TCPA Compliance for AI Patient Calls: The 2026 Guide

What is the TCPA and why does it apply to patient calls?

The Telephone Consumer Protection Act (TCPA) is the 1991 federal law that restricts calls and texts placed with an autodialer or an artificial or prerecorded voice, sets the consent requirements for those calls, and created the national framework for Do Not Call rules. It is enforced by the FCC and, unusually, by private plaintiffs. Statutory damages are $500 per violation, trebled to up to $1,500 when a violation is willful or knowing, and every call or text counts separately.

That per-call arithmetic is why the statute matters so much for patient outreach. A program placing thousands of automated calls a week is making thousands of compliance decisions, each assessed on its own, so one gap is multiplied by every call it touches.

An automated patient call also sits under more than one body of law at once. Consig's research, One Call, Three Rulebooks, describes three:

• Telecom law governs how the call is placed: the TCPA, FCC consent and revocation rules, and the autodialer and prerecorded-voice definitions.
• Healthcare law governs what is said: identity verification before protected health information is discussed, and the minimum-necessary limit on what is shared.
• AI law governs the voice itself: AI-voice disclosure, and a widening patchwork of state rules on automated calling and biometric data.
• Together they can put a dozen rules on a single call, varying by state and changing by the month.
• Two common assumptions no longer hold: "we're healthcare, so we're exempt," and "consent is on file." The sections below explain why.

Are AI voices treated as robocalls?

Yes. In February 2024 the FCC issued a declaratory ruling that AI-generated voices, including voice cloning, are "artificial" voices under the TCPA. An AI voice agent placing outbound calls therefore makes robocalls in the legal sense, however conversational it sounds. There is a comfortable assumption that automation reduces legal exposure. For outbound calling the opposite is true: a synthetic voice does not lighten the TCPA burden, it places the call squarely inside it, now at machine scale.

The robocall rules are specific. The TCPA prohibits calls using an artificial or prerecorded voice to a wireless number without the called party's prior express consent, unless the call is for emergency purposes or falls under an FCC exemption. FCC rules require prior express written consent for prerecorded telemarketing calls to residential lines. Prerecorded messages must identify the calling entity at the start of the call and provide a telephone number, and prerecorded telemarketing calls must offer an automated opt-out.

The autodialer question is narrower than it used to be. In Facebook, Inc. v. Duguid, decided unanimously on April 1, 2021, the Supreme Court held that a device qualifies as an automatic telephone dialing system only if it can store or produce numbers using a random or sequential number generator. Equipment that only dials from a stored list, such as a patient roster, generally falls outside the federal definition.

That ruling does not help an AI voice program much. Duguid narrowed only the autodialer prong. Calls using an artificial or prerecorded voice, which now includes AI-generated voices, still need consent however the number was dialed, and Do Not Call rules are unaffected. Some states have also written broader definitions of automated dialing equipment into their own laws, so the federal ruling does not settle the question everywhere.

What consent do you need?

The TCPA distinguishes informational calls from telemarketing, and the consent standard follows the purpose of the call. For informational calls, such as appointment reminders or post-discharge check-ins, prior express consent can be given orally or by providing the number for a related purpose. FCC guidance has treated a patient giving their number to a healthcare provider as consent to calls closely related to the reason it was given.

Telemarketing raises the bar. Under the FCC rule adopted in 2012 and effective October 16, 2013, prior express written consent must bear the signature of the person called, identify the authorized number, clearly authorize telemarketing calls using an autodialer or an artificial or prerecorded voice, and disclose that signing is not a condition of purchase. Electronic signatures valid under the E-SIGN Act count. Adding a sales pitch to a care call is what moves it into this stricter standard.

The written-consent rule is under pressure from the courts. In January 2025 the Eleventh Circuit vacated, before it took effect, an FCC rule that would have required written consent to name one seller at a time (Insurance Marketing Coalition v. FCC). In February 2026 the Fifth Circuit held in Bradford v. Sovereign Pest Control that the TCPA's text does not require written consent for marketing calls at all, and a Maryland district court followed a month later. Courts elsewhere may still apply the FCC rule, so the safe operating assumption is uneven law across the country.

Consent also has to belong to the right person. Under the TCPA, consent comes from the current subscriber, so calling a reassigned number can be a violation even when the original consent was valid. The FCC's Reassigned Numbers Database answers whether a number has been permanently disconnected since a given date, with a safe harbor for callers that query it properly. OptumRx's wrong-number settlement shows why this data hygiene matters.

