Ecommerce OS · Telehealth8 min readUpdated November 3, 2026

SMS Flows for Telehealth Companies

The SMS flows a telehealth brand can send, the consent each one needs under the TCPA health care rules, what a text can say, and opt-out rules.

Nick Bonnassies, CMO at Tagada · checked against 10 sources

Article summary

TL;DR

A telehealth brand should text for a few time-sensitive moments: an unfinished intake, a case update, a shipment, the next refill, a failed payment. Marketing texts need prior express written consent; some health care messages from a HIPAA covered entity are exempt, but billing and promotional texts never are. Keep every text free of medical detail.

Marketing texts sent with an autodialer need "prior express written consent", except a "health care" message from a HIPAA covered entity or its business associate (47 CFR 64.1200(a)(2)).
A separate free-to-patient exemption covers prescription notifications and similar texts, with limits: 160 characters, one a day, three a week, no billing or marketing content.
A reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" revokes consent, to be honored within 10 business days.
The FCC's "revoke-all" rule, which extends one opt-out to unrelated messages, is delayed until January 31, 2027 (order of January 2026).
Solicitation texts are barred before 8 a.m. and after 9 p.m. at the recipient's location.

Want to go further? Ask

On this page

This guide is part of our playbook on the best ecommerce platform for telehealth companies. The general guide, for any store: SMS marketing for ecommerce. Longer messages belong in email flows for telehealth companies.

The TCPA rules sort texts by purpose. A telehealth brand sends all three kinds, often from the same number.

Kind of text	Examples	Consent needed	Rule
Marketing	Offers, win-back, new services, abandoned checkout with a promotion	Prior express written consent, naming the phone number, not a condition of purchase	64.1200(a)(2) and (f)1
"Health care" message from a covered entity	Messages about the patient's care, sent by or for a HIPAA covered entity	Exempt from the written consent requirement; prior express consent still applies to autodialed texts	64.1200(a)(1) and (a)(2)1
Free-to-patient health care text	Appointment reminders, lab results, "prescription notifications"	Exempt from consent if all conditions are met (below)	64.1200(a)(9)(iv)1

The second row only helps if HIPAA applies to you. A covered entity is a health plan, a clearinghouse, or a provider that transmits health information electronically in a standard transaction2. Many cash-pay brands need a lawyer to answer that for each entity.

The free-to-patient exemption has strict conditions1:

Sent only to the wireless number the patient provided.
States the name and contact information of the provider.
160 characters or less.
One message a day, three a week at most, per patient.
No telemarketing, solicitation or advertising, and no "accounting, billing, debt-collection, or other financial content".
Opt-out by replying STOP, honored immediately.
Not charged to the patient or counted against their plan.

160

Characters at most in a free-to-patient health care text

1 a day

And three a week at most, per patient

10 business days

Longest time allowed to honor an opt-out from other texts

Watch out

A failed payment text or a refill charge reminder is billing content. It does not fit the free health care exemption, even when it concerns a prescription. Get consent for it at checkout.

Flow	Trigger	Timing	Consent to plan for
1. Unfinished intake	Intake started, not submitted	1 hour later, once	Written consent if it promotes; keep it a plain reminder
2. Abandoned checkout	Checkout started, no payment	30 minutes to a few hours	Written marketing consent
3. Case update	Clinician decision	On the event	Health care message; "your case has an update" and a portal link
4. Shipped	Pharmacy ships	On the event	Consent given at checkout for order updates
5. Next refill charge	Upcoming rebill	A few days before	Consent at checkout (billing content); at least 7 days before a trial ends for Visa6
6. Failed payment	Rebill declined	Day 0, then once within a week	Consent at checkout (billing content)
7. Promotions and win-back	Campaigns	Rarely	Written marketing consent

Flows 3 to 6 should fire from the case and the shipment, not from a calendar. That is how a telehealth stack with storefront, doctors, pharmacy and payments like Tagada Rx sends them.

Fig. 1Three texts, three consent rules

Consent behind each text

Case update: a health care message, fired by the clinician decision.
Shipped: consent given at checkout for order updates.
Failed payment: billing content, so consent at checkout.

BrandMonCase updateYour case has an update. See it in your portal: [link]
BrandWedShippedYour order has shipped. Track it here: [link]
BrandDay 0Payment failedYour plan's payment didn't go through. Update your card: [link]

Nothing on the lock screen says what the patient is treated for.

Illustrative example.

Speed matters most for flow 6. Recurly reports that 90% of recovered failed payments come back within 10 days7. The full sequence is in failed payment recovery for telehealth companies.

