TCPA, DNC, and FTC (TSR) Governance and Compliance for Healthcare Payers: What Member Outreach Programs Need to Know

Key Takeaways:

• Healthcare Payer outreach is governed by three regimes at once: the TCPA (consent and automated-contact technology), the federal and state Do Not Call frameworks, and, for sales-purpose calls, the FTC’s Telemarketing Sales Rule.
• The Healthcare exemption is narrower than most teams assume. It is purpose-based, not entity-based, so being a HIPAA-covered entity does not exempt a Payer’s calls, and any marketing, billing, or debt-collection content voids it.
• TCPA and HIPAA are separate legal standards. A Payer can hold valid HIPAA authorization and still face TCPA liability on the same call, because the two are proven differently and the burden of proving consent falls on the caller.
• Statutory damages run $500 per call or text and up to $1,500 for willful or knowing violations, with no cap. One misconfigured campaign can scale into millions of dollars in fines, especially when AI Agents are leveraged.
• Opt-outs must be honored within 10 business days through any reasonable method, and post-call review cannot prevent liability that attaches the moment a non-compliant contact is made.

Healthcare Payers conducting member outreach are subject to the Telephone Consumer Protection Act (TCPA), the federal and state Do Not Call (DNC) frameworks, and, depending on call purpose, the FTC’s Telemarketing Sales Rule (TSR). All three can apply to a single outreach program at the same time. The stakes are concrete: Statutory damages accrue per call or text, and the Healthcare exemption most teams rely on is narrower than commonly assumed.

For the broader engagement picture, see Gryphon’s guide to AI-empowered, compliant member engagement.

H2: Table of Contents

• Which Telemarketing Regulations Apply to Healthcare Payer Outreach?
• Does the Healthcare Exemption Cover Member Outreach?
• What Kind of Consent Do Healthcare Payers Need for Member Outreach?
• How Do DNC, Screening, and Revocation Obligations Apply?
• How These Rules Apply Across Member Outreach Programs
• Why Post-Call Compliance Review Leaves Healthcare Payers Exposed
• Building Compliant Member Outreach at Scale
• Frequently Asked Questions

Which Telemarketing Regulations Apply to Healthcare Payer Outreach?

Healthcare Payer outreach is governed by three federal regimes simultaneously: the TCPA governs consent and the technology used for automated calls and texts, the DNC framework governs who may be contacted, and the TSR governs call conduct when a call has a sales purpose. Applicability follows call purpose, not organizational identity.

That last point is where most guidance stops short. A single Payer’s outreach portfolio can sit under different regimes program by program, so an enrollment campaign, a billing call, and a medication-adherence text may each answer to a different combination of rules. Treating “our outreach” as one compliance question is the first structural mistake.

How TCPA, DNC, and TSR Differ

The three regimes govern different things and are triggered by different acts. The table below summarizes what each covers and what sets it off.

Regulation	What it governs	What triggers it
TCPA (47 C.F.R. § 64.1200)	Consent and the technology behind automated calls and texts (autodialers, prerecorded or artificial voice, AI-generated voice, SMS).	Placing an automated, prerecorded, or AI-voice call or text without the required consent, or contacting a wireless number without a valid basis.
Federal and State DNC	Who may be contacted.	Contacting a number on the National DNC Registry, a state registry, or an internal do-not-call list without an applicable exception.
TSR (16 C.F.R. Part 310)	Call conduct when a call has a telemarketing or sales purpose.	Making a call that induces the purchase of a good or service, which triggers disclosure, abandoned-call, and DNC obligations.

Where State Mini-TCPA Laws Add Requirements

State mini-TCPA statutes impose obligations beyond federal rules, including separate state DNC registries, narrower calling windows, and private rights of action that plaintiffs pursue aggressively. Florida, Oklahoma, and Washington are frequently cited examples. Multi-state Healthcare Payers inherit the strictest applicable standard for each contact.

