Executive Summary
Therapy practices use SMS for appointment reminders, intake links, and occasional office updates. On US local numbers via practice management software, that is A2P 10DLC traffic requiring Brand and Campaign registration. Clinical sensitivity demands minimal necessary content in texts, strong access controls, and clear separation from marketing. HIPAA and state privacy duties may apply alongside TCPA and carrier rules—coordinate with healthcare counsel; this article focuses on 10DLC packaging and consent hygiene.
Short answer: Register Brand + Campaign for reminder/care texts; keep message content non-sensitive; obtain appropriate consent at intake; do not bolt therapy promo blasts onto reminder consent without PEWC analysis.
Who This Is For / Who It Is Not For
Who this is for
- Solo therapists and group practices
- Behavioral health clinics using scheduling SMS
- EHR/practice platforms onboarding clinician clients
Who this is not for
- Crisis-hotline short-code operators with specialized programs
- Non-SMS telehealth video-only stacks
Definitions
| Term | Practice meaning |
|---|---|
| Reminder SMS | Time/place logistics for appointments |
| Care notification | Office closure, telehealth link logistics |
| Marketing SMS | Promotional content—rare for many clinics; high scrutiny |
| Minimum necessary | Privacy principle—avoid diagnoses in SMS |
Use-Case Mapping
| Message | Campaign framing | Content rule |
|---|---|---|
| Appointment reminder | Customer Care / Account Notification | No diagnosis details |
| Telehealth join link | Customer Care | Authenticate appropriately |
| Card on file / billing | Account Notification | Avoid oversharing |
| Newsletter / workshop promo | Marketing | Separate PEWC |
Consent and Intake
Disclose SMS reminders during intake with purpose, rates, STOP/HELP. Marketing workshops need separate opt-in. Document consent in the EHR/PM system. Honor STOP even if it complicates reminder workflows—offer voice/email alternatives.
Sample Messages (Illustrative)
[Practice Name]: Reminder—appointment on [date] at [time]. Reply C to confirm, STOP to opt out, HELP for help. Msg & data rates may apply.
Avoid: diagnosis names, medication details, or “your depression follow-up” style content in SMS bodies.
Decision Framework
- Inventory SMS templates for PHI leakage.
- Choose 10DLC vs toll-free with privacy review.
- Register care-focused Campaign; add Marketing only if needed.
- Configure STOP with clinical ops fallback.
- Train staff never to text clinical details from personal phones for convenience.
Risk and Failure Modes
| Risk | Mitigation |
|---|---|
| PHI in SMS | Template review + BAAs with vendors |
| Personal phone workarounds | Policy ban + approved tools only |
| Marketing without PEWC | Separate opt-in or do not send |
| Shared family phones | Sensitive content policy |
Implementation Checklist
| Step | Owner | Artifact |
|---|---|---|
| PHI template audit | Privacy officer | Redlined templates |
| Brand/Campaign submit | Admin | IDs |
| BAA inventory | Privacy | Vendor list |
| STOP + clinic callback SOP | Ops | SOP |
| Staff attestation | Clinical director | Log |
Soft CTA
Preflight packaging with MyTCRPlus tools. Tools do not provide HIPAA certification.
FAQ
Do therapists need 10DLC?
For US local A2P SMS, typically yes (or another approved sender path).
Can I include the reason for visit in reminders?
Generally avoid clinical details in SMS; keep logistics only—confirm with privacy counsel.
Is intake form consent enough?
For reminders if clearly disclosed; marketing needs stronger separate consent.
What about group practices with many clinicians?
Often one Brand under the practice entity; confirm number assignment model with CSP.
Key Takeaways
- Register 10DLC for practice SMS platforms.
- Minimize clinical content in texts.
- Separate marketing consent if used.
- Coordinate TCPA with HIPAA/state privacy counsel.
- Ban unmanaged personal-phone clinical SMS.