Renewal and trial texts touch card network rules too: Tagada follows Visa and Mastercard rules and the laws that apply to payments.

What a telehealth text can say

A text shows up on a lock screen. Write it so anyone glancing at the phone learns nothing medical.

Brand name first
So the patient knows who writes.
No treatment names, conditions or intake answers
"Your order", "your plan", "your case".
One action, one link
To the portal or the checkout.
No medical claims or advice
Clinical questions go to the care team in the portal.
Opt-out wording
In the first text and regularly after: "Reply STOP to opt out."

Example

"Brand: your next order ships on March 4 and will be charged that day. Skip, pause or cancel: [link]. Reply STOP to opt out."

Ask for the phone number with its purpose next to it: order and care updates.
Add a separate, unchecked box for marketing texts. The disclosure must say the patient authorizes marketing texts and is "not required to sign the agreement" to buy1.
Store the proof: the wording shown, the time, the number.
Check state rules. Florida and Oklahoma have their own consent rules for marketing texts, as reported by Medical Economics5.
Register your sending numbers. Carriers can filter texts from unregistered 10-digit numbers (10DLC registration), according to the same source5.

Store the proof for every consent you collect.

Since the Supreme Court's Facebook v. Duguid decision (April 1, 2021), the federal autodialer definition is narrower4. State laws and the written consent rules for prerecorded messages still apply, so treat written consent as the default for marketing.

This is general information, not legal advice.

Opt-outs

Rule	What it requires
Keywords	"stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" revokes consent; other words count if a reasonable person would read them as a request (64.1200(a)(10))1
Deadline	Within a reasonable time, not more than 10 business days (64.1200(a)(10))1
Confirmation	One confirmation text is allowed, with no marketing in it (64.1200(a)(12))1
Free health care texts	Opt-out by replying STOP, honored immediately (64.1200(a)(9)(iv))1
Revoke-all	One opt-out covering unrelated message types: delayed until January 31, 2027 (FCC order, as reported by Burr & Forman)3

Measure SMS

Metric	Formula	Watch for
Consent rate	Phones with consent ÷ checkouts	Low: purpose not clear at checkout
Intake completion after text	Completed intakes ÷ texts sent (flow 1)	Where patients drop
Rebills recovered by SMS	Recovered ÷ failed payments texted	SMS vs. email only
Opt-out rate	Opt-outs ÷ texts delivered	Rising: too many texts
Complaints	Carrier filtering, replies like "who is this"	Brand name missing

How Tagada helps

The payment layer behind renewal and refill texts

A renewal text only helps if the charge behind it goes through. TagadaPay handles that layer: "Every transaction is scored against your live MID network in real time."10

Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with a cascade to another processor when one is down or times out
Your vault, portable: "Switch processors without re-onboarding customers"
Fraud and security: "Native 3DS2, device intelligence, and rules engine"
Support: "24/7 human support on Slack Connect"

Building a telehealth brand from scratch? Tagada Rx runs storefront, doctors, pharmacy and payments in one stack, with an Email + SMS module "Fired by real events"8; notifications stay content-free, and declined or cancelled cases never rebill, so no text announces a charge that will not happen9. US patients only, by selection.

Start free

The payment layer behind renewal and refill texts

Updated on November 3, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Can a telehealth company text patients without written consent?

For marketing, no: autodialed marketing texts need prior express written consent. A "health care" message from a HIPAA covered entity is exempt from the written consent requirement, and some free-to-patient texts such as prescription notifications are exempt if every condition is met. Billing and promotional texts never qualify.

Are refill reminder texts allowed?

A text that only notifies the patient about a prescription can fit the health care rules. A text that announces a charge, a price or an offer is billing or marketing content and needs the matching consent. Collect it at checkout, separately from the purchase.

Can a text name the patient's medication?

Keep it out. A text is visible on a lock screen and stored by carriers. Say "your order" or "your plan" and link to the portal, where the patient logs in to see details.

What time can I send texts to patients?

Telephone solicitations are banned before 8 a.m. and after 9 p.m. at the recipient's location. Schedule by the patient's time zone. Event texts, such as shipping updates, are best sent in the same window.

Do I need a HIPAA-compliant SMS platform?

If a covered entity uses the platform to send protected health information, the vendor is a business associate and needs an agreement. Texts with no clinical detail lower the risk, but confirm your setup with counsel.

Sources

Checked November 3, 2026

Tagada

Texts fired by the case and the shipment, with the right consent

Funnels, one-click upsells, subscription billing and payment routing, on one customer record.

Start free See pricing

01Create your free account
02Connect your store or build a checkout
03Launch funnels, upsells and subscriptions