Automated Resupply Outreach Compliance: TCPA Consent, HIPAA, and Medicare Refill Rules (2026)

Part 1: TCPA Consent Rules for Resupply Texts and AI Voice Calls

The TCPA (47 U.S.C. 227) restricts calls made with an autodialer or an artificial or prerecorded voice. The FCC’s rules sit in 47 CFR 64.1200. Patients can sue for $500 per call or text, and up to $1,500 when a court finds the violation willful. At resupply volumes, those numbers multiply fast.

Texts are calls

The FCC and the courts treat a text message as a call under the TCPA. Any rule that applies to an automated call to a cell phone also applies to an automated resupply text. Most resupply platforms send texts automatically from a list, so plan on the TCPA applying to every campaign.

AI voice calls are “artificial voice” calls

On February 8, 2024, the FCC issued a declaratory ruling (FCC 24-17) confirming that calls using AI-generated or cloned voices fall under the TCPA’s “artificial or prerecorded voice” rules. The ruling did not ban AI voice calls. It means an AI resupply call needs the same consent as a prerecorded call, must identify the caller, and must give the patient a way to opt out. It does not matter that the AI holds a two-way conversation. The voice is still artificial.

What kind of consent you need

The TCPA has two consent levels. Prior express consent covers informational calls and texts. Prior express written consent, a signed agreement with specific disclosures, covers telemarketing.

For DME suppliers, two points matter most. First, the FCC has long held that when a patient gives their cell phone number to a health care provider, that is prior express consent for calls and texts about their care. Second, 47 CFR 64.1200(a)(2) exempts calls that deliver a “health care” message from a HIPAA covered entity or its business associate from the written consent requirement. A reminder that a patient’s CPAP cushions are due is a health care message about their treatment. A promotion for a product the patient has never been prescribed is a different story.

In practice, that means four things:

• Capture the number at intake and record where it came from. Consent covers the number the patient gave you, not one pulled from a data broker or another source.
• Keep the message about the patient’s own care. Due supplies, refill confirmation, shipping, and order status fit. Upsells, unrelated products, and billing collections do not belong in the same automated flow.
• Get written consent if you plan any marketing. If a campaign promotes products outside the patient’s current order, collect prior express written consent with the required disclosures.
• Store consent per number, per channel. A patient can welcome texts and refuse AI calls. Your system needs to know the difference.

The health care exemption is narrower than it sounds

The FCC’s 2015 order created a separate exemption in 47 CFR 64.1200(a)(9)(iv) for certain health care calls and texts to cell phones made without prior consent. It covers messages such as appointment reminders, prescription notifications, and home health care instructions. The conditions are strict. Messages must go only to the number the patient provided, must be free to the patient, must name the provider and give contact information, and must be short (about 1 minute for voice, 160 characters for text). They cannot include telemarketing, advertising, or billing content. The provider may send only 1 message a day and 3 a week, and must honor opt-outs immediately.

The “free to the patient” condition is hard to guarantee on standard carrier plans. That is why most resupply programs rely on prior express consent, not on the exemption.

Revocation: honor STOP, and watch the new FCC order

Since April 11, 2025, patients can revoke consent by any reasonable means. A text reply such as “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” is a revocation on its own. You must honor it within a reasonable time, no longer than 10 business days. You may send one confirmation text within 5 minutes to confirm the opt-out, with no marketing in it.

The rules are changing again. The FCC adopted Report and Order FCC 26-67 on September 30, 2026, and released it on October 1. It drops the “revoke all” rule, which had been delayed to January 31, 2027. Under the new order, an opt-out from one category of informational message can be limited to that category. A patient who stops payment reminders, for example, may still get resupply reminders. Marketing opt-outs still cover all marketing. Businesses may also name an exclusive opt-out method, such as a key press during the call or a keyword reply by text, as long as it is clearly disclosed in every message. The order takes effect 30 days after it is published in the Federal Register. A further proposal asks whether to cut the 10-business-day deadline to 7.

Until the new rules apply, the safest setting is simple. Treat any STOP as a stop for that number, and make it fast.

Calling hours and state rules

The TCPA’s 8 a.m. to 9 p.m. window, in the patient’s local time, applies to telephone solicitations. Resupply reminders are usually not solicitations, but most suppliers apply the same window to every automated call and text. Patients prefer it, and it removes a debate. Several states, including Florida and Oklahoma, have their own telemarketing laws with stricter hours and frequency caps. If you serve patients in many states, have counsel check whether your messages fall inside them.

Carriers add one more layer. Business texts sent from 10-digit numbers must be registered through the carriers’ A2P 10DLC program. Unregistered traffic gets filtered or blocked, which looks like a patient who never responds.

Part 2: HIPAA in Resupply Texts, AI Calls, and Magic Links

The TCPA decides whether you can contact the patient. HIPAA decides what you can say and how you protect it. A DME supplier that bills electronically is a HIPAA covered entity, and resupply outreach is a treatment communication.

