refill rate reported beside no-show rate. - Mixed marketing+reminder campaigns eliminated. Those are access and trust metrics. They beat vanity dial counts. ## Sensitive specialties and minors Behavioral health, infectious disease, reproductive health, and adolescent care need tighter scripts and often human-only paths for anything beyond a generic “please call the office about your visit.” Caregiver outreach for pediatric visits should use the guardian contact on file and avoid leaving clinical detail with siblings or household members. Governance is how you encode those exceptions — not tribal knowledge at the desk. ## Coordinating with legal without freezing ops Send counsel a one-pager: purposes, channels, sample scripts, exemption/consent assumptions, retention of logs, and BAAs in play. Ask for a written edge list (“never include X,” “stop after N attempts,” “escalation for specialty Y”). Ops then executes the edge list. Infinite legal review of every SMS adjective is how outreach dies; zero legal review is how complaints are born. The governance middle is a signed edge list plus weekly sampling. ## One-page policy outline (copy into your wiki) 1. Purpose catalog (named). 2. Eligibility rules. 3. Windows by visit class. 4. Channel matrix + minimum-necessary examples. 5. Opt-out and confidential-communications handling. 6. Outcome codes. 7. Weekly sample procedure. 8. Change control for scripts. If those eight headings exist with owners, you have governance. If they exist only in a vendor SOW, you do not. Ship the edge list. Sample weekly. Refill what you free. Disclaimer This content is for informational and educational purposes only. It is not a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of a qualified healthcare provider with any questions you may have regarding a medical condition. ## More to read - Regulation May 13, 2026 ### [TCPA Consent for Appointment Reminders: What Actually Changed](https://www.getarbol.com/en/blog/tcpa-appointment-reminders-compliance/) The FCC's TCPA consent rules for reminder calls and texts are still shifting. Here is what your practice's intake process needs to get right now. 10 min read Samuel Giraldo - Practice operations May 15, 2026 ### [Front desk overflow: an AI voice layer that keeps your staff](https://www.getarbol.com/en/blog/front-desk-overflow-ai-layer/) US practices lose capacity when the phone outruns the desk. An AI voice layer absorbs overflow without replacing the people who still own the lobby. 11 min read Tomas Giraldo - Practice operations Jun 19, 2026 ### [Weekend overflow without burning the front desk](https://www.getarbol.com/en/blog/weekend-overflow-without-burnout-us/) Weekend phone demand drains Monday capacity. A US practice playbook for covering overflow without burning the front desk or inventing a 24/7 hire. 11 min read Tomas Giraldo ## Every call answered. Every appointment in its place. Arbol answers calls and WhatsApp 24/7, and books and confirms appointments on top of the medical record and systems you already use. [Book a demo](https://cal.com/tomas-giraldo-pdfbl9/30-min-arbol-ai-demo) --- **Arbol AI** — AI agents for clinics and healthcare providers: they answer and reach patients by phone, WhatsApp, SMS, email and web chat, book their appointments 24/7 and keep a record of every conversation. - Original page: - Book a demo: · Pricing: - Agent index: · Support: