Texting patients legally: quiet hours, consent, and opt-outs for behavioral health

Texting patients in a therapy practice sits on top of two separate rulebooks that people routinely collapse into one. HIPAA governs what you are allowed to say. The TCPA governs whether you were allowed to send anything at all. A message can be perfectly fine under HIPAA and still be a TCPA problem, and the reverse happens too. Getting texting patients right under both HIPAA and TCPA in therapy comes down to a handful of operational decisions you make once and then enforce automatically, because enforcing them by hand fails the first busy week.

Standard caveat, stated once: I am describing how practices generally set this up, not giving you legal advice, and if you are running a substance-use program or doing anything that looks like outbound marketing, a lawyer who does health communications is worth the hour.

What does the TCPA actually allow a therapy practice to text?

The short version is that treatment messages sent to a number the patient gave you ride the healthcare exemption. Appointment reminders, results-are-ready notifications, care instructions, intake paperwork links, a same-day note after a missed session. These are the messages you have a real reason to send, and the exemption exists because regulators recognized that. The FCC's consumer guidance on unwanted calls and texts describes the regime the exemption sits inside, and it is worth reading once so you know what the other side of the line looks like.

The exemption stops being your friend the moment a message starts serving your business rather than the patient's care. Re-engagement blasts to people who stopped coming eight months ago, birthday messages, announcements that you are now offering ketamine-assisted therapy, referral asks, satisfaction surveys tied to review requests. Those are marketing-adjacent and need prior express written consent, gathered separately from your general consent-to-treat.

The trap for small practices is the re-engagement campaign, because it feels clinical. You genuinely do want to know how the person who dropped out in March is doing. Send that one from a human, individually, or make it a phone call. Automated bulk outreach to a lapsed list is the shape of thing the TCPA was written about.

What can actually go in the message?

HHS has said for years that providers may text patients with reasonable safeguards, which sounds permissive until you notice SMS travels unencrypted and lands on a lock screen. So the workable answer is to stop trying to secure the channel and instead control the payload. Neutral text, portal link for anything real.

Things that should never appear in a text you send:

• Diagnoses, or anything that implies one
• PHQ-9, GAD-7, or any assessment score
• Medication names, dosages, or refill details
• Group names that describe the group ("Wednesday DBT skills")
• Anything about a crisis contact, hospitalization, or safety plan
• Billing detail beyond "you have a statement waiting"

A reminder that reads "Reminder: appointment with Dana, Thu Jul 30, 2:00pm. Reply C to confirm" tells the patient everything they need. If they need more, the portal link handles it behind a login. This is also the reason to keep clinician first names rather than full names with credentials in the message: "Dana" is a reminder, "Dr. Dana Ruiz, Addiction Psychiatry" is a disclosure.

Get a business associate agreement with whoever transmits the messages. Your practice management system, your standalone messaging vendor, whatever sits between you and the carrier. A vendor that will not sign one cannot lawfully handle your PHI, which ends the evaluation there.

Does 42 CFR Part 2 change the rules?

Substantially, yes, and this is where practices get caught. The 2024 final rule amending 42 CFR Part 2 has been fully in force since February 16, 2026. Under Part 2, the fact that someone is affiliated with a substance-use treatment program is itself protected. The affiliation, on its own, before you say anything about diagnosis or attendance.

Practically that means your sender identity carries risk. If texts arrive from "Riverside Recovery Center," you have disclosed program affiliation to anyone who picks up that phone, including a partner, a parent, or an employer holding a work device. Use a neutral sender name, keep the clinic's programmatic identity out of the message body, and have documented consent for automated outreach before you turn any of it on. If you run both general mental health and a Part 2 program under one roof, the safe default is to apply the stricter standard to everyone rather than maintain two message templates and hope routing never breaks.

When are you allowed to send?

Treat 8am to 9pm in the recipient's local time as the boundary. Two implementation details matter more than the rule itself. First, the time zone has to be the patient's, and the moment you see anyone across a state line by telehealth, "our office hours" stops being a workable proxy. Second, decide what happens to a message that would have gone out at 9:40pm: it should hold until 8am, not fire anyway and not silently vanish. A dropped reminder is worse than a late one, because staff will assume it went.

Frequency deserves a cap too, even though no statute hands you a number. Automated systems are very good at stacking: a reminder, a form request, a balance notice, and a survey can all land on the same Tuesday because each was configured by someone thinking about their own sequence. Set a per-patient ceiling across all automated messages, three in a rolling seven days is a reasonable starting point, and let clinical messages from a human bypass it.

How do you handle STOP without breaking care?

Honor it immediately and everywhere. The FCC's consumer guidance on unwanted texts makes the expectation plain, and carriers enforce it independently of anything you decide. Three things that separate a real opt-out implementation from a nominal one:

1. The opt-out applies to every automated message, not just the sequence that triggered it. If a patient replies STOP to a billing text and still gets appointment reminders, you have a compliance problem and an angry patient.
2. Clinical staff can see it. The clinician needs to know that reminders are not reaching this person, otherwise the next no-show gets attributed to the patient instead of to your plumbing.
3. There is a fallback. When SMS goes dark, the patient should roll to email or a phone call automatically, since the underlying need for the reminder has not gone anywhere. A Cochrane review of mobile phone reminders found a risk ratio around 0.77 for non-attendance against no reminder, and losing that for a patient because a channel was switched off is a real cost.

Reinstating someone requires a fresh opt-in from them. Do not let a staff member flip the toggle back because the patient "said it was fine" on the phone, unless that conversation gets documented as consent.

The setup that keeps you out of trouble

Say you are a four-clinician group adding automated messaging this month. The configuration worth writing down before anything sends: patient-provided mobile captured at intake with a consent checkbox that separates treatment messages from anything promotional; templates reviewed once so none of them contain clinical content; quiet hours set on patient-local time with held-and-released behavior; a weekly per-patient cap; opt-out that propagates across every sequence and is visible in the chart; a per-patient log of every send so that when someone says they never got a reminder, you can answer instead of guess.

That last item earns its keep faster than you expect. Most texting disputes in practice are not legal, they are factual arguments about whether a message went out, and a timestamped log ends them in ten seconds.

Valence builds these constraints into its care pathways rather than leaving them to configuration discipline: quiet hours at 8am to 9pm in the patient's local time, per-patient weekly send caps, automatic opt-out handling that applies across pathways, and a per-patient send log. SMS runs $0.03 a message, email is free. The pathway automation page shows how the pieces fit. For the wider compliance picture in a small practice, our HIPAA checklist for solo practitioners walks the rest of the surface: BAAs, device encryption, audit logs, and the breach plan you want written before you need it. If you are comparing platforms on this, the SimplePractice alternatives rundown looks at how each one handles messaging.