Patient Consent for Automated Healthcare Calls

Automated patient calls raise three separate consent questions. HIPAA needs no authorization for care or payment calls, but it does for marketing. The TCPA needs prior express consent for AI-voice calls to mobiles, with a narrow healthcare exemption for care messages, and written consent for offers. Recording consent depends on state law.

Key Takeaways

• AI voices count as artificial voices, so the calling rules apply in full.
• The healthcare exemption covers short care messages, never bills or offers.
• A refused consent form ends the calls, even when the exemption fits.

A patient's yes to a reminder call says nothing about recording it or offering something new. We keep the three consent questions apart, explain the healthcare exemption, and build its limits, opt-outs and billing rules into a Dograh agent. For the wider picture, see our guide to voice AI in healthcare privacy.

Three consent questions, kept apart

Each automated patient call answers to three different consent rules, and a yes under one never covers another. Keep them in separate fields in your records.

The first is the Health Insurance Portability and Accountability Act (HIPAA). It lets a provider use patient information for treatment, payment and health care operations without the patient's signed authorization, so a reminder about a booked visit needs none. Marketing is different. Using PHI to promote a product or service needs a signed HIPAA authorization, with narrow exceptions.

The second is the Telephone Consumer Protection Act (TCPA), which governs the call itself. The Federal Communications Commission (FCC) has ruled that an AI-generated voice is an artificial voice under the TCPA, in its 2024 declaratory ruling. So an AI agent calling a mobile needs the patient's prior express consent for a care or service call, and prior express written consent for anything that promotes a product or service.

The third is the recording. Federal and state wiretap laws decide whether you may record, and some states need every party to agree. For the state-by-state list and the wording of the spoken notice, see our post on call-recording consent laws.

What the healthcare exemption allows

The FCC's calling rule exempts some healthcare calls to mobiles from the consent requirement, and every condition matters. The call goes to the number the patient gave. It is about care, such as appointment confirmations and reminders, lab results, pre-op instructions, discharge follow-up, prescription notices or home care instructions. It names the provider and gives a way to reach them at the start.

The limits are strict. The call lasts about a minute, a patient gets at most one a day and three a week, and the call offers an easy opt-out that the provider honors at once. Nothing about accounting, billing, debt collection or other money matters may appear, and no telemarketing.

Landlines follow a related rule. A prerecorded or artificial-voice call that delivers a HIPAA health care message to a residential line needs no consent, within the same frequency limits, and an offer still needs written consent.

The exemption itself has critics. After the Supreme Court's 2025 McKesson ruling, which lets courts read the TCPA without deferring to the FCC, some TCPA lawyers question whether the exemption will hold. Treat that as commentary from lawyers rather than settled law, though it is still a good reason to keep written consent on file even for exempt calls.

Building the limits into the agent

Each condition maps to one place in your setup. The opening comes first. Write the practice's name and callback number in the Greeting Text on the Start Call node, since it plays word for word as the call connects. If you want to tell patients they're speaking with an automated assistant, or your location requires it by law, add that to the same text. Then turn off Allow Greeting Interruption on that node, which starts out on, so a patient who begins talking can't cut the practice name and number short.

Length and topic come from the prompt. Tell the agent to deliver the one care message, offer the opt-out and close, and not to discuss bills or offers. A prompt instruction can still be missed, so test calls with patients who raise a balance and check that the agent steers back.

Frequency belongs to your list. Dograh campaigns call the numbers you upload and retry unanswered calls twice by default. Build each list in your own system so it enforces one a day and three a week across all campaigns, and set retries to 0 when a retry would break the limit. Voicemail is off by default. If you turn it on for exempt calls, the message also carries the practice's name, callback number and how to opt out.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

Opt-outs and refusals revoke consent

Patients can take consent back in any reasonable way, and on an AI call that usually means saying so out loud, since the patient talks rather than pressing keys. In the prompt, tell the agent to recognise "stop calling me" and similar phrases, confirm, and call an HTTP API tool that writes the opt-out to your system. Your system then removes the number from the next list. Under the exemption, the provider honors that opt-out at once.

A refusal on paper counts as well. In Specht v. Lee Health System, a federal court in Florida found the reminder calls fit the exemption and that giving a number was consent. The patient had refused to sign the TCPA consent in the terms-of-treatment form, though, and the court held that refusal revoked consent, so the later calls broke the TCPA, as the National Law Review reported. Feed intake-form refusals into the same opt-out field the agent writes to.

The exemption still works when the records are clean. In Morris v. Lincare, the same court granted summary judgment for Lincare, holding that the exemption covered prerecorded supply calls made on consent the patient had given another provider, as TCPAWorld reported.

Billing, offers and recordings

Billing calls sit outside the exemption, so an automated outbound call about a balance needs consent that covers it. The safer design is to discuss balances only when the patient calls in, after the agent verifies them, and to have an HTTP API tool ask your billing system to send its own secure payment link by text or email. HIPAA-compliant voice AI for medical billing covers that setup.

Offers need both written TCPA consent and, when they use PHI, a HIPAA authorization. A recall call is care. Adding a whitening discount turns it into marketing, which our post on dental recall and recare outreach keeps separate.

Recording is switched on or off for the whole Dograh server rather than per caller. If a patient objects, the agent offers a callback from a person rather than continuing. These rules shift with state law and new rulings, so treat this as general information and have counsel review your consent forms and call scripts.