AI Text Messaging in Digital Health: TCPA Compliance for Automated Patient Outreach

If your digital health company, hospital system, or healthcare technology platform uses automated tools to send text messages or make calls to patients, you are operating under one of the most actively litigated federal statutes in the United States. The Telephone Consumer Protection Act has generated more class action litigation than almost any other federal consumer protection law, its statutory damages structure makes individual violations economically significant even before aggregation, and the legal landscape governing it shifted dramatically in 2025.

Add artificial intelligence to automated patient communications and you have layered an emerging technology on top of a complex regulatory structure that was not designed to address it — with courts, the FCC, and Congress still working out how the pieces fit. This post maps what digital health companies and healthcare providers need to know about TCPA compliance for AI-driven patient outreach in 2026.

The TCPA Framework: What the Statute Covers

The Telephone Consumer Protection Act, enacted in 1991, restricts the use of automatic telephone dialing systems, artificial or prerecorded voice messages, and fax machines to send unsolicited commercial messages. The statute applies to calls and text messages to mobile phones, and its core prohibition requires prior express consent before using an autodialer to contact a consumer.

For healthcare contexts, the TCPA’s consent requirements divide into two tiers based on the purpose of the communication.

Prior express written consent is required for calls or texts that include advertising or telemarketing content — messages promoting products, services, or the practice itself. This is the higher consent standard, requiring a written agreement that clearly authorizes the specific type of communication.

Prior express consent (oral or written, though written documentation is strongly advisable) is required for informational calls and texts using an autodialer — messages that do not include advertising or marketing content. This is the standard applicable to the healthcare exemption discussed below.

Violations of the TCPA carry statutory damages of $500 per violation, trebled to $1,500 per willful or knowing violation. Given the scale at which AI-powered patient communication systems operate — sending thousands of messages per day — a compliance failure is not a single violation. It is potentially tens of thousands of violations carrying aggregate exposure in the millions.

The Healthcare Exemption: Scope and Limits

The FCC created a TCPA exemption for certain healthcare-related automated calls and texts, recognizing that timely patient communications serve genuine public health purposes that distinguish them from the commercial telemarketing the TCPA was primarily designed to restrict.

Qualifying messages under the healthcare exemption include:

• Appointment confirmations and reminders
• Prescription availability and refill notifications
• Instructions for hospital pre-registration and pre-operative procedures
• Lab result notifications
• Wellness checkups and post-discharge follow-up communications
• Information about healthcare benefit eligibility

The exemption requires that covered communications be made by or on behalf of a HIPAA-covered healthcare provider to patients with whom the provider has an established relationship. The messages must be non-commercial — no promotional content, no advertising, no marketing material. If a single automated message contains both exempt healthcare content and promotional content, the entire message loses its exempt status.

The frequency limitation is strict: the exemption permits a maximum of one message per day and three messages per week per patient, per purpose. Exceeding those limits requires obtaining prior express consent for the messages that fall outside the exemption.

The practical implication for AI-powered patient communication platforms is critical: the exemption is conditioned on message content, not just message category. An AI system generating personalized patient outreach messages needs robust content controls ensuring that automated optimization toward engagement — a core function of many AI systems — does not inadvertently introduce promotional content that destroys the exemption. Every message variation generated by the AI needs to be evaluated against the non-commercial requirement, not just the template.

The FCC AI Voice Decision: What It Means for Digital Health

In 2024, the FCC issued a declaratory ruling confirming that the TCPA’s restrictions on “artificial or prerecorded voice” communications encompass AI-generated voice technologies — AI systems that generate human-sounding voices are subject to the same prior express consent requirements as traditional prerecorded messages.

For digital health companies using AI-powered voice outreach — automated calls delivering appointment reminders, medication adherence check-ins, or care navigation assistance — this ruling confirms that the consent obligations apply regardless of whether the voice on the call was recorded by a human or synthesized by an AI engine.

