AI Voice Calls to Patients and the TCPA Healthcare Exemption Explained

Updated September 2026. Written by Matteo Grassi, clinical psychologist and cofounder of HANA Health.

The Telephone Consumer Protection Act (TCPA) is the 1991 federal law that limits calls made with an autodialer or an artificial or prerecorded voice. Since February 2024 the FCC counts AI-generated voices as artificial, so an AI call to a patient's cell phone needs the patient's prior express consent unless it fits a narrow healthcare exemption: eight listed care purposes, one call a day, three a week, no billing.

I've sat on both ends of the patient call, as a clinician and as the person building the thing that dials, and consent is always the question teams leave for last.

Key facts

• February 2024: the FCC ruled that the TCPA's limits on "artificial or prerecorded voice" calls cover AI technologies that generate human voices (FCC 24-17).
• $500 per violation: statutory damages in a private TCPA suit, up to $1,500 if the violation was willful or knowing (47 U.S.C. 227(b)(3)).
• 8 purposes, 3 calls a week: the wireless healthcare exemption covers eight care purposes and allows one message per patient per day, up to three a week, under the 2026 rule text (47 CFR 64.1200).
• 10 business days: the maximum time to honor a revocation of consent, under rules in effect since April 2025 (FCC draft order).
• June 2025: the Supreme Court held 6 to 3 that district courts aren't bound by the FCC's interpretation of the TCPA (McLaughlin v. McKesson).
• September 30, 2026: the FCC is scheduled to vote on a draft order making opt outs from informational calls category specific (FCC fact sheet).

Do AI voice calls count as robocalls under the TCPA?

Yes. In its February 2024 declaratory ruling, the FCC confirmed that the TCPA's "artificial or prerecorded voice" restrictions cover AI technologies that resemble human voices or generate call content, voice cloning included. An outbound call that uses one needs prior express consent unless it's an emergency or an exemption applies.

How the number was dialed doesn't matter. The statute names an autodialer or an artificial voice as separate triggers, so one click to call one patient still counts if the voice on the line is synthetic. A live, responsive conversation doesn't change that. The voice is artificial because a person isn't speaking it.

Every artificial voice call must also name who is responsible at the start, using the registered business name, and give a callback number.

What the rules don't require yet is the sentence "this is an AI." The FCC proposed that in August 2024, with a formal definition of an AI-generated call. The current rule text doesn't include it. It's still a proposal.

Inbound is different. The same proposal noted that the TCPA's artificial voice limits reach calls a caller makes or initiates, not technology that answers inbound calls.

What consent does a practice need before an AI voice calls a patient?

Prior express consent. For healthcare calls, the FCC said in 2015 that a patient who gives their number to a provider has consented to healthcare calls subject to HIPAA, made by the covered entity or its business associates, as long as the call stays within the scope of that consent and the patient hasn't said otherwise.

"Within scope" does a lot of work there. The FCC has said it means the call must be closely related to the purpose for which the number was provided. A number given at intake for scheduling supports appointment calls. Whether it supports a monthly chronic care check in is a judgment call, and I wouldn't bet a class action on it.

The FCC has refused to widen this. In a 2020 order, its consumer bureau denied a health plan's request to make case management and other health care calls without prior consent. A relationship with the patient isn't consent, it said, and a call can satisfy HIPAA and still violate the TCPA.

Telemarketing needs prior express written consent. The rule carves health care messages from covered entities and business associates out of the written requirement, not out of consent itself.

One newer wrinkle. In June 2025 the Supreme Court held that district courts aren't bound by the FCC's reading of the TCPA, and the 2015 clarification is exactly that kind of reading. Explicit, documented consent holds up either way.

When does the TCPA healthcare exemption apply?

Only when every condition in 47 CFR 64.1200(a)(9)(iv) is met. The exemption lets a healthcare provider, or someone calling on its behalf, place an automated or AI voice call to a patient's cell phone without prior consent. Miss one condition and you need consent again.

The conditions, from the current rule text:

• Free to the patient: not charged, and not counted against their plan's minutes or texts.
• Right number: only the wireless number the patient provided.
• Identify up front: the provider's name and contact information at the start.
• Listed purposes only: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions.
• No selling, no money talk: no telemarketing, solicitation or advertising, and no billing, debt collection or other financial content. HIPAA privacy rules still apply.
• Short: generally one minute or less for a voice call, 160 characters or less for a text.
• Frequency cap: one message per patient per day, up to three a week.
• Opt out in every message: an automated voice or key press opt out if a person answers, a toll free number if it reaches voicemail, reply STOP for texts.
• Immediate opt outs: honored right away, not within days.

Residential landlines have a separate exemption for health care messages from covered entities and business associates, with the same one a day, three a week cap and an automated opt out.

Does the healthcare exemption cover care management calls?