Responsibility for consent is shared between a platform and its customer. On Consig, the compliance engine enforces calling rules on every call, and under the Acceptable Use Policy the customer must obtain every consent the TCPA and related laws require before calls are placed, keep records of those consents, and provide them on request. See Security & compliance.

How does consent revocation work now?

Since April 11, 2025, a consumer can revoke consent through any reasonable means: saying so in the middle of a call, replying by text, or sending an email. The patient does not have to use the caller's preferred channel or keyword. The business must honor the request within 10 business days, down from the previous 30.

A broader "revoke-all" provision, under which opting out of one message type revokes consent for all automated messages from that sender, has been delayed to January 31, 2027 while the FCC reconsiders it under its "Delete, Delete, Delete" initiative. During the waiver, opting out of one healthcare message type stops only that type. The delay makes the rule harder to operationalize, not easier: a program has to run today's version correctly while staying ready for whichever way it lands.

The practical consequence is that consent is no longer a fact recorded once on a form. It is a state that can flip at any moment, arrive through any channel, and has to propagate across every active campaign. A patient who replies "stop" to a text from the hospital pharmacy should not get an automated call from a different department the following week, even a high-value one such as a post-discharge follow-up. Failures here are costly: Kaiser Permanente's $10.5M Fried v. Kaiser settlement involved texts sent after recipients replied "stop."

Treating consent as a live state means a program has to:

• Keep one consent system of record that every campaign reads from, with one source of truth per patient and message type.
• Recognize a mid-call opt-out the moment it is spoken, not only a reply to a designated keyword.
• Propagate a revocation across all channels well inside the 10-business-day window, so no campaign works from stale permission.
• Track the rules themselves, because parts of the revocation framework are under active reconsideration.
• Watch the record-keeping side: vCons, an IETF-track standard, package a conversation with its governance metadata, including consent.

What is the healthcare exemption, and why is it narrow?

The TCPA healthcare exemption comes from the FCC's July 2015 TCPA Omnibus Declaratory Ruling and Order. It allows certain calls and texts that have exigency and a healthcare treatment purpose, and are free to the recipient, to reach wireless numbers without prior express consent. Covered call types include appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions. A separate FCC provision covers certain prerecorded healthcare messages to residential lines.

The conditions are what make it narrow. A call that exceeds the frequency cap, or that adds billing content, falls outside the exemption, and the ordinary consent rules apply again. Because the FCC treats AI-generated voices as artificial voices, an AI call relying on the exemption has to meet the same conditions as a prerecorded one.

The exemption also does not reach everything a provider or plan calls about. The research behind this guide puts it bluntly: "we're healthcare, so we're exempt" is one of the assumptions that no longer holds. Even the FCC's waiver of its pending revoke-all rule works message type by message type. And healthcare organizations are now TCPA defendants, as the Fried v. Kaiser and Patterson v. OptumRx settlements show.

What are the calling-hour and frequency rules?

At the federal level, both the FCC's TCPA rules and the FTC's Telemarketing Sales Rule prohibit telephone solicitation calls before 8 a.m. or after 9 p.m., measured at the called party's location. The federal window applies to solicitations rather than purely informational calls, though many healthcare programs apply it, or a narrower window, to all outbound contact.

Several states are stricter. Florida's and Oklahoma's telephone solicitation acts, for example, limit solicitation calls to 8 a.m. through 8 p.m. local time and cap how many calls can be made to the same person on the same subject in 24 hours. Some states also restrict calls on Sundays or holidays. See calling-hour restrictions.

Applying these rules is harder than it looks, because a phone number no longer reliably shows where a person is. Patients keep their numbers when they move, so an area code can sit several time zones away from the handset. And calling-hour rules interact with frequency limits, including the one-per-day and three-per-week conditions attached to the healthcare exemption. In practice, a program needs to:

• Check both the patient's address of record and the number's area code, and call only when both fall inside the permitted window.
• Apply the window of the state the patient is in, not the state the program runs from.
• Count attempts per patient across campaigns, not per campaign, so retries do not quietly breach a frequency cap.
• Treat the federal solicitation window as a floor for all outbound contact if that is the program's policy, and write the policy down.

How do state mini-TCPA laws change the picture?

