HIPAA-Compliant Appointment Reminders: What HHS Allows and How to Send Them Safely

Yes, appointment reminders are allowed under HIPAA. The U.S. Department of Health and Human Services (HHS) treats appointment reminders as part of a patient’s treatment, so providers can send them without a separate written authorization. HIPAA-compliant appointment reminders follow four rules:

1. Share only what is needed: name, date, time, place, and a callback number. Leave out diagnoses, procedures, and test names.
2. Use reasonable safeguards for each channel, such as checking the phone number or email address before sending.
3. Honor reasonable patient requests to be contacted another way, such as by phone instead of text.
4. Sign a business associate agreement (BAA) with any vendor that sends reminders using patient information.

Calls, voicemails, texts, emails, and postcards can all be used this way. The details for each channel are below, along with templates and what to check before using tools like Square, HubSpot, or appointment reminder calls from an outside service.

HIPAA Appointment Reminders: What HHS Actually Says

Most articles on this topic paraphrase. Here is what HHS’s own guidance says, in plain words.

Reminders are treatment, so no authorization is needed

HHS answers the question directly in its FAQ: appointment reminders “can be made without an authorization” because they are part of the patient’s treatment. They are also not marketing, so the stricter marketing rules do not apply when the message is only about the appointment.

Leaving messages and mailing reminders is allowed

HHS says the Privacy Rule does not stop providers from leaving messages on answering machines or with a family member who answers, or from mailing reminders to patients’ homes. Providers should limit what they say, for example, the practice name and a callback number, and use professional judgment about what a family member should hear.

Email is allowed with safeguards

HHS says providers may communicate with patients by email if they use reasonable safeguards: check the address, limit the information, and meet the Security Rule. If a patient finds unencrypted email unacceptable, the provider should offer a more secure method, mail or phone.

Patients can ask to be contacted another way

Under HIPAA, patients can make reasonable requests to receive communications by a different method or at a different location. HHS gives the example of a patient who wants reminders by email instead of postcard. Your reminder system needs a way to record and follow these preferences.

What a HIPAA-Compliant Reminder Can and Cannot Say

The minimum necessary standard is the rule of thumb: include only what the patient needs to show up.

Safe to include:

• Patient’s first name
• Practice name (or a neutral name if your specialty is sensitive)
• Date, time, and location or video visit instructions
• What to bring, such as ID or an insurance card
• How to confirm, cancel, or reschedule
• A callback number and opt-out instructions

Leave out:

• Diagnosis, reason for the visit or symptoms
• Procedure, test or medication names
• Specialty names that reveal a condition, such as an addiction or HIV clinic name
• Full date of birth, medical record number, or insurance ID
• Balances owed or payment details
• Links that open records without a login

Your no-show policy can be mentioned in general terms (“please give 24 hours’ notice”), but fees or balances belong in a secure message or a phone call, not a text.

Compare:

Risky: “Reminder: your colonoscopy prep starts tonight. Appointment tomorrow 8 AM with Dr. Lee, GI clinic.”

Safer: “[Practice]: Reminder of your appointment tomorrow at 8:00 AM. Please follow the instructions given at your last visit. Questions? Call [Number].”

HIPAA Compliant Reminders by Channel

Channel	What HHS guidance says	Main risk	Safer practice
Phone call	Allowed as a treatment communication	Talking to the wrong person	Confirm you have the patient before giving any detail
Voicemail or message with family	Allowed; limit the information	Others hear the message	Name, practice and callback number only
Text message (SMS)	No separate HHS FAQ; the same reasonable safeguards approach as email applies	Standard SMS is not encrypted; shared phones	Minimum details, verified number, opt-out, vendor BAA
Email	Allowed with reasonable safeguards	Wrong address, shared inbox	Verify address, minimum details, offer secure option on request
Postcard or letter	Allowed to mail to home	Anyone in the home can read it	No reason for visit or specialty on the card
Patient portal or app	Covered by the Security Rule	Weak logins	Notify by text or email; keep details behind login

Are Text Appointment Reminders HIPAA Compliant?