Mostly, no. The exemption was written for short notifications, and care management calls aren't short notifications. A CCM check in that reviews symptoms, medications and care plan goals won't fit inside a minute, and "chronic care check in" isn't one of the eight purposes.

Some pieces can fit. A reminder before a care management visit is a listed purpose. So is a brief post discharge call intended to prevent readmission, if it stays concise and carries no billing content. A full transitional care conversation is a different animal.

The FCC has looked at this before. A health plan asked in 2015 for case management calls to be treated as urgent and exempt. The 2020 answer was no.

So for care management, plan on consent, not the exemption.

One catch worth naming. In many programs the first AI call is the enrollment call, the one that explains the program and asks the patient to join. It needs its own legal basis before it's placed, either consent you already hold or an exemption. An AI call can't collect the consent it needed in the first place.

How do patients revoke consent, and what could change on September 30?

Today a patient can revoke consent by any reasonable method, and you have up to 10 business days to honor it. Text replies like "stop" or "unsubscribe" count automatically. For an AI agent, "please don't call me again" halfway through a call is a revocation, not small talk.

The 2024 "revoke all" piece, where one opt out would cancel every robocall from that caller, has never taken effect. The FCC delayed it twice, most recently to January 31, 2027.

On September 9, 2026 the FCC circulated a draft order for its September 30 meeting. As drafted, it would:

1. Let callers treat an opt out from one category of informational calls as covering only that category. Telemarketing opt outs would still cover all telemarketing.
2. Let callers name an exclusive opt out method (key press or voice, standard text reply words, or a designated website or phone number) if it's disclosed clearly on each call or text.
3. Leave the opt out rules for exempt calls unchanged.

The changes would take effect 30 days after Federal Register publication, and a companion notice floats shrinking the 10 day window to seven. The draft could still change. Even if it passes, I'd still honor a spoken "stop." It's what the patient meant.

What this means for your practice

Start with a map, not a vendor. Every automated call and text needs a named legal basis.

1. List every automated call and text and its basis: consent you hold, or the exemption. If it's the exemption, test it against every condition above.
2. Ask for consent in plain words, and keep the record. Name calls and texts, automated and AI voices, and the purposes. A care management enrollment conversation is a natural place. Naming AI also covers you if the 2024 proposal is adopted.
3. Script the first ten seconds: practice name, callback number, how to opt out.
4. Teach the agent to hear "stop" in every form, and send every opt out to one list shared by staff and automation.
5. Put every calling vendor under a business associate agreement. The 2015 consent clarification is written for covered entities and business associates acting for them. We covered which vendors in a voice AI stack need a BAA separately.
6. Watch the September 30 vote, then revisit your opt out design once the final text is out.

If you're weighing AI calls for care management, HANA Remote is what we built for that job, and the consent map above is where any rollout should start, whoever you work with.

Frequently asked questions

Do I have to tell patients the call is from an AI?

Federal rules don't require those words yet, but every artificial voice call must name the practice at the start and give a callback number. The FCC's 2024 AI disclosure proposal hasn't been adopted. State rules may add more.

Do AI text messages to patients fall under the TCPA too?

Yes. The FCC treats texts as calls, and the healthcare exemption names texts explicitly, with a 160 character limit and a reply STOP opt out. Autodialed texts need the same consent analysis as voice calls.

Is a HIPAA business associate agreement enough for TCPA compliance?

No. HIPAA governs what a call says about a patient, while the TCPA governs how the call is placed, a line the FCC drew explicitly in 2020. Our piece on running voice AI safely in a clinic covers the HIPAA side.

What should happen if a patient says "stop calling me" during an AI call?

Treat it as a revocation. You have up to 10 business days to honor it, or no time at all if the call relied on the healthcare exemption. The agent should confirm, end the call and write the opt out to the shared list.

Sources

1. FCC. Declaratory Ruling FCC 24-17 on AI technologies and robocalls. 2024. docs.fcc.gov
2. Office of the Law Revision Counsel. 47 U.S.C. 227. uscode.house.gov
3. eCFR. 47 CFR 64.1200, Delivery restrictions. Checked September 2026. ecfr.gov
4. FCC Consumer and Governmental Affairs Bureau. DA 20-669, Anthem, Inc. petition. 2020. docs.fcc.gov
5. FCC Consumer and Governmental Affairs Bureau. DA 26-12, consent revocation effective date. 2026. fcc.gov
6. FCC. Fact sheet and draft Report and Order, CG Docket No. 02-278. September 2026. docs.fcc.gov
7. Supreme Court of the United States. McLaughlin Chiropractic Associates v. McKesson Corp. 2025. supremecourt.gov
8. Federal Register. FCC 24-84, proposed rule on AI-generated calls. 2024. federalregister.gov

This article is educational and isn't billing, coding, clinical or legal advice. TCPA exposure depends on your facts, so check the current FCC rules and talk to counsel before you launch automated patient calls.

If you're planning AI calls for care management and want to compare notes on consent and opt out design, book time with me here.