TCPA, HIPAA and AI reminder calls: what US practices should know

Automated appointment reminders are routine in US healthcare — but when the voice on the line is AI, two sets of rules apply at once: the Telephone Consumer Protection Act (TCPA), which governs how you may call patients, and HIPAA, which governs what happens to their health information.

Start with the TCPA. In February 2024 the FCC confirmed that AI-generated voices count as an “artificial or prerecorded voice” under the Act, so an AI reminder call is treated like any other automated call. For calls to mobile phones, the FCC exempts health care messages — appointment confirmations and reminders among them — from the stricter consent requirements, but only within limits: call only the number the patient gave you, name the provider, keep it free to the patient and concise (generally a minute or less), no marketing or billing, at most one call a day and three a week, and an easy opt-out that is honored right away.

HIPAA comes in the moment patient data leaves your walls. Any vendor that handles protected health information on your behalf is a business associate, and you need a signed Business Associate Agreement (BAA) before sharing that data. Share only the minimum needed, and be careful with voicemail: a message left on a machine should say who is calling and ask for a call back — not reveal the reason for the visit.

In practice it comes down to a short checklist: call only the number on file, say who is calling and that it’s an automated assistant, keep the call to the appointment, respect sensible calling hours, cap how often you try, and make “stop calling me” work the first time, on every channel. Ask any vendor how each point is enforced in the product, not just promised in the contract.

Vera is built around that checklist. It introduces itself as the practice’s digital assistant, doesn’t record call audio (it keeps a written transcript and the outcome for your staff), sticks to the appointment, contacts patients only within the hours and the number of attempts each practice sets, and flags a patient who asks not to be contacted at once — no further automated calls or messages.

None of this is legal advice, and your obligations depend on your practice and your state — some states add their own rules on top of the TCPA. Check with your counsel before you switch on automated calls.