One Call, Three Rulebooks: The Compliance Landscape for Automated Patient Calls

What are the three rulebooks?

An automated patient call sits under three bodies of law at once. Telecom law governs how the call is placed: the TCPA, FCC consent and revocation rules, and autodialer and prerecorded-voice definitions. Healthcare law governs what is said: identity verification before protected health information is discussed, and the minimum-necessary limit on what is shared. AI law governs the voice itself: AI-voice disclosure, and a widening patchwork of state rules on automated calling and biometric data. Together they can put a dozen rules on a single call, varying by state and changing by the month.

The paper argues that two common assumptions no longer hold. The first is "we're healthcare, so we're exempt": the healthcare exemption is narrow. Even the FCC's waiver of its pending revoke-all rule works message type by message type, so opting out of one healthcare message type stops only that type. The second is "consent is on file," which treats consent as a fixed fact rather than a state that can change mid-call.

How fast is TCPA litigation growing, and is healthcare exposed?

In the first half of 2025, plaintiffs filed 1,052 TCPA class actions, against 539 in the same period of 2024, a 95% increase over a year that was already a record. September 2025 set a single-month record of 224 filings. More than three-quarters of TCPA suits are now filed as class actions. A leading defense attorney has called the statute "the biggest cash cow in history" for the plaintiffs' bar and expects filings to climb another 50%. Recent outcomes include a combined FTC judgment of about $145M against Assurance IQ and MediaAlpha over an alleged "consent farm" and a Citibank robocall settlement of about $29.5M.

Two recent cases put healthcare on the defendant list. Kaiser Permanente settled for $10.5M over texts sent after recipients replied "stop" (Fried v. Kaiser, December 2025). OptumRx settled for $1.86M over medication-adherence calls that reached wrong numbers (Patterson v. OptumRx, March 2026). The OptumRx facts are well-intentioned clinical outreach with a consent and data-hygiene gap, the same pattern any patient-outreach program can fall into. Insurers have noticed: a July 2025 Munich Re Specialty advisory warned that a single unsolicited message to 10,000 recipients "could result in 10,000 violations," and noted that many standard policies exclude TCPA claims.

Does using an AI voice change the legal analysis?

Yes, and not in the direction many assume. Since the FCC's February 2024 ruling, an AI-generated voice is treated as an "artificial or prerecorded" voice, the robocall category under the TCPA. A synthetic voice does not lighten the consent and disclosure burden. It places the call squarely inside it, now at machine scale.

Why is consent no longer a checkbox?

Since April 11, 2025, a consumer can revoke consent through any reasonable means, whether spoken mid-call, texted or emailed, and the business must honor it within 10 business days, down from 30. A broader "revoke-all" rule, under which opting out of one message type revokes consent for everything, has been delayed to January 31, 2027 while the FCC reconsiders it under its "Delete, Delete, Delete" initiative. Meanwhile the courts are moving the other way on capture: in February 2026 the Fifth Circuit held in Bradford v. Sovereign Pest Control that the TCPA's text does not require written consent for marketing calls, and a Maryland district court followed a month later.

The paper concludes that consent is now a state, not a filed fact, and that the churn in the rules is itself the burden. In practice a program needs a consent system of record every campaign reads from, recognition of a spoken mid-call opt-out, propagation of revocations across all channels well inside the 10-day window, and the ability to absorb rule changes. A patient who replies "stop" to a pharmacy text should not receive an automated call from another department the following week. See Consent Is No Longer a Checkbox.

Why can't a generative model handle the compliant steps on its own?

Open-ended conversation is what makes voice AI worth deploying, and it is probabilistic by design. The legally binding moments of a call, such as the AI-voice disclosure, consent capture, identity verification before any protected health information is spoken, and honoring an opt-out, must be deterministic. A system that is right 99% of the time still mishandles a binding step thousands of times across a large program, with statutory damages assessed per call. Forrester's 2024 AI Pulse survey found roughly 70% of US generative-AI decision-makers believed a model always returns the same output for the same prompt; it does not. Forrester's Q2 2026 Conversational AI Wave, which screened about 650 vendors down to 14, required guardrails that are enforceable.

The paper's resolution is a map rather than a trade-off: match the conversational technology to the task, step by step. The short, legally weighted steps run as scripted flows that behave identically on every call. The conversation between them stays natural. In some states, protected health information and biometric identifiers may not be permitted to reach the general-purpose AI path at all, so the map also covers which data never touches the model. And because the law keeps moving, the map has to be redrawn as the rules change. See The Dilemma at the Heart of Every AI Patient Call.

Where should compliance live?

Most violations are failures of execution, not intent: a consent status that did not propagate, a disclosure that did not fire, a number that kept dialing after an opt-out. At a few calls a day a person catches these. At scale, only the system does. The paper therefore argues that the rulebook belongs inside the calling infrastructure, enforced on every call, rather than in a binder reviewed once a quarter.