Anyone telling a practice that federal rules require online booking is selling something.

The RealityThe booking widget is the easy part. The reminder is where the rules are.

⚠️

The Problem

A reminder sequence designed by marketing instinct.

Confirmation, then a two-day nudge, then a morning-of text, then a balance note — which is four messages and at least one category the exemption does not cover.

🔧

The Solution

Design the sequence against the cap and the content rules first.

One message a day, three a week, no financial content in the same message, and an opt-out in every one of them.

✅

The Resolution

The reminder programme survives the first complaint.

And the contact preference field actually overrides the default channel, which is what the confidential communications rule requires.

Appointment reminder rules start from a settled point

This one is not close. The regulator’s published position is that appointment reminders are considered part of treatment of an individual and therefore can be made without an authorisation. The definition of treatment is broad enough to carry it, and the marketing definition expressly excludes a communication made for treatment of an individual by a health care provider.

Worth correcting a citation that circulates widely. Trade articles point at a subsection of the notice of privacy practices rule as the source of an appointment reminder disclosure requirement. The word appointment does not appear anywhere in that section. Its subparagraphs now cover fundraising, group health plan sponsors, underwriting and substance use disorder records. If your notice cites it for reminders, the citation is wrong even if the practice is fine.

Unencrypted email guidance, and what it permits

The Privacy Rule allows covered health care providers to communicate electronically with their patients, provided they apply reasonable safeguards when doing so. It does not prohibit the use of unencrypted email for treatment-related communications between providers and patients, though other safeguards should be applied.

The practical answer for a front desk is in the same guidance. If the provider feels the patient may not be aware of the possible risks of using unencrypted email, the provider can alert the patient of those risks and let the patient decide whether to continue. And where a patient initiates by email, the provider can assume email is acceptable unless the patient has said otherwise.

The reverse also holds and is the part to build for: if unencrypted email is unacceptable to a patient who requests confidential communications, other means should be offered and accommodated.

A confidential communications request is not discretionary

For providers this is an affirmative duty with no threshold test. A covered health care provider must permit individuals to request and must accommodate reasonable requests to receive communications by alternative means or at alternative locations.

Note the asymmetry. Health plans owe this only where the individual states that disclosure could endanger them. Providers owe it on a reasonable request, full stop. A provider may require the request in writing and may ask how payment will be handled and for the alternative contact details — but may not require an explanation from the individual as to the basis for the request.

That is a procurement requirement dressed as a privacy rule. If the booking platform can only send a text to the number on file, the practice cannot satisfy this for a patient who asks for voice only, or for a work address. Ask the vendor before signing, not afterwards — it is the kind of question our EHR consulting work exists to ask on a practice’s behalf.

The content restriction deserves as much attention as the count. The exemption does not cover accounting, billing, debt-collection or other financial content. A reminder text that helpfully adds the outstanding balance has left the exemption entirely, and practices bundle those constantly.

Two more conditions travel with the exemption and are easy to breach without noticing. The message must go only to the wireless number the patient provided, which means a number captured from a referral form or a third party does not qualify. And every message must offer an easy means to opt out, with opt-out requests honoured immediately. A sequence that carries an opt-out only on the first message in a thread has already left the exemption. All of this is workflow optimization rather than policy drafting, and it belongs in the same review as the rest of your EHR solutions.

The addressable implementation specification trap

A patient-facing booking portal creates, receives, maintains and transmits electronic protected health information, so the Security Rule’s technical safeguards apply to it. Five standards attach: access control, audit controls, integrity, person or entity authentication, and transmission security.

All five standards are mandatory. Addressable never attaches to a standard — only to named implementation specifications underneath one. Audit controls and person or entity authentication have no implementation specifications at all, so there is nothing optional about either.

And addressable does not mean optional. The regulator’s own summary states that the designation does not mean an implementation specification is optional; it permits the entity to determine whether the specification is reasonable and appropriate for it. Where it is not, the entity must adopt an equivalent alternative that achieves the purpose of the standard, and must document why the original was not reasonable and appropriate.

So treating encryption as addressable and skipping it without a documented risk analysis is the violation — not the absence of encryption itself. There is no 2026 scenario where a public internet-facing booking portal carrying patient data over plain transport survives that assessment.

Information blocking scope, stated precisely

The rules apply to health care providers, health IT developers of certified health IT, health information exchanges and health information networks. Information blocking means a practice likely to interfere with access, exchange or use of electronic health information, except as required by law or covered by an exception.

Providers face a narrower standard than vendors: the provider must know that the practice is unreasonable and is likely to interfere. Developers, networks and exchanges face a knows or should know test.

One nuance worth stating carefully rather than blurring. Because electronic health information is defined by reference to what would be included in a designated record set, appointment information already recorded there can be electronic health information. Refusing to release a patient’s appointment history on request is a different question from declining to offer online booking. We found no primary source addressing scheduling data specifically, so treat that as reasoning rather than citation.

Online booking and reminders: common questions