Yes, text reminders can be HIPAA compliant. HIPAA does not ban texting patients. What matters is the content and the system that sends it.

• Keep the text minimal. Standard SMS is not encrypted, and other people may see a phone’s lock screen. Treat a text like a postcard.
• Verify the number when the patient books, and update it when it changes.
• Get consent and offer an opt-out. Telephone and texting rules also apply. Under the FCC’s healthcare exemption, automated appointment reminder texts to a patient’s mobile number must stay free of marketing and billing content, go no more than once a day and three times a week, and include an easy way to stop, such as replying STOP.
• Honor opt-outs quickly. FCC rules in effect since April 2025 require businesses to honor a request to stop texts or calls within 10 business days.
• Use a vendor that signs a BAA if it stores or processes patient information to send the texts.

For wording you can copy, see our appointment reminder templates.

Email Appointment Reminders and HIPAA

Email reminders are allowed. Keep three things in mind:

• Subject lines show up in previews. Use “Your upcoming appointment,” never the procedure or specialty.
• Plain reminders do not need encryption if they contain only minimum details, but anything with health information should go through an encrypted email or portal.
• Marketing emails are different. A newsletter promoting a new service is marketing, not treatment, and follows stricter rules. Keep reminders and promotions separate.

Automated and AI Appointment Reminders

Automation does not change HIPAA’s rules. It changes who handles the data.

The reminder vendor is usually a business associate

A company that stores your patient list and appointment times to send reminders on your behalf is a business associate, and you need a BAA with it. HHS describes a narrow “conduit” exception for services that only transmit data with temporary storage, like the postal service. A reminder platform that keeps your schedule and contact data does not fit that exception.

What to ask any HIPAA-compliant appointment reminder software vendor

1. Will you sign a business associate agreement?
2. Where is patient data stored, and is it encrypted at rest and in transit?
3. Who on your team can access our patient data?
4. Can we control exactly what each message says?
5. Can patients choose their channel and opt out, and do you record that?
6. Do you keep audit logs of messages sent?
7. How quickly will you tell us about a security incident?

AI voice reminders

AI reminder calls follow the same content rules as a person: confirm identity, give minimum details, leave short voicemails. Two extra points: the FCC treats AI-generated voices as artificial voices under the TCPA, so the consent rules for automated calls apply, and the AI’s call recordings and transcripts are patient information that needs the same protection as your scheduling data.

Reminders exist to keep patients coming. If you want to go further on attendance, our post on how AI appointment setters reduce no-shows covers rebooking and follow-up.

Square, HubSpot and Other General Tools

General business tools are popular with small practices, but HIPAA support varies by product and by feature.

Square Appointments

Square’s HIPAA page (updated March 16, 2026) says its business associate agreement is part of its terms, but “not all Services are HIPAA-enabled,” and customers are “solely responsible” for deciding whether and how to use Square with patient information. It excludes data from Square’s buyer-facing services, including appointment bookings made there, and makes customers responsible for services that communicate with their customers. If you use Square for reminders, confirm in writing which features are covered before including any patient details.

HubSpot

HubSpot added sensitive data features for Enterprise subscriptions, and business associates serving HIPAA-covered clients can agree to its BAA. Its terms allow sensitive data only in the features it lists as covered. HubSpot has also said it does not provide encrypted email, so sensitive data cannot be used in email personalization. For dental and medical practices, confirm which HubSpot tools (reminders, workflows, SMS, meetings) fall under the covered list before sending patient information through them.

Dental and medical practice software

Practice management and patient communication platforms built for healthcare usually offer a BAA as standard. Our dental appointment reminder guide compares reminder tools for dental offices.

HIPAA-Compliant Reminder Templates

Text, two days before:

[Practice]: Reminder of your appointment on [Day] at [Time]. Reply C to confirm or R to reschedule. STOP to opt out.