For Payers specifically, the McCarran-Ferguson Act complicates the TSR. The FTC’s rule reaches insurance telemarketing only to the extent the activity is not already regulated by state law, per FTC guidance on complying with the TSR. The practical effect is that state insurance and telemarketing rules, not just the federal TSR, are often the operative standard. A full view of state-level DNC and telemarketing restrictions is essential for any Payer operating across jurisdictions.

Does the Healthcare Exemption Cover Member Outreach?

The Healthcare exception partially covers member outreach, and far less than most teams assume. The TCPA’s Healthcare exemption is purpose-based, not entity-based, so being a HIPAA-covered entity does not exempt a Payer’s calls. The exemption covers specific Healthcare messages under strict conditions, and any marketing, billing, or financial content removes the call from its protection.

This is the single most common misconception in Payer outreach. The exemption is not a blanket permission that attaches to Healthcare Payers; it is a narrow carve-out that attaches to particular messages that satisfy every qualifying condition. Understanding exactly where that boundary sits is the difference between defensible compliant member outreach for Healthcare Payers and unintentional exposure at scale.

What Qualifies as an Exempt Healthcare Call

An exempt Healthcare call must meet every condition in a tight set: It delivers a permitted Healthcare message from a HIPAA-covered entity or business associate, contains no telemarketing or advertising, contains no billing or debt-collection content, complies with HIPAA privacy rules, respects the frequency caps, and offers an easy opt-out.

The exemption also treats line types differently. For residential landlines, prerecorded Healthcare messages may be delivered without prior consent under 47 C.F.R. § 64.1200(a)(3)(v), subject to the caps and opt-out. For wireless numbers, the exemption is narrower: It relieves only the written-consent requirement that applies to telemarketing, the message must go to a number the patient provided, and content must be concise, generally under one minute for calls and under 160 characters for texts.

What Voids the Exemption

Any of the following removes a call from the Healthcare exemption: marketing or promotional content, cross-sell or upsell language, Plan renewal or upgrade solicitation, billing or balance-due content, and dual-purpose messages that mix clinical and commercial information.

Each has a familiar Payer example. A wellness-visit reminder that also promotes a new supplemental Plan is marketing. A medication-adherence text that suggests moving to a higher-tier Plan is upsell. An open-enrollment call urging a richer Plan is renewal solicitation. A care-gap call that mentions an outstanding premium balance is billing content. Most damaging are dual-purpose scripts, such as a compliant flu-shot reminder that becomes non-exempt the instant an agent adds, “and while I have you, would you like to hear about our new Medicare Advantage Plan?”  That one sentence converts a Healthcare message into telemarketing and forfeits the exemption for the entire call.

Frequency Limits on Exempt Healthcare Calls

Exempt Healthcare messages are capped at one message per day and a maximum of three per week per recipient. Critically, the caps apply per recipient, not per program, so a member enrolled in several outreach initiatives can be over-contacted when independent teams each stay within the limit on their own.

This is a common failure point at large Healthcare Payers, where enrollment, clinical, and retention teams operate from separate systems and none can see the others’ contact history. It is also a core example of compliance risks across decentralized Healthcare operations, where the violation emerges from the gaps between programs rather than inside any one of them.

What Kind of Consent Do Healthcare Payers Need for Member Outreach?

The required consent tier depends on call purpose and number type. Informational Healthcare calls to a member-provided number may rest on implied or prior express consent, while any call or text with a marketing element sent to a wireless number requires prior express written consent.

Express Consent vs. Prior Express Written Consent

Prior express consent covers informational, non-telemarketing contact and can be established when a member provides a number for that purpose. Prior express written consent is the higher bar and is required for any marketing or advertising call or text using automated technology to a wireless number. Consent is captured at enrollment, in the member portal, through IVR, or by an agent, and each source is defensible only if the Payer can produce a dated, specific record of what the member agreed to.

One correction worth flagging for teams working from older playbooks is that the FCC’s one-to-one consent rule for lead-generated contacts was vacated by the Eleventh Circuit in January 2025 and never took effect, and the FCC has since repealed it. Lead-sourced consent therefore reverts to the prior “prior-express-written-consent” standard, but it remains a high-risk area, and documented, seller-specific consent is still the defensible practice. (This piece pairs with our companion resource on member consent and opt-out management; link once that pillar is live.)