The more open question is whether AI-powered text messaging platforms constitute “automatic telephone dialing systems” under the TCPA’s autodialer definition. The Supreme Court’s 2021 decision in Facebook, Inc. v. Duguid narrowed the autodialer definition to systems that use a random or sequential number generator to store or produce telephone numbers to be called, but significant gray areas remain. AI-powered messaging systems that pull from curated patient contact lists — rather than randomly or sequentially generating numbers — may fall outside the narrowed Duguid definition, but the analysis depends on how the specific system functions and courts have not uniformly resolved the edge cases.

The McLaughlin Decision: Courts Are Now Free to Go Their Own Way

On June 20, 2025, the Supreme Court issued McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., a decision that restructured the entire litigation landscape for TCPA enforcement. The ruling addressed whether federal courts must defer to FCC interpretations of the TCPA under the Hobbs Act. The Supreme Court held that courts are not bound by FCC interpretations — they must determine the “best reading” of the statute independently, giving FCC guidance only “appropriate respect” rather than controlling deference.

The practical consequence is significant and ongoing: TCPA interpretations that had appeared settled under FCC guidance are now open for independent judicial reconsideration in every federal circuit. Courts are actively working through what autodialer definitions, consent standards, and exemption scope mean without being required to follow the FCC’s answers to those questions.

For digital health companies, this creates a compliance environment where the legal analysis of automated patient communication systems cannot simply end with “the FCC said this is permissible.” Each federal circuit may reach different conclusions. A consent and operational structure designed around FCC guidance may not be sufficient in a circuit whose courts have departed from that guidance.

The appropriate response is not paralysis — it is building a compliance structure designed to satisfy the requirements of the most demanding judicial interpretation of the statute, not the most permissive one.

The One-to-One Consent Rule: What Was Proposed, What Happened, and Why It Still Matters

In late 2024, the FCC promulgated a rule that would have required, as of January 2025, “one-to-one consent” — each company seeking to send automated marketing messages would need to obtain its own consent from each consumer; consent obtained by one entity could not be shared with or sold to third parties for use in automated communications.

On January 24, 2025, the Eleventh Circuit vacated the one-to-one consent rule in Insurance Marketing Coalition v. FCC, holding that the FCC had exceeded its statutory authority. As of mid-2026, the one-to-one consent requirement is not in effect. Marketers can still, within limits, rely on consent obtained through lead generation forms that disclose multiple sellers.

For healthcare organizations, the practical significance of the vacated rule is limited because healthcare communications should be obtaining direct patient consent through registration and intake processes anyway — not relying on third-party lead generation consent. But the episode is significant for digital health companies with consumer-facing marketing components: the consent framework for the marketing side of their business needs to be evaluated carefully, since the regulatory landscape continues to shift.

Consent Revocation: The April 2025 Rules and Their Healthcare Impact

Effective April 11, 2025, the FCC’s consent revocation rules created a significant operational obligation. Under these rules, when a consumer revokes consent to receive automated communications — by texting STOP, replying with any reasonable revocation request, or using any other clear indication of intent to opt out — that revocation must be honored promptly. The FCC has stated it will enforce a 10-business-day outside limit, with best practice being immediate opt-out processing.

For healthcare organizations operating under the TCPA healthcare exemption, the 2025 revocation rules have a nuanced but important implication: an opt-out from a patient applies to all automated messages from that sender, including messages that would otherwise qualify for the healthcare exemption. A patient who texts STOP to a hospital’s appointment reminder system has revoked consent for all automated outreach from that hospital, not just appointment reminders.

The FCC had also proposed a rule requiring that an opt-out extend broadly across all automated marketing and informational communications from the same sender — a “revocation-all” requirement that would have swept healthcare exemption messages into a single opt-out event. In January 2026, the FCC delayed that requirement until January 31, 2027, while it reconsiders the scope of the rule. Healthcare organizations should monitor this development because a broad revocation-all rule, if it ultimately takes effect, will require significant patient communication database management to ensure that opt-outs are applied consistently across all automated outreach channels.

AI-Specific Compliance Considerations for Patient Messaging

Deploying AI in patient communication systems creates several compliance obligations that standard TCPA practice does not fully address.

Content Generation Controls

AI messaging platforms optimize for engagement. An AI system trained to maximize appointment scheduling rates may autonomously generate message variations that include language the system has learned improves response rates — language that may shade into promotional content and destroy the healthcare exemption. Every AI-generated message variation needs to be reviewed against the non-commercial requirement before deployment. Automated content generation without human review of the compliance implications creates systematic exemption risk.

