Opt In Once: The TCPA Healthcare Exemption, HIPAA Texting Rules, and One Consent Record for Every Channel

What the TCPA healthcare exemption, HIPAA texting rules, and the 2025 opt-out rule require, and why one agency number makes the consent record defensible.

KK

Krishna KurapatiQliqSOFT Blog · September 3, 2026

An admission packet runs forty pages. One line on one of them decides whether you will be able to reach the family for the next six months: the phone number they wrote down, and what you asked their permission to do with it. This is the first post in our One Agency, One Number series, and it starts here because everything else in the series, the saved contact, the callbacks, the voice agent, the transition from home health to hospice, rests on a consent record that was captured once and captured well.

A word on scope before the rules. This post describes how the rules work and what a defensible record contains. It is not legal advice, and your admission language is your counsel's call. What follows is the mechanics.

What the TCPA healthcare exemption actually covers

The TCPA healthcare exemption

The Telephone Consumer Protection Act governs calls and texts to mobile numbers that are placed with an autodialer or use an artificial or prerecorded voice, which in practice covers every text a platform sends on your behalf. Statutory damages run $500 to $1,500 per message, with no cap, through private and class actions. In its 2015 omnibus ruling the FCC addressed healthcare directly: when a patient gives a phone number to a HIPAA-covered provider, that act is prior express consent for calls and texts that carry a healthcare message from the provider or its business associates (FCC 15-72). Two limits matter for an agency. The consent covers healthcare messages, not billing, payment, or marketing, which need their own consent. And it attaches to the number the patient provided, for messages from the organization they provided it to.

HIPAA texting rules vs. TCPA consent

HIPAA and the TCPA answer different questions, and an agency needs both answers. HIPAA texting rules govern what is in the message and how it is protected: protected health information sent by text is permitted when the patient has been told that ordinary SMS is not encrypted and has agreed to receive it anyway, or when the text carries only a secure link and the health information stays behind it. The TCPA governs whether you had permission to send the message at all. A HIPAA-compliant platform with no TCPA consent record is still exposed; a TCPA-consented text that pastes a diagnosis into an unencrypted SMS is still a HIPAA problem. The consent record described below covers the TCPA half; the secure-link pattern covers the HIPAA half, which is why the two travel together on one number.

10DLC registration

Since 2021 the U.S. carriers have required any business texting from a standard ten-digit number to register the brand and the campaign with The Campaign Registry. Unregistered traffic is filtered or blocked, and the registration is what ties a number to a named sender and a stated use. The part most agencies miss: a registered 10DLC number carries voice, SMS, and MMS on the same number. The same ten digits can be the number nurses call from, the number texts arrive from, and the number a family calls back.

The 2025 revocation rule: opt-out by any reasonable means

Effective April 11, 2025, consent can be revoked by any reasonable means: a reply of STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE, or plain words to the same effect, and a business may no longer name the one channel it will accept (FCC 24-24; a limited waiver on one provision ran to April 2026, DA 25-312). The scope is narrower than the headline suggests. When a patient replies STOP to a healthcare treatment message, the provider must stop that type of message; it may continue other types of informational messages unless the patient says otherwise. A revocation is a fact about one channel and one purpose, and the record has to capture it that way.

Why many numbers make consent fragile

Here is how consent breaks in a typical agency. The patient gave a number at admission. The EHR's reminder module texts from a short code the patient never agreed to hear from. The scheduler calls from the office line. The nurse texts from a personal phone. The after-hours service calls from its own number. Each system keeps, or does not keep, its own consent flag. When the family replies STOP to the short code, nobody tells the scheduler. When a surveyor or a plaintiff's lawyer asks what the patient consented to and when, the answer lives in four systems, and one of them is a nurse's phone.

One number changes the shape of the problem. There is one sender for the patient to recognize and one sender for the consent to name. The admission language can say exactly what the number will do: texts, links to forms and consents, calls from the care team, and calls answered by the agency's automated assistant when nobody is free. One opt-in covers the set. One record holds it.

One number, one TCPA consent record: what it has to contain

A record you can defend answers five questions without a search:

1. Who. The patient or caregiver, and which number they gave. When the contact is a spouse or adult child, the record names them, not just the patient.
2. When. A timestamp on the consent and on every change to it.
3. How. The method: a QR code in the packet, a reply to the first text, a signature on paper. Opt-In Plus captures it at admission with a print-friendly QR flyer and logs the affirmative reply; Quincy's first text asks for the opt-in before any conversation continues.
4. What they were shown. The wording in force at the time, including which channels it named.
5. Every revocation, with its scope. STOP on a text stops texts; a request on a call to stop calling is a separate event about calls. Each one is logged against the channel it applies to, so a text opt-out never silently ends the phone relationship, and a phone request is never lost because it did not arrive as a keyword.

Sample SMS consent language for one agency number

Descriptive, not prescriptive: this is the shape of admission wording that names one number and every channel it carries. Your counsel adapts it.

By giving us this mobile number, you agree that [Agency] and its care team may text you about your care at this number, including links to forms, consents, and visit information, and may call you at this number, including calls answered by our automated assistant when a team member is not available. Message and data rates may apply. Reply STOP at any time to stop text messages; tell us on any call if you no longer want calls. This consent does not cover billing or marketing messages.

Three things make that wording work with the TCPA healthcare exemption and the revocation rule: it names the number, it names each channel (texts, links, calls, the automated assistant), and it tells the patient how to revoke by channel. The record then shows the version the patient saw.

In QliqSOFT all of this lands in the Opt-In Report: consents, revocations, timestamps, and method, exportable when someone asks. That is the artifact your compliance officer wants in the survey binder, and it exists because there is one number to report on.

STOP means what it says, and only that

A common fear about one number is that a single STOP will take the whole relationship down with it. It does not, and the rule does not require it to. A text STOP ends text messages. The phone relationship continues: the nurse still calls, the family still calls back, the voice agent still answers. If the family says on a call that they want no more calls, that is honored for calls and logged as such. The point of one number is not that one word turns everything off. It is that every word is recorded against the channel it was about.

The consent that travels with the patient

A home health patient who moves to hospice inside the same organization does not start over. The consent was given to the agency and its care team, the number has not changed, and the thread continues. When care ends and bereavement begins, the caregiver who was already on the thread becomes the contact, on the same number, without a second packet. How far that single consent reaches depends on the admission language your organization uses, which is exactly why the wording deserves counsel's attention once, at the template, rather than improvisation at every transition. The fourth post in this series covers the transitions in detail.

Pull your baseline this week

We do not yet publish outcome data from agencies running one number; adoption is early and we would rather show real figures later than borrowed ones now. You can start your own baseline today: export the Opt-In Report, and note three numbers. How many active patients and caregivers have a documented opt-in. How many revocations arrived in the last quarter, and through which channel. How many contacts saved your number. Six months from now those three lines are the before-and-after your board will ask for.

What we are not claiming

We describe the rules; we do not interpret them for your organization, and nothing here is legal advice. We do not claim that one consent legally covers every future service line for every organization; we say the record and the wording are what make that possible, and that counsel should review the wording. And we do not claim the voice agent is triage: it captures the reason for a call and routes it to the on-call nurse; clinicians make the clinical decisions.

Krishna Kurapati · Founder & CEO, QliqSOFT

Founder & CEO of QliqSOFT. Building healthcare communication solutions for 12+ years. Focused on closing gaps in care through technology that enhances human connection.