Are appointment reminders PHI?
Short answerSometimes, and it depends on who sends the reminder and what it says. Federal guidance treats appointment reminders from a covered health care provider as part of treatment, allowed without a separate authorization [1]. The details in the message, such as a diagnosis or procedure, are what turn a plain reminder into sensitive health information.
The explanation
The federal health privacy office answers this directly: reminders count as part of treatment and do not need a signed authorization first [1]. That answer is about health care providers. A plumber, a carpet cleaner or a lawn crew is generally not a health care provider, so those rules are not aimed at its reminders.
If you do run a clinic, therapy practice or similar business, treat the message body as the risk. A reminder that says only the date, time and location carries little. One that names a condition, a test or a medication carries a lot, and it may sit on a lock screen or a shared family phone.
A safe pattern is a short message with the business name, the day, the time and a link or number for changes. Leave out the reason for the visit. Ask each patient how they want to be contacted, and respect an opt-out the first time it arrives. Rules differ by state and by contract, so check your own situation with a qualified advisor.
Steps
- Write reminders with only business name, date, time and a callback number.
- Remove any reason for the visit, test name or provider specialty from the template.
- Record which channel each person agreed to, such as text or email.
- Honor a STOP reply immediately and log it.
What to watch for
- Voicemail scripts that say too much on a shared line.
- Including a diagnosis or medication in a text preview.
- Sending to a number the person did not give you.
How Apex does it
In progress
Part of this is built. The rest is not. Status as of 2026-10-07; the badge shows the least-built feature involved.
Apex has a healthcare pack in progress that is meant to keep health details out of the system, and reminders can be limited to time and place. Texting also needs STOP handling, which is built. Check your own state rules before you rely on any tool.
- IP11Healthcare / no-PHI pack(In progress)
- CM03Appointment reminders (SMS/email)(Built, rolling out)
- CM09Opt-out / STOP and quiet hours(Built, rolling out)
Apex Flow Scheduler is in early access. See how we label status.
Sources
- HHS: appointment reminders under the HIPAA Privacy Rule (read 2026-10-07)
Where this question comes from: owners type it, or a close variant, into search boxes. It was returned by public search suggestions (Google, Bing or DuckDuckGo) when we collected them on 2026-10-06. We do not have search volumes.