Why TCPA Consent Is Not the Same as HIPAA Authorization

TCPA consent and HIPAA authorization are separate legal requirements with separate standards, and satisfying one does not satisfy the other. HIPAA governs the privacy of protected Health information; the TCPA governs consent to receive automated calls and texts. A Payer can hold valid HIPAA authorization and still face TCPA liability on the same call.

The two are proven differently. TCPA consent does not always have to be written, except for marketing to wireless numbers, whereas HIPAA authorization carries its own form and content requirements under the HIPAA Privacy Rule. The practical implication is unforgiving. The burden of proving TCPA consent falls on the caller, so a Payer that documents HIPAA authorization but not TCPA consent has satisfied only half of the requirement and cannot prove the half that draws the lawsuits.

How Do DNC, Screening, and Revocation Obligations Apply?

Healthcare Payers must screen every contact attempt against multiple suppression lists and several number-level risk signals before dialing, and must process opt-out requests within 10 business days. The obligation spans the full suppression lifecycle: who you may not call, which numbers carry hidden risk, and what happens when a member revokes.

Federal, Internal, and State DNC Lists

Three list types carry independent obligations: the National Do Not Call Registry, state DNC registries, and the Payer’s internal do-not-call list. Each is a separate scrub, and passing one does not satisfy the others.

Internal DNC is usually the weakest link. Opt-out requests arrive across every channel a member can reach, including live agents, the member portal, physical mail, and inbound calls, and at many Plans those requests are never centralized. A member who opts out by phone on Monday can be textable by a different system on Tuesday, which is a violation regardless of intent.

Number-Level Risks: Wireless, Reassigned, and Litigator Lists

The phone number itself carries risk independent of the member. Wireless status raises the consent standard and can change through number portability, so a phone number treated as a landline may in fact be mobile. Reassigned numbers break the link between consent and recipient. When a number changes hands, prior consent does not transfer, and calling the new holder creates fresh exposure.

The Reassigned Numbers Database, operated by the FCC at reassigned.us, provides a safe harbor when a Payer checks it in good faith before contact. Known-litigator lists add a further layer, flagging serial TCPA plaintiffs so a Payer can route those numbers out of automated outreach before a demand letter follows.

Revocation: Keywords, Reasonable Methods, and Timing

Members may revoke consent through any reasonable method, Payers may not designate an exclusive channel, and revocation requests must be honored within 10 business days. Standardized opt-out keywords that callers must treat as valid include STOP, QUIT, END, REVOKE, CANCEL, and UNSUBSCRIBE.

A single confirmation message is permitted, provided it carries no promotional content, is sent within five minutes of the request, and does not attempt to talk the member out of the decision. The broader “revoke-all” provision (47 C.F.R. § 64.1200(a)(10)), which would treat a revocation of one message type as applying to all future calls and texts from the caller on unrelated topics, has been extended twice and is currently set to take effect on January 31, 2027. The “reasonable means” and 10-business-day requirements, by contrast, are already in force.

How These Rules Apply Across Member Outreach Programs

The applicable rules change program by program. Payers that apply one standard across all outreach are simultaneously over-suppressing low-risk contacts and under-protecting high-risk ones. The table below maps the four most common Payer programs to their exemption status, exposure, and the control that matters most.

Program	Likely exemption status	Primary regulatory exposure	Key operational control
Enrollment and onboarding	Often outside the exemption if it includes Plan selection or marketing.	TCPA consent tier, plus TSR if there is a sales purpose.	Verify consent tier by number type before contact.
Billing and payment	Not exempt; payment content voids the exemption.	TCPA, plus FDCPA and Regulation F where a third party is involved.	Segregate from clinical messaging; screen for third-party involvement.
Care gap and medication adherence	Typically exempt if purely clinical and within caps.	TCPA frequency caps; any commercial content voids the exemption.	Enforce per-recipient caps across all programs.
Post-care follow-up	Usually exempt if purely clinical.	TCPA; wireless raises the consent standard.	Confirm number type and opt-out status at the moment of contact.