Extended Implementation Playbook
This playbook converts the principles in the article into a sequenced project plan your team can execute without guessing.
Phase 0 — Discovery (week 1)
Interview every team that can trigger an SMS. Export template lists from each vendor. Classify each template as marketing, informational, or conversational care. Identify which legal entity owns each sending number. Capture current consent language screenshots. Produce a gap list: unregistered numbers, missing privacy URLs, bundled checkboxes, and vendors without STOP webhooks.
Phase 1 — Foundations (weeks 2–3)
Publish or repair website privacy and SMS terms. Align legal name and tax ID documents for Brand registration. Select Brand type with your CSP based on expected volume—without inventing universal fee or MPS figures. Draft Campaign descriptions using the who/who/why test. Write message flows that narrate the real opt-in path. Prepare sample messages with brand identification and STOP language.
Phase 2 — Registration (weeks 3–5)
Submit Brand; resolve verification issues immediately. Submit Campaign(s); respond to rejection reasons with packaging fixes rather than argument. Associate numbers only after approval. Configure HELP/STOP replies and test from multiple carrier handsets. Confirm CSP-stated throughput for planning.
Phase 3 — Controls (weeks 5–6)
Connect all vendors to a central suppression list. Enforce template governance so production copy cannot drift silently from registered samples. Train staff with send permissions. Stand up weekly metrics: delivery failures, STOP rate, HELP volume, and exception counts. Create an incident severity model for post-STOP sends and unregistered traffic.
Phase 4 — Scale (ongoing)
Expand locations or programs only after soft-launch metrics stabilize. Revisit packaging when adding loyalty vendors, franchise markets, or new promo calendars. Schedule quarterly counsel review for consent language and state overlays. Re-verify Brand data after mergers, rebrands, or address changes.
RACI snapshot
| Activity | Compliance | Marketing | Engineering | Counsel | CSP admin |
|---|---|---|---|---|---|
| Consent copy | A | R | C | C | I |
| Campaign packaging | R | C | I | C | A |
| Number association | C | I | R | I | A |
| STOP propagation | A | I | R | I | C |
| Incident response | A | C | R | C | C |
Evidence you should be able to produce in 24 hours
- Brand ID and Campaign IDs
- Live privacy and SMS terms URLs
- Opt-in screenshot with version date
- Consent record sample with timestamp and disclosure hash
- STOP log showing suppression timestamps across systems
- Current sample message library
If you cannot produce these, you are not ready for aggressive growth sends—regardless of how polished the marketing calendar looks.
Executive talking points
- Registration identifies us to carriers; it does not create recipient consent.
- Throughput and fees are provider-specific; we will not quote invented industry averages.
- STOP must work everywhere we can send, not only in the primary ESP.
- Template drift is a first-class risk and will be gated like a production change.
Adapt timelines to your CSP review queues. This playbook is operational guidance, not a guarantee of approval timelines or legal safe harbor.
Extended Implementation Playbook
This playbook converts the principles in the article into a sequenced project plan your team can execute without guessing.
Phase 0 — Discovery (week 1)
Interview every team that can trigger an SMS. Export template lists from each vendor. Classify each template as marketing, informational, or conversational care. Identify which legal entity owns each sending number. Capture current consent language screenshots. Produce a gap list: unregistered numbers, missing privacy URLs, bundled checkboxes, and vendors without STOP webhooks.
Phase 1 — Foundations (weeks 2–3)
Publish or repair website privacy and SMS terms. Align legal name and tax ID documents for Brand registration. Select Brand type with your CSP based on expected volume—without inventing universal fee or MPS figures. Draft Campaign descriptions using the who/who/why test. Write message flows that narrate the real opt-in path. Prepare sample messages with brand identification and STOP language.
Phase 2 — Registration (weeks 3–5)
Submit Brand; resolve verification issues immediately. Submit Campaign(s); respond to rejection reasons with packaging fixes rather than argument. Associate numbers only after approval. Configure HELP/STOP replies and test from multiple carrier handsets. Confirm CSP-stated throughput for planning.