Voicemail:

“Hi, this message is for [First name]. This is [Your name] from [Practice] calling about your upcoming appointment. Please call us back at [Number]. Thank you.”

Email:

Subject: Your upcoming appointment

Hi [First name], this is a reminder of your appointment with [Practice] on [Day, Date] at [Time] at [Address]. Please bring a photo ID and insurance card. To change your time, call [Number] or log in to your patient portal.

Telehealth:

[Practice]: Your video visit is [Day] at [Time]. Join from your patient portal 5 minutes early. Help: [Number].

Phone call opening:

“Hi, may I speak with [First name]? … This is [Your name] from [Practice]. I’m calling to confirm your appointment on [Day] at [Time].”

For handling replies on the phone, see our appointment confirmation call script.

Where The DBT AI Fits

The DBT AI makes automated appointment reminder calls for medical, dental and other practices.

• Calls before each visit at the times you choose, then texts the date, time and location
• Patients confirm or cancel on the call, and the status shows in your calendar or system
• Separate calls to rebook cancellations and no-shows
• You control the wording, so reminders stay within minimum necessary details
• HIPAA-ready for patient information; ask about a BAA and your data setup on the demo call
• Calls only people who asked to hear from you, with reminders kept free of promotions

For more on how AI phone systems protect patient data, read our guide to AI receptionist HIPAA compliance, or see how it works in a dental answering service.

FAQ

Are appointment reminders HIPAA compliant?

Yes. HHS treats appointment reminders as part of treatment, so they can be sent without a separate authorization. They must include only the information needed and be sent with reasonable safeguards.

Are text appointment reminders HIPAA compliant?

Yes, if they contain minimum details, go to a verified number, include an opt-out, and are sent through a vendor that signs a BAA when it handles patient data. Leave out diagnoses, procedures, and specialties.

Does HubSpot offer HIPAA-compliant automated reminders for dental practices?

HubSpot offers sensitive data features and a BAA for Enterprise subscriptions, but sensitive data is allowed only in the features HubSpot lists as covered, and it does not provide encrypted email. Confirm with HubSpot which reminder, workflow and SMS tools are covered before using them with patient information.

Are appointment reminders sent by Square HIPAA compliant?

Not automatically. Square says not all of its services are HIPAA-enabled and that customers are responsible for deciding whether to use them with patient information. Confirm which Square Appointments features its BAA covers, and keep reminder content to minimum details.

Are automated appointment reminders HIPAA compliant?

They can be. Automation is allowed, but the vendor that sends them is usually a business associate that must sign a BAA, protect the data and let you control what each message says.

Are automated reminders HIPAA compliant for healthcare appointments?

Yes, when the content is limited, the vendor signs a BAA and patients can choose or stop the channel. Automated texts and calls to mobile numbers also need to follow FCC rules for healthcare messages.

Are email appointment reminders sent by Square HIPAA compliant?

Only if the specific feature is covered by Square’s BAA and the email contains minimum details. Square’s HIPAA page leaves this decision to the customer, so check with Square before relying on it.

Can I do appointment reminders under HIPAA?

Yes. Any covered provider can send appointment reminders. Keep them to the date, time, place and callback number, and respect patients’ channel preferences.

Does an appointment reminder text require patient consent, or is it a HIPAA violation?

A reminder text is not a HIPAA violation by itself, and HIPAA does not require a separate authorization. Telephone rules are different: automated texts to mobile numbers need the patient’s consent or must meet the FCC’s healthcare exemption conditions, including an easy opt-out.

Does HIPAA allow appointment reminders?

Yes. HHS says appointment reminders can be made without an authorization because they are part of treatment.

Send Reminders Patients Trust

Review your current reminders this week: read every template, remove anything that names a condition or procedure, check that each vendor has signed a BAA and make sure patients can choose or stop the channel. Those four steps cover most of what HIPAA expects.

To hear how The DBT AI handles a reminder call, talk to The DBT AI team.