GUIDE · CONFIGURATION

Configuring communication workflows for Florida practices under HIPAA and the TCPA

Three rulebooks apply to every automated text, email, and call a Florida practice sends: HIPAA, the federal TCPA, and Florida’s own Telephone Solicitation Act. This guide turns them into settings. Each rule is cited to its section so your counsel can check it, and each recommendation is something a workflow can actually enforce.

Published September 11, 2026 10 min read

What this is: a configuration guide written by the people who build intake workflows for South Florida practices, with the rules cited. What it is not: legal advice. Statutes change, your practice’s covered-entity status is a question for your counsel, and nothing here substitutes for their review.

The three rulebooks, and which settings each one touches

Most practices think of this as one problem called “compliance.” It is three, with different agencies enforcing them and different settings satisfying them. The good news is that a single well-configured workflow satisfies all three; the bad news is that a workflow configured for only one of them can be in breach of the other two.

HIPAA (45 C.F.R. PARTS 160 AND 164)

Governs what a message may contain and who may see it. The provisions that matter for intake are the definition of marketing (§164.501), the authorization required before marketing with PHI (§164.508(a)(3)), the minimum-necessary standard (§164.502(b)), reasonable safeguards (§164.530(c)), and the technical safeguards of the Security Rule (§164.312). Enforced by HHS Office for Civil Rights.

TCPA (47 U.S.C. §227; 47 C.F.R. §64.1200)

Governs whether you may send an automated text or call at all, and when. Requires prior express consent for automated informational messages to mobile numbers and prior express written consent for marketing ones; sets quiet hours of 8 AM to 9 PM in the recipient’s local time (§64.1200(c)(1)); and, under the FCC’s 2024 order, requires opt-outs made by any reasonable means to be honored within ten business days. Statutory damages are $500 per violation and up to $1,500 if willful (§227(b)(3)). Enforced by the FCC and, in practice, by private class actions.

FLORIDA TELEPHONE SOLICITATION ACT (FLA. STAT. §501.059)

Florida’s own layer, which covers text messages as well as calls. Tighter than federal law on three points: quiet hours are 8 AM to 8 PM (§501.059(4)(a)); no more than three telephonic sales calls in 24 hours on the same subject (§501.059(4)(b)); and prior express written consent is required before any automated system is used to send a sales message (§501.059(8)(a)). A 2023 amendment lets a recipient stop texts by replying with a plain request and gives the sender fifteen days to comply before liability attaches. Same $500 and $1,500 damages structure as the TCPA (§501.059(10)).

Two things sit alongside the statutes and are just as capable of stopping your messages. Carrier registration for application-to-person texting (A2P 10DLC) is a CTIA and carrier requirement, not a law, but unregistered traffic is filtered or blocked, and healthcare is a use case carriers review. And Florida’s recording statute (§934.03) requires all parties’ consent to record a call, which turns a voice agent’s opening line into a compliance control.

Step 1: decide which channel is allowed to carry what

Before any message is written, decide the content policy per channel and make the workflow enforce it. The minimum-necessary standard (§164.502(b)) is the rule; the practical version is that a channel’s protections should match what travels on it. Carrier SMS is not end-to-end encrypted in transit whatever platform sends it, so the only durable way to keep clinical detail out of an unencrypted text is to design the text so it never asks for any.

First-touch reply (SMS, email, web chat): logistics only. Acknowledge, offer availability, ask for language preference. Never ask what brings them in, never echo back anything they volunteered.
Reminders and confirmations: date, time, location, provider first name, how to reschedule. HHS treats appointment reminders as permitted treatment communications, provided reasonable safeguards apply, and the safeguard is brevity.
Intake forms: the only place clinical questions live, served over TLS and stored inside the HIPAA-enabled platform under a BAA. Never emailed as an attachment, never collected in a chat widget.
Voice agent: scheduling and logistics only. Anything clinical is escalated to a human, and the agent is configured not to record clinical content into a transcript it would then retain.
Social messaging (Facebook, Instagram, WhatsApp): off, unless your platform provider has confirmed BAA coverage for those channels in writing. Ours has not published that coverage.