Dynamic Consent Management

AI patient communication systems typically send personalized messages based on patient data, health status, and care management workflows. Consent records need to be as dynamic as the messages. A patient who consents to appointment reminders has not consented to AI-generated wellness coaching messages. A patient who opted out of marketing communications has revoked all consent. The consent database needs to be connected to the AI outreach system with controls sufficient to prevent messages from reaching patients who have not provided the required consent for the specific type of communication being sent.

Frequency Monitoring

The healthcare exemption’s three-messages-per-week limit applies per purpose. An AI system managing a patient’s care across multiple conditions — sending reminders for a diabetic patient’s endocrinology appointments, medication adherence for their cardiac medications, and post-discharge follow-up from a hospitalization — may be generating multiple message streams. The system needs to aggregate frequency across all automated outreach to that patient and enforce the limits at the individual patient level.

Third-Party AI Vendor Relationships

Healthcare organizations increasingly deploy AI patient communication systems built by third-party vendors. TCPA liability in this context is not limited to the third party doing the sending. The healthcare organization on whose behalf the messages are sent bears responsibility for the compliance of the outreach program. Contracts with AI patient communication vendors should include:

• Representations and warranties that the platform is designed to comply with TCPA requirements
• Indemnification provisions covering TCPA claims arising from the vendor’s platform operations
• Audit rights sufficient to verify consent management, frequency controls, and opt-out processing
• Requirements that the vendor notify you promptly of regulatory developments or enforcement activity affecting its platform

A standard SaaS agreement is not sufficient. TCPA exposure is too large, and class action risk too real, to leave liability allocation to default contract rules.

State Law Additions: Where the TCPA Floor Is Not the Ceiling

Federal TCPA compliance is necessary but not sufficient for digital health companies operating nationally. Several states have enacted laws imposing more stringent requirements than the federal statute.

Florida’s Telephone Solicitation Act uses a broader definition of autodialer than the federal statute and imposes stricter consent requirements for texts to Florida consumers. Oklahoma’s Consumer Protection Act similarly expands the autodialer definition. Washington state’s Consumer Protection Act has been used by plaintiffs to bring state-law claims alongside TCPA claims, and Washington’s strong private rights of action make it an active litigation jurisdiction for communication privacy claims.

Companies running national AI patient outreach programs need to assess state-specific requirements for the states where their patient populations are concentrated. Compliance at the federal floor does not guarantee compliance at the state level, and state law claims can carry per-violation damages independently of federal TCPA liability.

Practical Compliance Architecture for AI Patient Communications

A compliant AI patient communication program in 2026 needs to be built on the following structural elements.

Documented consent collection. Every patient receiving automated communications needs to have provided the appropriate level of consent for the specific type of communication they will receive. Consent records need to be maintained in a format that can be produced in litigation — including the date and method of consent, the specific communications consented to, and any subsequent revocations.

Real-time opt-out processing. Opt-out requests need to be processed immediately and applied across all automated outreach channels. A patient who opts out of appointment reminders has effectively opted out of all automated communications from your organization. Your system needs to enforce that result, not manage it as a channel-specific preference.

Message content review for AI-generated variations. Before any AI-generated message variation is deployed at scale, it needs to be reviewed against the healthcare exemption’s non-commercial requirement. Automated content generation without compliance review creates systematic liability.

Frequency tracking at the individual patient level. Daily and weekly message frequency limits need to be enforced across all automated outreach streams for each patient, not just within individual program tracks.

State law assessment. For states where your patient population is concentrated, assess whether state law imposes requirements beyond the federal TCPA floor and build those requirements into your operational procedures.

Vendor contract review. Review your AI patient communication vendor agreements for TCPA-specific representations, warranties, and indemnification provisions. If they are absent, negotiate them.

The TCPA is not going away, and the class action plaintiffs’ bar is not losing interest in healthcare defendants. Digital health companies that build compliant patient communication architectures from the start will avoid the disruptive, expensive remediation that comes with reacting to a demand letter or class certification motion.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.