Phase 3 — Controls (weeks 5–6)
Connect all vendors to a central suppression list. Enforce template governance so production copy cannot drift silently from registered samples. Train staff with send permissions. Stand up weekly metrics: delivery failures, STOP rate, HELP volume, and exception counts. Create an incident severity model for post-STOP sends and unregistered traffic.
Phase 4 — Scale (ongoing)
Expand locations or programs only after soft-launch metrics stabilize. Revisit packaging when adding loyalty vendors, franchise markets, or new promo calendars. Schedule quarterly counsel review for consent language and state overlays. Re-verify Brand data after mergers, rebrands, or address changes.
RACI snapshot
| Activity | Compliance | Marketing | Engineering | Counsel | CSP admin |
|---|---|---|---|---|---|
| Consent copy | A | R | C | C | I |
| Campaign packaging | R | C | I | C | A |
| Number association | C | I | R | I | A |
| STOP propagation | A | I | R | I | C |
| Incident response | A | C | R | C | C |
Evidence you should be able to produce in 24 hours
- Brand ID and Campaign IDs
- Live privacy and SMS terms URLs
- Opt-in screenshot with version date
- Consent record sample with timestamp and disclosure hash
- STOP log showing suppression timestamps across systems
- Current sample message library
If you cannot produce these, you are not ready for aggressive growth sends—regardless of how polished the marketing calendar looks.
Executive talking points
- Registration identifies us to carriers; it does not create recipient consent.
- Throughput and fees are provider-specific; we will not quote invented industry averages.
- STOP must work everywhere we can send, not only in the primary ESP.
- Template drift is a first-class risk and will be gated like a production change.
Adapt timelines to your CSP review queues. This playbook is operational guidance, not a guarantee of approval timelines or legal safe harbor.
Extended Implementation Playbook
This playbook converts the principles in the article into a sequenced project plan your team can execute without guessing.
Phase 0 — Discovery (week 1)
Interview every team that can trigger an SMS. Export template lists from each vendor. Classify each template as marketing, informational, or conversational care. Identify which legal entity owns each sending number. Capture current consent language screenshots. Produce a gap list: unregistered numbers, missing privacy URLs, bundled checkboxes, and vendors without STOP webhooks.
Phase 1 — Foundations (weeks 2–3)
Publish or repair website privacy and SMS terms. Align legal name and tax ID documents for Brand registration. Select Brand type with your CSP based on expected volume—without inventing universal fee or MPS figures. Draft Campaign descriptions using the who/who/why test. Write message flows that narrate the real opt-in path. Prepare sample messages with brand identification and STOP language.
Phase 2 — Registration (weeks 3–5)
Submit Brand; resolve verification issues immediately. Submit Campaign(s); respond to rejection reasons with packaging fixes rather than argument. Associate numbers only after approval. Configure HELP/STOP replies and test from multiple carrier handsets. Confirm CSP-stated throughput for planning.
Phase 3 — Controls (weeks 5–6)
Connect all vendors to a central suppression list. Enforce template governance so production copy cannot drift silently from registered samples. Train staff with send permissions. Stand up weekly metrics: delivery failures, STOP rate, HELP volume, and exception counts. Create an incident severity model for post-STOP sends and unregistered traffic.
Phase 4 — Scale (ongoing)
Expand locations or programs only after soft-launch metrics stabilize. Revisit packaging when adding loyalty vendors, franchise markets, or new promo calendars. Schedule quarterly counsel review for consent language and state overlays. Re-verify Brand data after mergers, rebrands, or address changes.