A useful test for any template: if this message were read aloud in a waiting room, would it disclose that the recipient is a patient and why? A reminder that says “Tuesday at 3, Coral Gables office” passes. One that says “your EMDR session” does not.

Step 2: capture consent that satisfies all three rulebooks at once

One checkbox can do the work if it is written properly, placed properly, and stored properly. It must be separate from the clinical consent and from the Notice of Privacy Practices acknowledgment: neither of those is messaging consent, and a plaintiff’s attorney will point that out.

Unchecked by default, clearly and conspicuously worded, and specific about the channel: that the practice may send automated texts and calls about scheduling and follow-up to the number provided, that consent is not a condition of receiving care, that message and data rates may apply, and how to stop.
In the language of the form. A Spanish intake form with an English consent line is a consent that the signer may not have understood. The Spanish version is written by a person, not a plugin, and includes the Spanish stop words.
Stored as a record, not a flag. Timestamp, source form, IP address, the exact consent text version shown, and the language it was shown in. Under §501.059(8)(a) and the TCPA’s written-consent rules the burden of proof is on the sender.
Scoped to what you will actually send. If any message in the sequence promotes a service the person has not asked about, that is marketing, and it needs the written-consent standard rather than the informational one. Most intake sequences can be written to stay informational. Write them that way.

Step 3: set quiet hours to Florida’s window, not the federal one

The TCPA permits solicitation calls and texts from 8 AM to 9 PM local time. Florida cuts the evening off at 8 PM. A workflow configured to the federal window sends an hour of messages every evening that Florida law does not permit if they count as telephonic sales calls, and a follow-up to someone who inquired but has not yet booked can be read that way. Set the window to 8 AM to 8 PM in the recipient’s time zone and be done with the argument.

Quiet hours apply to scheduled sends: nurture steps, reactivation, reminders queued in advance. Hold them and release at 8 AM.
The immediate reply to an inbound message is a response to the person’s own request, which the Florida act carves out of its definitions. Answer at 10:40 PM. Do not follow up at 10:50.
Frequency cap: no more than three outbound contacts in 24 hours on the same subject (§501.059(4)(b)). Configure it as a hard limit, not a guideline.
Time zone: use the recipient’s, derived from area code or stated preference, not the practice’s. A Brickell practice with a patient in Texas is sending into Central time.

Step 4: make opt-out work in both languages and across every channel

Recognize STOP, and in Spanish ALTO and PARE, plus the plain-language requests the FCC’s 2024 order says you must honor: “stop texting me,” “no me escriban más,” and the like. A keyword-only filter is no longer enough.
Honor it within ten business days at the outside; configure it to be immediate.
Propagate it. An opt-out by text should stop automated calls to that number too, and vice versa, unless the person says otherwise. Stop on reply, stop on booking, stop on opt-out are three separate exits and a sequence needs all three.
Confirm once and then go silent. One confirmation message is expected; a second is a violation.
Log it with the same care as the consent record. Revocation disputes are decided on records.

Step 5: keep the website itself from leaking

The largest recent enforcement actions over health data have not been about text messages. They have been about tracking pixels. HHS OCR’s bulletin on online tracking technologies, first issued in 2022 and narrowed by a federal court in 2024, and the FTC’s 2023 actions against GoodRx and BetterHelp over sharing visitor data with advertising platforms, describe the same failure: a form or page where a person reveals a condition, and a third-party script watching.

No advertising pixels on any page where a person can book, submit a form, or select a service. If a Meta or Google Ads tag must exist, keep it on general pages and keep it off the intake path.
Analytics only behind consent, and configured never to receive form contents, URL parameters that name a service, or user identifiers.
Session-recording and heat-map tools off the intake path entirely.
Chat widgets treated as intake: served over TLS, inside the BAA boundary, and not asking clinical questions.