Mini-TCPA laws are state statutes that regulate telephone solicitations and automated calls and texts on top of the federal TCPA, often with their own consent rules, calling-hour and frequency limits, and private rights of action. The best-known is the Florida Telephone Solicitation Act (FTSA). Amendments that took effect in July 2021, a few months after Duguid, gave consumers a private right of action and reached calls made with automated systems defined more broadly than the federal autodialer, which set off a wave of class actions. Florida narrowed the law in 2023, including that definition, and added a notice-and-cure period for text messages. Oklahoma enacted a similar Telephone Solicitation Act in 2022, and other states have adopted their own versions.

These laws generally target telephone solicitations, so purely informational healthcare calls are often outside their scope. The line can be thin, and healthcare is not immune: the Kaiser Permanente settlement resolved claims under both the TCPA and the FTSA. Because state laws differ on calling hours, call frequency and consent, a program calling across state lines has to apply the rules of the state each patient is in.

State law reaches beyond telemarketing, too. States are adding AI-specific statutes, bot-disclosure laws, and rules on biometric data and call recording, and, as Consig put it at Plug and Play Orlando, more than 500 state-level regulations are emerging around AI-enabled communication. In some states, protected health information and biometric identifiers may not be permitted to reach a general-purpose AI model at all. So a state rule can change not only what a call must say, but which technology may handle which part of it.

Consig's compliance engine tracks the relevant federal, state and local policies, applies the calling rules that govern each call, and flags risky steps in the portal while a workflow is being built. More on the security page.

What does AI disclosure require?

At the federal level, the FCC's February 2024 ruling places AI-generated voices under the TCPA's artificial-or-prerecorded-voice rules, which already require identifying the calling entity at the start of the call, providing a telephone number and, for certain calls, offering an opt-out. The FCC has also proposed rules that would define AI-generated calls and require disclosure of AI use when consent is obtained and on the call itself. See AI voice disclosure laws.

States are adding their own requirements on top, through AI-specific statutes, telemarketing and bot-disclosure laws, and rules on biometric data and call recording. The result is that the required wording and timing of a disclosure can depend on where the patient is.

This is exactly the kind of step a generative model should not be left to phrase. A disclosure has to be delivered in the required words, at the required moment, on every call. A model that paraphrases a disclosure, or skips it when the conversation takes an unexpected turn, creates compliance exposure at machine scale. A disclosure step should:

• Run as scripted, deterministic logic rather than generated text.
• Select its wording from the rules of the patient's state, not a single national script.
• Fire at the required point in the call, including at the start when the caller has to identify itself.
• Be recorded as delivered, so the program can show after the fact that it happened.

Why is the litigation risk rising for healthcare?

In the first half of 2025, plaintiffs filed 1,052 TCPA class actions, against 539 in the same stretch of 2024, a 95% increase over a year that was already the worst on record. September 2025 alone set a single-month record of 224 filings, close to four times the prior September. More than three-quarters of TCPA suits are now filed as class actions, the format built for maximum leverage. A leading defense attorney has called the TCPA "the biggest cash cow in history" for the plaintiffs' bar, and expects filings to climb another 50%.

For years these looked like someone else's lawsuits: telemarketers, lead generators, solar installers. Two of the recent outcomes listed below are healthcare.

The OptumRx case deserves a second reading. The calls at issue were medication-adherence calls: clinically motivated, well-intentioned outreach that reached the wrong numbers. It is the exact fact pattern of a patient-outreach program with a consent and data-hygiene gap. The Kaiser case is the revocation problem in its plainest form: texts sent after recipients replied "stop."

The people who price risk have noticed. A July 2025 Munich Re Specialty advisory warned that "a single unsolicited message to 10,000 recipients could result in 10,000 violations, each carrying statutory penalties," and noted that many standard policies exclude TCPA claims outright, with only a limited market willing to cover the exposure at all.

What ties these cases together is that most violations are failures of execution, not intent: a consent status that did not propagate, a disclosure that did not fire, a number that kept dialing after an opt-out. At a few calls a day, a person catches those. At scale, only the system does. That is the argument for putting the rulebook inside the calling infrastructure, enforced on every call, rather than in a binder reviewed once a quarter. For the full picture, read TCPA Lawsuits Doubled, and Healthcare Just Joined the Defendant List.