 

The billing row deserves emphasis. Payment, balance-due, and collections content removes a call from the Healthcare exemption and, where a third-party collector is involved, may additionally trigger FDCPA and Regulation F obligations. It is the program with the most overlapping regimes and the least room for error. Because this section mirrors the engagement side of the same four programs, it pairs naturally with Gryphon’s guide to AI-empowered member engagement across Payer programs.

Calling Windows and Quiet Hours Across Time Zones

The federal calling window permits outreach only between 8:00 a.m. and 9:00 p.m. in the recipient’s local time, and many state windows are narrower. The trap is operational. The applicable window follows the member’s actual location, not the Payer’s or the contact center’s, and area code is an unreliable proxy for where a member currently lives after years of number portability.

Why Post-Call Compliance Review Leaves Healthcare Payers Exposed

Post-call compliance review identifies violations only after they have occurred and after liability has already attached. The only controls that prevent exposure operate before and during the contact attempt. With statutory damages of $500 to $1,500 per call or text and no cap, after-the-fact review manages evidence, not risk.

The failure modes are specific. Batch scrubbing creates a window between the scrub and the dial in which a number’s status can change. Written policy does not stop an agent from saying something that voids an exemption mid-call. Consent captured in one system is invisible to a campaign running in another. And frequency caps are unenforceable when programs operate independently, each unaware of the others’ contact history.

What Real-Time Enforcement Looks Like in Practice

Real-time enforcement evaluates each contact at the point of outreach: pre-call screening against every applicable DNC and suppression list, consent verification by call purpose and number type, calling-window enforcement by the member’s location, in-call prompts for required disclosures, and automatic capture of an audit record for every attempt.

This is the control layer that sits between the campaign and the outreach. Gryphon delivers it as real-time contact governance that enforces the applicable rules before a violation can occur, rather than surfacing it in a report after liability has already attached.

Building Compliant Member Outreach at Scale

Healthcare Payers face steady pressure to increase member contact for quality measures, retention, and revenue, while operating under three overlapping regimes, per-call statutory damages, and a compressed remediation window. Manual and periodic controls cannot hold that line at volume. Positioned as a contact governance control layer, Gryphon helps Payers expand member outreach rather than restrict it: enforcement before the violation, a defensible audit trail for every contact, and the confidence to reach more members, not fewer. For a real-world example, see how a leading Healthcare Payer approached contact compliance.

See how Gryphon helps Healthcare Payers scale compliant member outreach by exploring Gryphon for Healthcare.

Frequently Asked Questions

Does HIPAA compliance mean a Healthcare Payer is TCPA compliant?

No. They are separate legal frameworks with separate standards. HIPAA governs the privacy and security of protected health information, while the TCPA governs consent for automated calls and texts. A Payer can hold valid HIPAA authorization and still face TCPA liability on the same call.

What are the penalties for a TCPA violation?

Statutory damages are $500 per call or text, rising to $1,500 for willful or knowing violations, with no aggregate cap. Because damages accrue per message, a single misconfigured campaign reaching a few thousand members produces exposure in the millions, and claims are frequently aggregated in class actions.

Do Healthcare Payers need written consent to text members?

It depends on the content. Informational Healthcare texts to a member-provided number may rest on prior express consent, while any text with a marketing or promotional element sent to a wireless number requires prior express written consent.

How quickly must a Healthcare Payer honor an opt-out request?

Within 10 business days of receipt, shortened from the prior 30-day window. The request must be honored regardless of which channel it arrived through, including agent, portal, mail, or inbound call.

Does the Healthcare exemption apply to billing calls?

No. Billing, balance-due, payment, and collections content removes a call from the Healthcare exemption, and where a third party is involved it may additionally trigger FDCPA and Regulation F obligations.

What is the Reassigned Numbers Database and do Healthcare Payers need to use it?

It is an FCC-operated database that identifies numbers disconnected and potentially reassigned to a new subscriber. Checking it in good faith before contact provides a safe harbor against liability, because consent does not transfer when a number changes hands.