Step 6: scope the voice agent and announce the recording

Florida requires the consent of all parties to record a conversation (§934.03). The agent’s first sentence, in whichever language it continues in, states that the call may be recorded. No exceptions, no shortening.
Scope: scheduling, directions, hours, insurance and fee logistics, callback requests. It does not take a history and it does not answer clinical questions; it offers a human.
Retention on recordings and transcripts is a setting, and default-forever is a decision. A transcript containing clinical detail is PHI. Set a retention period your counsel is comfortable with and apply it.
The provider names Reviews AI as handled under its HIPAA module and is silent on conversation and voice AI. Treat that silence as a boundary, and keep what the agent hears to logistics.

Step 7: register the sending number before the first message

A2P 10DLC brand and campaign registration, with the campaign described honestly as healthcare appointment and intake messaging. Misdescribed campaigns get rejected or, worse, approved and later suspended.
Sample messages submitted for registration should be the real templates, with the opt-out language included.
Toll-free numbers need their own verification. Either way, allow for the review period in your go-live timeline.

The go-live checklist

This is the list we run before any practice’s intake system is switched on. Each line is a setting or a document, and each one can be checked.

Content policy per channel written down and reflected in every template
Consent checkbox unchecked by default, clear and conspicuous, in English and in Spanish, separate from clinical consent and the NPP acknowledgment
Consent record stores timestamp, source, IP, text version, and language
Quiet hours set to 8 AM to 8 PM in the recipient’s time zone; immediate inbound replies exempt; scheduled sends held
Frequency cap of three contacts per 24 hours on the same subject enforced by the workflow
STOP, ALTO, PARE, and plain-language revocation recognized; opt-out propagated across channels; one confirmation only
Stop on reply, stop on booking, stop on opt-out configured on every sequence
No advertising pixels or session recording on the intake path; analytics consent-gated and stripped of form data
Voice agent announces recording, scoped to logistics, retention period set on recordings and transcripts
Social messaging channels off
A2P 10DLC or toll-free registration approved before the first send
HIPAA module active on the agency account and HIPAA mode enabled on this sub-account, confirmed on the day
BAA executed between the practice and the configuring agency, and the agency’s BAA with the platform in hand

Every item above is something we build into a TheraCRM.pro configuration by default, and it is also something any practice can ask any vendor to demonstrate. The list is more useful to you as a set of questions than it is to us as a feature list.

Questions we get asked about this

Why 8 PM and not 9 PM?

The federal TCPA permits solicitation calls and texts until 9 PM local time. Florida's Telephone Solicitation Act stops at 8 PM (Fla. Stat. 501.059(4)(a)) and covers text messages. A follow-up to someone who inquired but has not booked can be read as a telephonic sales call, so the Florida window is the safe one. Immediate replies to an inbound message are a response to the person's own request and are treated differently.

Is an appointment reminder marketing under HIPAA?

No. HHS treats appointment reminders as treatment communications, which are permitted without an authorization provided reasonable safeguards apply. The safeguard is content: date, time, place, and how to reschedule, without the reason for the visit. A reminder that names the service or condition is a different message.

Does a signed Notice of Privacy Practices count as consent to text?

No. The NPP acknowledgment is a HIPAA document about how the practice uses and discloses health information. Consent to receive automated texts and calls is a TCPA and Florida requirement and has to be captured separately, in clear language, in the language of the form, and stored with a timestamp and the exact text shown.

Our voice agent records calls. Is that allowed in Florida?

Only with all parties' consent (Fla. Stat. 934.03). In practice that means the agent states at the start of every call, in the language the call continues in, that the call may be recorded. A caller who objects is transferred to a human on an unrecorded line or offered a callback.

Does TheraCRM.pro guarantee compliance if we follow this guide?

No, and no vendor honestly can. The guide describes settings that satisfy the cited rules as we read them, and every TheraCRM.pro configuration ships with them applied. Your practice's policies, training, and counsel review are the rest of the picture, and statutes change. Treat this as the checklist your counsel reviews, not a substitute for that review.

Is your therapy CRM HIPAA compliant? What the platform’s HIPAA module does, what an agency has to do with it, and the five questions to ask. Read more HIPAA and your CRM The three-way split between platform, configurator, and practice, and what stays with you. Read more

Want the checklist run against your current setup?

A 30-minute consultation walks through each line with whatever you have in place today, and tells you plainly which settings are where they should be and which are not.

Book a Consultation HIPAA & BAA detail