Is a resupply reminder “marketing” under HIPAA?

Generally, no. Under the HIPAA marketing rules, a covered entity’s communication about its own treatment or the products it provides to the patient is not marketing unless a third party pays the covered entity to send it. A supplier reminding its own patient that replacement supplies are due does not need a separate HIPAA authorization. If a manufacturer funds the campaign, that changes, and you should review it with counsel.

Unencrypted texts are allowed, with safeguards

HHS guidance in FAQ 570 says providers may communicate with patients electronically if they apply reasonable safeguards. In the 2013 Omnibus Rule, HHS added that a provider may send unencrypted messages to a patient who has been told about the risk and still prefers them. The guidance was written about email, and texting is widely treated the same way. Two practical rules follow from it.

First, tell patients at intake that standard texts are not encrypted, and record their preference. Second, apply the minimum necessary standard to the message itself. “Your supplies from ABC Medical are ready to reorder. Confirm here: [secure link]” is a safer text than one that names the CPAP mask, the diagnosis, or the patient’s date of birth.

Magic links: where the PHI should live

A magic link moves the PHI out of the text and onto a secure page. The patient taps the link, sees the items due, confirms quantities and the shipping address, and submits. No app or password is needed. HIPAA does not define magic links, so the safeguards come from the Security Rule’s general standards for access control, audit controls, and transmission security. A well-built magic link should:

• Serve the page over HTTPS only
• Use a long, random token that cannot be guessed or reused across patients
• Expire after a set period or after the order is confirmed
• Ask for a simple identity check, such as date of birth, before showing item details
• Log every view and confirmation with a timestamp for the audit trail

Texts get forwarded and phones get shared. An expiring link with an identity check limits what a wrong recipient can see.

AI voice calls and PHI

An AI call carries the same risk as a staff call. The person who answers may not be the patient. Before the AI discusses specific supplies, it should confirm it is speaking with the patient or an authorized caregiver. If it reaches voicemail, the message should include only the company name and a callback number, not the products or the reason for the call. Recordings and transcripts that contain PHI are part of the record and need the same protection as the rest of the patient file.

Business associate agreements

Every vendor that creates, receives, stores, or transmits PHI for your outreach is a business associate. That includes the resupply platform, the SMS provider, and the voice AI provider. Each one needs a signed business associate agreement before patient data flows.

What may change

HHS proposed a major update to the HIPAA Security Rule in January 2025. It would make encryption of ePHI at rest and in transit a required standard instead of an addressable one. As of October 2026 it is still a proposal, and the federal regulatory agenda targets final action for 2027. Programs that already keep PHI out of the text body and behind an encrypted link will need few changes if it is finalized.

Part 3: Medicare Refill Documentation for Automated Outreach

TCPA consent lets you contact the patient. Medicare’s refill rules decide whether that contact supports the claim. The rules sit in the “Refill Requirements” section of each LCD and in the DME MACs’ Standard Documentation Requirements article (A55426). They last changed on January 1, 2024, and the DME MACs restated them in their January 2026 annual reminder.

The timing rules

For items dispensed on a recurring basis, the supplier may contact the beneficiary no sooner than 30 calendar days before the expected end of the current supply. CGS confirmed in its FAQ on the change that this replaced the old 14-day rule. Delivery may happen no sooner than 10 calendar days before the supply runs out. Product-level limits, such as one full face mask every 3 months, are listed in our Medicare supply replacement schedule.

The affirmative response

Medicare does not allow refills to ship automatically, even when the patient agreed to auto-ship. The supplier must document an affirmative response before each refill. This is where TCPA consent and Medicare documentation get confused. A patient who agreed to receive texts has not requested a refill. The refill request is a separate event, and it must be recorded every cycle.

What the refill record must contain

According to A55426, the record must include:

• The beneficiary’s name, or the authorized representative’s name if different
• A description of each item requested
• Documentation of an affirmative response showing a need for the refill
• The date of the refill request

The record must exist before the item ships. Medicare does not prescribe a channel, so a phone call, a text reply, an AI voice call, or a magic link confirmation can all work. What matters is that the system captures each element and ties it to the order.

How each outreach channel creates the record

Common gaps that fail audits

• A “YES” with no item list. The record must describe each item requested. A one-word reply to a generic text does not.
• Outreach on the old 14-day setting. It is not a violation, but it leaves less time for patients to answer before the delivery window.
• Shipping inside 10 days because the patient asked. A patient’s request does not move the delivery window.
• Records written after shipment. A note added later by staff or the patient is not accepted.
• Opted-out patients still in the campaign. A STOP that never reached the resupply list creates a TCPA problem on the next cycle.

One Compliant Resupply Flow, Step by Step

Here is how the three rule sets fit into a single automated cycle.