• ~$145M: combined FTC judgment against Assurance IQ and MediaAlpha over an alleged "consent farm."
• ~$29.5M: Citibank settlement of robocall allegations.
• $10.5M: Kaiser Permanente, TCPA and FTSA class settlement over texts sent after recipients replied "stop" (Fried v. Kaiser, December 2025).
• $1.86M: OptumRx, robocall settlement over clinical-adherence calls placed to wrong numbers (Patterson v. OptumRx, March 2026).

Which steps must be deterministic?

What makes voice AI worth deploying is open-ended conversation, and it is probabilistic by design: the same input can produce a different, perfectly reasonable output. What makes a patient call lawful is the opposite. A disclosure has to be delivered in the required words, identity has to be verified before any protected health information is spoken, and an opt-out has to be recognized the moment it is said. Those steps are deterministic by definition.

"Almost always" is the wrong target. A system that behaves correctly 99% of the time still mishandles a legally binding step thousands of times across a large calling program, and each miss can carry per-call statutory damages. Forrester's 2024 AI Pulse survey found roughly 70% of U.S. generative-AI decision-makers believed a generative model always returns the same output for the same prompt. It does not. Forrester's Q2 2026 Conversational AI Wave, which screened about 650 vendors down to 14, required guardrails that are enforceable.

The resolution is a map, not a trade-off: match the conversational technology to each step of the call. The short, legally weighted steps run as scripted flows that behave identically on every call; the conversation between them stays natural, as the list below shows.

The map covers data as well as words. In some states, protected health information and biometric identifiers may not be permitted to reach the general-purpose AI path at all, so part of the design is deciding which data never touches the model. And the map moves as the law does, so it has to be redrawn when the rules change.

The division of labor with clinical staff should be just as explicit. The automation dials, verifies identity, walks the structured protocol and documents the call; it does not assess the patient or give medical advice. Every escalation needs an owner, decided before the first call. See What AI Should (and Should Never) Do on a Patient Call.

Consig workflows combine deterministic, scripted stages with generative stages, and generative AI runs only where it has been approved, so disclosures, consent capture, opt-outs and identity checks can run as scripted flows rather than being left to a language model. For how that differs from agent-first platforms, see Consig vs. generic voice AI agents.

• Scripted: the AI-voice disclosure and caller identification.
• Scripted: consent capture, and recognition of a spoken opt-out.
• Scripted: identity verification before any protected health information is discussed.
• Scripted: the minimum-necessary limit on what health information the call covers.
• Scripted: structured clinical screening, red-flag questions and clinical-instruction read-back.
• Generative: the moments in between that benefit from sounding natural, such as acknowledging a frustrated patient or finding a callback time that works.

How does HIPAA interact with TCPA on a call?

The TCPA governs whether and how a call may be placed. HIPAA governs what happens to the health information on it. HIPAA applies to covered entities and to the business associates that handle PHI on their behalf, and its Privacy Rule's minimum-necessary standard limits PHI use and disclosure to what a task requires. The healthcare exemption itself makes HIPAA compliance one of its conditions, so the two regimes meet on the same call.

On a patient call, HIPAA shapes two moments in particular. Identity has to be verified before any protected detail is spoken, since disclosing a diagnosis or appointment to the wrong person can be an impermissible disclosure; even confirming that someone is a patient of a specific clinic can disclose PHI. And what the call discusses, records and transcribes has to stay within the minimum necessary. With AI voice agents a third question appears: whether PHI should reach a general-purpose language model at all, which some state laws further restrict.

This is where a wrong-number problem becomes a double problem. A call to a reassigned number is a TCPA risk, and if the call then discloses health details it becomes a privacy risk as well. Knowledge-based prompts such as name and date of birth are barely security, because none of that is secret anymore, and in 2025, 38% of Americans received a call from someone impersonating a healthcare provider or insurer. Strong identity verification protects both the patient and the program.

Before any PHI is shared with a vendor, confirm that a Business Associate Agreement is in place, and understand which subprocessors, including any language-model providers in the call path, its obligations extend to. Consig requires a signed BAA with healthcare customers before any PHI is shared, and verifies identity through Journey.ai's Zero Knowledge Network, so credentials and biometrics never enter the AI, the LLM or the transcript.

Disclaimer

This guide is general information, not legal advice. It summarizes rules, rulings and cases as Consig has described them in its published research and articles, current as of the date shown above, and the law in this area is changing quickly, in some places in opposite directions at once. Federal rules are under reconsideration, courts in different jurisdictions disagree, and state requirements vary. Consult qualified counsel about how the TCPA, state law and HIPAA apply to your specific program before you place calls.