RACI snapshot
| Activity | Compliance | Marketing | Engineering | Counsel | CSP admin |
|---|---|---|---|---|---|
| Consent copy | A | R | C | C | I |
| Campaign packaging | R | C | I | C | A |
| Number association | C | I | R | I | A |
| STOP propagation | A | I | R | I | C |
| Incident response | A | C | R | C | C |
Evidence you should be able to produce in 24 hours
- Brand ID and Campaign IDs
- Live privacy and SMS terms URLs
- Opt-in screenshot with version date
- Consent record sample with timestamp and disclosure hash
- STOP log showing suppression timestamps across systems
- Current sample message library
If you cannot produce these, you are not ready for aggressive growth sends—regardless of how polished the marketing calendar looks.
Executive talking points
- Registration identifies us to carriers; it does not create recipient consent.
- Throughput and fees are provider-specific; we will not quote invented industry averages.
- STOP must work everywhere we can send, not only in the primary ESP.
- Template drift is a first-class risk and will be gated like a production change.
Adapt timelines to your CSP review queues. This playbook is operational guidance, not a guarantee of approval timelines or legal safe harbor.
Extended Implementation Playbook
This playbook converts the principles in the article into a sequenced project plan your team can execute without guessing.
Phase 0 — Discovery (week 1)
Interview every team that can trigger an SMS. Export template lists from each vendor. Classify each template as marketing, informational, or conversational care. Identify which legal entity owns each sending number. Capture current consent language screenshots. Produce a gap list: unregistered numbers, missing privacy URLs, bundled checkboxes, and vendors without STOP webhooks.
Phase 1 — Foundations (weeks 2–3)
Publish or repair website privacy and SMS terms. Align legal name and tax ID documents for Brand registration. Select Brand type with your CSP based on expected volume—without inventing universal fee or MPS figures. Draft Campaign descriptions using the who/who/why test. Write message flows that narrate the real opt-in path. Prepare sample messages with brand identification and STOP language.
Phase 2 — Registration (weeks 3–5)
Submit Brand; resolve verification issues immediately. Submit Campaign(s); respond to rejection reasons with packaging fixes rather than argument. Associate numbers only after approval. Configure HELP/STOP replies and test from multiple carrier handsets. Confirm CSP-stated throughput for planning.
Phase 3 — Controls (weeks 5–6)
Connect all vendors to a central suppression list. Enforce template governance so production copy cannot drift silently from registered samples. Train staff with send permissions. Stand up weekly metrics: delivery failures, STOP rate, HELP volume, and exception counts. Create an incident severity model for post-STOP sends and unregistered traffic.
Phase 4 — Scale (ongoing)
Expand locations or programs only after soft-launch metrics stabilize. Revisit packaging when adding loyalty vendors, franchise markets, or new promo calendars. Schedule quarterly counsel review for consent language and state overlays. Re-verify Brand data after mergers, rebrands, or address changes.
RACI snapshot
| Activity | Compliance | Marketing | Engineering | Counsel | CSP admin |
|---|---|---|---|---|---|
| Consent copy | A | R | C | C | I |
| Campaign packaging | R | C | I | C | A |
| Number association | C | I | R | I | A |
| STOP propagation | A | I | R | I | C |
| Incident response | A | C | R | C | C |
Evidence you should be able to produce in 24 hours
- Brand ID and Campaign IDs
- Live privacy and SMS terms URLs
- Opt-in screenshot with version date
- Consent record sample with timestamp and disclosure hash
- STOP log showing suppression timestamps across systems
- Current sample message library
If you cannot produce these, you are not ready for aggressive growth sends—regardless of how polished the marketing calendar looks.
Executive talking points
- Registration identifies us to carriers; it does not create recipient consent.
- Throughput and fees are provider-specific; we will not quote invented industry averages.
- STOP must work everywhere we can send, not only in the primary ESP.
- Template drift is a first-class risk and will be gated like a production change.
Adapt timelines to your CSP review queues. This playbook is operational guidance, not a guarantee of approval timelines or legal safe harbor.
Disclaimer
Informational only—not legal or medical privacy advice. Engage qualified healthcare counsel for HIPAA/state rules.