1. Intake. Capture the patient’s cell number, record the source, and disclose that texts and automated or AI calls will be used for their supplies. Record their preference for unencrypted texts and their consent per channel.
2. Eligibility. Calculate each item’s next eligible date from the last date of service, the LCD frequency, and the payer’s rules. Commercial and Medicaid plans may differ from Medicare. Our FAQ on resupply eligibility checks at scale covers this step.
3. Outreach window. Open outreach no sooner than 30 days before the supply runs out. Check the opt-out list and the patient’s channel consent before every send.
4. Contact. Send a short text or email with a magic link. If the patient does not respond, follow up with an AI voice call where they consented to calls. Keep each message to the patient’s own supplies.
5. Confirmation. Record the responder’s name, each item and quantity, the shipping address, and the date. Transfer anything unusual to staff.
6. Fulfillment. Hold shipment until 10 days before the supply runs out. Stay within the dispensing limit, usually a 3-month quantity.
7. Opt-outs. Process every STOP, verbal “don’t call me,” or email request across all resupply campaigns within 10 business days, or faster.

For a deeper look at how scheduling, eligibility, and outreach fit together, see how to optimize your resupply chain and the benefits of automating DME/HME resupply.

What to Ask a Resupply Outreach Vendor About Compliance

Large suppliers run resupply through the module in their billing platform, through standalone outreach tools, or through call center staff. Whichever you evaluate, ask the same questions:

• Does it store consent per phone number and per channel, with the source and date?
• Does a STOP reply or a verbal opt-out on an AI call remove the patient from every resupply campaign automatically?
• Does the AI voice identify your company at the start of the call and offer an opt-out?
• Does it verify the patient before discussing supplies, and leave PHI-free voicemails?
• Do magic links expire, require an identity check, and log every action?
• Does the confirmation record include each item, the responder, and the date, and is it saved with the order before shipment?
• Will the vendor, and its SMS and voice subcontractors, sign a business associate agreement?
• Can it enforce the 30-day and 10-day windows by payer and product?

If you are comparing standalone tools with platform-based resupply, our pages on S3 resupply alternatives and SNAP resupply alternatives show how the options differ. The FAQ on DME software with built-in CPAP resupply automation covers sleep programs in particular.

How NikoHealth Handles Resupply Outreach

NikoHealth is built for large, multi-location DME providers that run resupply for thousands of patients across many payers. Its resupply module sets rules by product and payer, tracks per-patient schedules, and runs texts, emails, and Voice AI calls from one campaign. Patients confirm through a secure magic link, with no app or password, or by phone with Voice AI. The AI confirms supplies, quantities, and the shipping address, creates the order, and transfers complex calls live to staff. The confirmation is saved with the order. The platform is HIPAA-compliant, ISO 27001 and SOC2 compliant, with encryption in transit and at rest, as described on the security page.

Quality DME, which runs automated resupply campaigns for more than 22,000 patients, saw a 400%+ increase in patient response rates, as described in how DMEs are automating patient outreach. Prime Care HME automated resupply alongside billing and AR on the same platform.

Software does not give consent or decide coverage. Your intake process, your consent language, and the LCD still set the rules. Software applies them the same way on every patient and every cycle.

Want to hear a compliant Voice AI resupply call? Request a demo.

Resupply Outreach Compliance FAQ

Do DME suppliers need consent to send resupply text messages?

Yes. Under the TCPA, a text is a call, and automated texts to cell phones need prior express consent. A patient who gives their cell number to a HIPAA covered entity generally consents to health care texts about their own care. Prior express written consent is needed only for marketing outside the HIPAA health care message exception.

Are AI voice calls legal for DME resupply?

Yes, with consent. The FCC ruled in February 2024 that AI-generated voices are “artificial or prerecorded voice” under the TCPA. An AI resupply call needs the patient’s prior express consent, must identify the caller, and must offer a way to opt out.

How fast must a supplier honor a STOP reply?

Within a reasonable time, no longer than 10 business days. Words like stop, quit, end, revoke, opt out, cancel, and unsubscribe are treated as a revocation on their own. The FCC is considering shortening the deadline to 7 business days.

Can resupply texts include PHI?

HIPAA allows unencrypted texts to patients who were told about the risk and still prefer texting, with reasonable safeguards. Best practice is to keep PHI out of the message body and put item details behind a secure, expiring link with an identity check.

Are magic links HIPAA-compliant?

HIPAA does not certify or define magic links. A magic link supports compliance when it uses HTTPS, a random single-patient token, an expiration, an identity check before showing details, and an audit log of every view and confirmation.

Does TCPA consent count as a Medicare refill request?

No. Consent allows you to contact the patient. Medicare requires a separate, documented affirmative response for each refill, with the beneficiary’s name, each item requested, and the date, recorded before the item ships.

How many days before the supply runs out can a supplier contact a Medicare patient?

No sooner than 30 calendar days before the expected end of the current supply. Delivery can happen no sooner than 10 calendar days before. These rules took effect January 1, 2024.

Does the TCPA apply to resupply emails?

No. The TCPA covers calls and texts. Commercial email falls under CAN-SPAM, and resupply emails that contain PHI still need HIPAA safeguards.