The Healthcare Exemption in 47 CFR 64.1200 Covers Less Than You Think

The Healthcare Exemption in 47 CFR 64.1200 Covers Less Than You Think

Ask most home health or home care operators about TCPA and you get some version of "we're healthcare, we're exempt." The exemption is real. It is also narrower than the sentence implies, it comes in two different forms that do different things, and one of the two is unavailable to a large share of private-pay home care agencies.

The text is short enough to read directly, so read it directly.

Form one: the wireless carve-out in (a)(2)

47 CFR 64.1200(a)(2) prohibits initiating a call that "includes or introduces an advertisement or constitutes telemarketing," using an automatic telephone dialing system or an artificial or prerecorded voice, to the lines described in (a)(1)(i) through (iii) — which include cellular numbers — "other than a call made with the prior express written consent of the called party or the prior express consent of the called party when the call is made by or on behalf of a tax-exempt nonprofit organization, or a call that delivers a 'health care' message made by, or on behalf of, a 'covered entity' or its 'business associate,' as those terms are defined in the HIPAA Privacy Rule, 45 CFR 160.103."

Notice what that does and does not say. It places a healthcare message alongside prior express written consent as an alternative in the telemarketing paragraph. It does not repeal paragraph (a)(1), which restricts autodialed or prerecorded calls to those same numbers absent an emergency purpose or the prior express consent of the called party.

The practical translation, which is where agencies most often go wrong: the healthcare provision relieves you of the heightened written consent standard that otherwise attaches to telemarketing content. It is not a general license to autodial or send prerecorded messages to a patient's cell phone with no consent at all.

Form two: the residential-line limits in (a)(3)(v)

The second form is a conditional exemption for prerecorded calls to residential lines. Paragraph (a)(3)(v) permits a call that "delivers a 'health care' message made by, or on behalf of, a 'covered entity' or its 'business associate,' as those terms are defined in the HIPAA Privacy Rule, 45 CFR 160.103, and the caller makes no more than one call per day to each patient's residential line, up to a maximum of three calls combined per week to each patient's residential line and honors the called party's request to opt out of future calls as required in paragraphs (b) and (d) of this section."

Three conditions, all of them countable, all of them auditable, and all of them commonly exceeded by agencies running automated appointment reminders alongside automated medication reminders alongside automated satisfaction surveys from three different vendors that do not know about each other.

Condition	What it means operationally
One call per day, per patient, per residential line	Aggregate across every system you use, not per system
Three calls per week combined	"Combined" is the load-bearing word
Honors opt-out per (b) and (d)	Automated opt-out mechanism in the message, plus internal do-not-call handling

If you use more than one automated outreach vendor, nobody is counting the combined total unless someone was assigned to. That is the single most common failure of this exemption in practice, and it is not a subtle legal question — it is arithmetic that no one owns.

The threshold problem: are you a covered entity?

Both forms of the exemption are conditioned on the caller being, or acting on behalf of, a HIPAA covered entity or business associate. That term is defined in 45 CFR 160.103 as a health plan, a health care clearinghouse, or "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."

The third prong is the one that matters here, and it has a condition attached. Being a health care provider is not sufficient. The provider must transmit health information electronically in connection with a covered transaction — the standard electronic transactions defined in the rule, such as claims, eligibility inquiries, and remittance advice.

For a Medicare-certified home health agency, this is almost never in doubt. For a private-pay home care agency that bills families directly, submits no electronic claims, and runs no electronic eligibility checks, it is a live question — and the answer may well be no. An agency that is not a covered entity and is not acting as a business associate does not have the healthcare exemption available in either form, regardless of how clinical its calls sound.

Mixed-model agencies are the hard case. An agency with a small Medicaid waiver line of business alongside a large private-pay book may be a covered entity by virtue of the former, with consequences reaching the latter. This is a fact-specific determination and a genuinely contested one; providers and their counsel reach different conclusions on similar facts. It is worth an actual legal opinion rather than an assumption inherited from a vendor's marketing page.

What "health care message" excludes

The exemption attaches to the content of the call, not to the identity of the caller alone. A covered entity does not get to send anything it likes.

The same section defines advertisement as "any material advertising the commercial availability or quality of any property, goods, or services" and telemarketing as "the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services." A prerecorded call promoting your new private-duty service line to former patients is telemarketing whether or not a nurse recorded it.

The blurry cases are real: a call about transitioning from a covered episode to private-pay services; a "wellness check" that ends with an offer; a satisfaction survey that includes a referral request. Where the purpose is mixed, the safer analysis assumes the advertising purpose governs.

What the exemption never touches

• Revocation. Under 64.1200(a)(10) a called party may revoke consent by any reasonable method, and requests must be honored within a reasonable time not to exceed ten business days. Healthcare status does not create a right to keep calling. We covered the current state of that rule and its delayed provisions in the post on the ten-business-day revocation clock.
• Do-not-call handling. Paragraph (d)(3) requires internal do-not-call requests to be recorded and honored within ten business days, with records retained for five years.
• Message identification. Paragraph (b) requires prerecorded messages to identify the caller at the outset and to provide a callback number, with an automated opt-out mechanism where applicable.
• State law. Several states have enacted their own telemarketing statutes with private rights of action and definitions that do not mirror the federal rule. Federal exemption is not state exemption.
• Call recording. Nothing in 64.1200 requires you to record calls. It requires you to honor requests and maintain do-not-call records. How you evidence compliance is a separate decision with its own state-law consent questions.

Separately, the FCC's 2015 omnibus order exempted certain free, pro-consumer healthcare-related messages to wireless numbers from the consent requirement, "subject to strict conditions and limitations to protect consumer privacy." Those conditions are specific and restrictive, and the exemption should not be relied on from a summary — including this one.

What to do this week

1. Answer the covered-entity question in writing. One paragraph: which entity, which prong of 160.103, which electronic transactions. If you cannot name the transactions, you have found your first task.
2. Inventory every automated outbound system. Appointment reminders, medication reminders, surveys, on-call callbacks, EVV alerts, marketing tools. List the vendor, the trigger, and the daily volume per patient.
3. Do the combined-count math for one week. Pick ten patients with residential lines. Count total automated calls each received. Compare against one per day and three per week combined. This takes an afternoon and it is the highest-value hour in this list.
4. Classify each automated campaign as health care message or telemarketing. Anything with an offer in it goes in the second column, no matter who recorded it.
5. Confirm opt-out plumbing on every prerecorded campaign. Automated opt-out mechanism present, routed to a suppression list your other vendors also read.

Our home care call compliance checklist pairs with this for the recording, redaction, and retention side of the same program.

Why this is hard to police

Every requirement above is a counting problem across systems that do not talk to each other, plus a content-classification problem across calls nobody reads. Manual sampling finds neither. SurfacerIQ operates in the interaction intelligence category — reviewing conversation content and outbound patterns across full volume so that classification and opt-out signals surface as data rather than as an annual audit finding.

This post is general information, not legal advice. TCPA interpretation is fact-specific and shifts with FCC orders and court decisions; verify the current rule text and consult counsel licensed in your operating states before relying on any exemption.

If you want a second set of eyes on which of your outbound campaigns actually qualify, talk to us.