Telehealth SMS: Consent, 10DLC and Messages That Convert

Two texts. Which one would you send?

"Hi Dana, your weight-loss program review is ready. Your last dose is due Friday."

"Hi Dana, it's Bright Clinic. Your visit is confirmed for Thursday at 3. Reply STOP to opt out."

The first one feels warmer and more specific. It is also the one I would never send. It tells whoever sees the screen that Dana is a patient and what for, and it is a marketing-flavored message built on health details. The second one does the job and keeps the story out of the message.

This post is educational and not legal advice. Run your own program past counsel who knows telehealth and messaging law.

Why is SMS both the best channel and the riskiest?

A text lands in the same place as a message from a friend, which is exactly why it works. It is also why consent, frequency and content are treated so seriously. Carriers police what reaches phones, and regulators police how you got the number and what you say.

For a telehealth clinic there is a third layer: the message itself can reveal something about a person's health. That makes content discipline as important as consent.

What is 10DLC, and do you need it?

A2P 10DLC is the carrier standard for application-to-person texts sent through ordinary 10-digit local numbers. Twilio describes the goal in two words:

That is the whole philosophy of the system.¹

Registration has two parts:¹

• Brand: who you are, so carriers can confirm you are legitimate. Standard and Low-Volume Standard brands require a Tax ID.
• Campaign: how people opt in, opt out and get help, and what the messages are for.

Twilio notes that registering means less message filtering and higher throughput, and that unregistered traffic from a Twilio 10DLC number incurs additional carrier fees.¹ Treat that as the cost of skipping the process: more filtered messages, slower delivery and a bill.

What to prepare before you register

• Your legal business name and tax ID.
• A plain description of why you text: appointment reminders, intake follow-ups, check-ins.
• The exact opt-in language and where it appears.
• Your STOP and HELP responses.
• Sample messages that match what you will send.

Mismatch is the usual problem. If you register for appointment reminders and then send promotions, expect trouble.

What counts as consent?

Consent is clear, specific and provable. A checkbox that is not pre-checked, next to words that say who is texting, what kind of messages to expect and that message and data rates may apply, is the standard pattern. Save the timestamp, the page version and the number.

The legal ground shifted a bit this year. In January 2025 a federal appeals court threw out the FCC rule that would have limited consent to "no more than one identified seller."³ (I covered it in One-to-One Consent Was Vacated.) That specific requirement is gone. The law firm's advice afterward is still sensible: keep monitoring TCPA developments and consider the consent requirements from wireless carriers, messaging providers and industry guidelines.³

CTIA, the wireless industry association, publishes its Messaging Principles and Best Practices, and the May 2023 edition is public.⁶ Its original 2017 guidance told senders to seek express consent and offer a STOP opt-out.⁵ Read the current edition yourself. Your messaging provider will hold you to it even though it is not itself a statute.

No consent log, no program. If a patient claims they never opted in, your answer should be a record, not a recollection.

What happens when someone says STOP?

You stop, quickly, and across every way they might say it. Nixon Peabody's summary of the FCC rules that took effect on April 11, 2025:²

• Consumers can revoke consent in "any reasonable manner."
• Requests using stop, quit, revoke, opt out, cancel, unsubscribe or end must be honored.
• Revocation requests must be processed within a reasonable time not exceeding 10 business days.
• A broader requirement, that a revocation in response to one type of message applies to all future messages from that caller on unrelated matters, was delayed to April 11, 2026.

My advice: process opt-outs immediately, not on day nine, and sync them across every tool that can send a text. The most common failure is a stop reply that works in one system while an automation in another keeps firing.

How do you keep health details out of your texts?

Two rules.

Rule one: the text proves that a relationship exists at most. It should not name a condition, a medication, a dose, a result or a program that implies one.

Rule two: details live behind a login. The text says there is something to see. The patient portal shows it. The same discipline applies to tracking pixels on patient pages.

HIPAA's authorization rule for marketing is worth knowing even if you are not sure it applies to you. A covered entity generally must obtain an authorization for any use or disclosure of protected health information for marketing, with narrow exceptions such as a face-to-face communication or a promotional gift of nominal value.⁴ Whether you are a covered entity depends on your setup, so ask counsel. Writing neutral texts is cheap insurance either way.

Marketing claims in texts follow the same rules as ads. The FTC's health guidance says ads must be truthful and not misleading and that claims need adequate substantiation before they run, and a text is an ad.⁷

What do texts that convert have in common?

They are boring in the best way.

Text is best for nudges that save a human step: reminders, confirmations, a link to finish a telehealth intake form. Use email for anything that needs space and a record, and make sure it is authenticated.

A launch checklist

• Brand and campaign registered, with samples that match your real messages.
• Consent language live on every form, with logging.
• STOP, HELP and "unsubscribe" handled instantly and synced everywhere.
• Message templates reviewed for health details and unsupported claims.
• A named owner for compliance, and a calendar reminder to review quarterly.

Do these five things and your texts are easier to deliver, easier to defend and nicer to receive. For the wider funnel around them, see my telehealth page.

Keep building.Ekai