The thing you are actually worried about
It is not the data breach. It is a patient getting the wrong message with their name on it. Or the same reminder four times. Or a text at eleven at night, and your front desk taking that call in the morning.
So this page is about what the system does, not what it promises.
29
separate reasons a message does not send
Consent. A working phone number. Rate limits. Quiet hours. Do-not-contact. Duplicates. And twenty-three more. Any one of them stops a message on its own, and every stop is logged with its reason.
Four of them decide whether you can leave this running overnight. Here they are.
It halts itself
If the system is about to send the same message to the same patient twice, it does not just block that one. It stops sending for the whole clinic until a person looks. One duplicate usually means something bigger is wrong. Carrying on would turn one mistake into a thousand.
Quiet hours are enforced at send time
We check when the message goes out, not when it was planned. So if the queue backs up during the day, it cannot spill into the night.
Already booked is a win, not a failure
Sometimes we stop a message because the patient already booked. Your report says so. The whole point of the campaign was the booking, and it happened.
Too soon means later, not never
If a message would land too soon after the last one, it waits for the next run. It is not thrown away. You do not lose the patient over bad timing.
What we hold, and what we never import
What patient outreach uses. We do not import your charts.
We hold
- Name, contact details and date of birth
- Appointment dates and status
- Where they are in a plan of care, and how they pay (cash or insurance)
- What we sent, and what came back
We never import
- Diagnoses or diagnosis codes
- Clinical notes from your EMR
- Insurance policy numbers or SSNs
- Anything that would let us change a chart
Access to your EMR is read-only. Nothing we run can alter a chart, a note or an appointment in your system of record. Your patient list stays in the platform. We never screenshare patient data or email patient lists, and only an owner can export the list. That is why one BAA covers it. You sign with us. We hold BAAs with the services that store your data, and the carrier that delivers texts works under the HIPAA conduit rule. Free text can still carry a health detail: a note your staff writes, a label from another system, or a reply from the patient. We protect all of it as patient data.
Questions owners actually ask
- Is automated patient messaging HIPAA compliant?
- It can be. The details decide it. We hold contact details, date of birth, appointments, and the messages and calls themselves. We never import diagnoses or clinical notes from your EMR. We read your EMR, we cannot write to it, so nothing we run can change a chart. You sign one BAA with us, and we hold BAAs with the services that store and process your patient data. Texts and call audio travel a carrier that works under the HIPAA conduit rule, so no text ever mentions a condition or treatment.
- What stops a patient being messaged by mistake?
- Twenty-nine checks. Any one of them stops a message. The strongest is the duplicate check. If the system is about to send the same message twice, it does not just skip that one. It stops all sending for your clinic until a person looks. A system that stops itself beats one that promises it will not slip.
- Will patients get messages at 11pm?
- No. We check quiet hours when the message goes out, not when it is planned. So a backed-up queue cannot spill into the night. A message that would land in quiet hours waits until morning.
- What happens if a patient already booked?
- The outreach stops, and we count that as a win. Same when a reminder outlives the appointment it was about. Both are reasons we chose not to send. Both show up in your report instead of being hidden.
- Does anything write back to my EMR?
- No. We can read your EMR. We cannot write to it. Nothing we do can change a chart, a note or an appointment. We record bookings on our side and report them back to you. Your front desk stays the only thing that touches your EMR.
- Can a patient opt out?
- Yes. Each channel has its own opt-out, and each applies to every campaign, not only the one the patient replied to. A text opt-out stops texts and AI calls, a call opt-out stops AI calls, and an email opt-out stops email. Do-not-contact stops everything.
- Do you need a BAA?
- Yes, and one is enough. You sign it with us. We hold BAAs with the services that store and process your patient data, and the carrier that delivers texts works under the HIPAA conduit rule, so there is nothing else for you to sign. Your list stays in the platform: no screenshares of patient data, no emailed lists. Only an owner can export it, and every export is logged.
Bring the question that worries you most
If there is a scenario this page does not answer, it is a better use of twenty minutes than anything else on the call.