AI No-Show Recovery and Reminders: HIPAA Plus TCPA Without Tripping Either

The TCPA healthcare exemption permits one call or text per day, three per week, sixty seconds or less, no marketing — and the FCC made it crystal clear in 2024 that AI voice falls under the same rule. HIPAA wraps another layer on top.

What this workflow does

flowchart TD
  In[Patient interaction] --> MinNec{Minimum necessary?}
  MinNec -->|yes| Process[AI process]
  MinNec -->|no| Reject[Block + log]
  Process --> Encrypt[(AES-256 at rest)]
  Encrypt --> DB[(PostgreSQL)]
  Process --> Audit[(Audit trail)]
  DB --> Right[Right of access §164.524]

The AI agent calls or texts a patient 48 hours before an appointment with a confirmation prompt, again 24 hours before with a reminder, and again the morning of with a directions or telehealth-link push. If the patient confirms, the slot holds. If the patient cancels, the slot opens and the recovery flow tries to fill it from a waitlist. If the patient no-shows, the recovery flow runs immediately — outbound to the patient with a rebooking offer and to the next waitlist patient with the open slot.

Done well, the workflow drops no-show rates from 18–25% to 6–10% and lifts capacity by 4–8 visits a week per provider. Done badly, it gets the practice on a TCPA class-action plaintiff list.

HIPAA constraints

Reminders are treatment and operations under 45 CFR 164.501, so no separate authorization is needed beyond the Notice of Privacy Practices. The minimum-necessary standard at 45 CFR 164.502(b) governs voicemail and SMS content: name, practice, callback are fine; diagnosis, specialty (when stigmatizing), or medication are not. The voicemail rules at HHS FAQ 198 confirm that practices may leave appointment-reminder voicemails with minimum-necessary content unless the patient has restricted that channel under 45 CFR 164.522.

TCPA at 47 USC 227 plus the FCC's healthcare exemption at 47 CFR 64.1200(a)(3)(v) permits prerecorded and AI-voice calls for treatment-related purposes without prior express consent, but caps frequency at one call or text per day, three per week per provider, sixty seconds for calls, 160 characters for texts, and bars all marketing content. The FCC's February 2024 declaratory ruling extended TCPA to AI-generated voices explicitly. Patients can revoke consent through any reasonable method, with revocation honored within 10 business days.

How CallSphere implements it

CallSphere's Healthcare Voice Agent ships reminders as the send_reminder and run_recovery tools — 2 of 14 healthcare tools. The agent introduces itself in the first sentence as required by the FCC AI-voice ruling: "Hi, this is the AI assistant from [Practice]." Frequency caps are enforced at the platform level — the system blocks any send that would breach the one-per-day or three-per-week ceiling. Voicemail content stays in the safe zone: name, practice, generic context, callback. SMS stays under 160 characters with a STOP keyword and an HHS-aligned opt-out. Every revocation is honored within minutes, far inside the 10-business-day FCC clock. Recovery flows pull from the waitlist with the same constraints. Every send is captured in post-call analytics in the encrypted healthcare_voice PostgreSQL database (1 of 115+ tables), with sentiment (–1.0 to +1.0), lead score (0–100), AI summary, and audit trail. HIPAA and SOC 2 aligned, 37 agents and 90+ tools across 6 verticals. Pricing on /pricing; start with the 14-day trial or talk to us at /contact.

Implementation checklist

1. Identify the call or text as AI-generated in the first sentence — FCC requirement.
2. Cap frequency at one send per day, three per week per provider — TCPA healthcare exemption ceiling.
3. Keep voice messages under 60 seconds and SMS under 160 characters.
4. Strip diagnosis, medication, and stigmatizing specialty from voicemail and SMS content.
5. Implement STOP, opt-out, and revocation across all channels with same-day honoring.
6. Record patient channel preferences from intake — phone, SMS, email, portal — and respect them.
7. Track 45 CFR 164.522 restrictions and route around restricted channels.
8. Sign BAAs with SMS gateway, voice carrier, and any sub-processor.
9. Capture quiet-hours rules per state — California, New York, and Florida have stricter caps than the federal default.
10. Audit-log every send with timestamp, channel, content category, and disposition.
11. Run weekly QA: sample of voicemails, sample of SMS, drift checks on the AI script.
12. Monitor opt-out rate as a leading indicator of script drift.

FAQ

Does the TCPA healthcare exemption cover AI voice? Yes — the FCC's February 2024 declaratory ruling extended TCPA to AI voices and confirmed the healthcare exemption applies, subject to the same caps and disclosure expectations.

Can we leave the appointment time and provider name in a voicemail? Time and practice name are typically minimum necessary. Provider specialty is fine for general practice; specialty disclosure becomes a privacy issue for behavioral health, oncology, infectious disease, and reproductive health.

What about email reminders? Email is not under TCPA but is under CAN-SPAM and HIPAA. Encrypt or use portal links; do not put diagnosis or medication in the subject or body.

Do recall and reactivation campaigns count as marketing? HHS treats appointment scheduling and treatment reminders as healthcare operations, not marketing. The line moves when you are pushing elective procedures or third-party products — that is marketing under 45 CFR 164.508 and requires authorization.

Sources

• 47 CFR 64.1200 FCC TCPA Rules: https://www.ecfr.gov/current/title-47/section-64.1200
• FCC Declaratory Ruling on AI Voices (February 2024): https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf
• HHS FAQ 198 Voicemail Reminders: https://www.hhs.gov/hipaa/for-professionals/faq/198/may-a-health-care-provider-leave-a-message/index.html
• 45 CFR 164.522 Right to request restrictions: https://www.ecfr.gov/current/title-45/section-164.522
• 45 CFR 164.502 Minimum necessary: https://www.ecfr.gov/current/title-45/section-164.502