Skip to main content

​
Build a HIPAA-postured patient engagement program

You run digital engagement for a clinic chain. Your patients expect the same reminder and rescheduling experience retail brands ship, but the data behind it is PHI, and the posture decision is yours. This guide composes the pieces Devotel Orbit ships for that program — appointment reminders, two-way confirm and reschedule, no-show win-back, recording consent, and audit evidence — into one reference, in the order you should build them. Each part has its own deep guide. This page is the program-level order of work; if you only need the reminder mechanics, start with Appointment reminders end to end.
This guide describes Devotel Orbit platform controls. It is not legal advice. The determination that PHI is in scope, the posture that applies, and the controls your regulator expects belong to your counsel and your compliance officer. Every control below is tenant-owned: you choose the posture, you operate the gates, and you own the retention decision.

​
1. Choose the posture first

The posture is a tenant-owned decision. Orbit provides the controls and the ledger; the legal determination that PHI is in scope is yours. Make four decisions before you build anything: Run the HIPAA first-enablement runbook to bring the workspace to the posture you chose, then keep this page open as the build order.

​
2. Build a PHI-aware audience

Define the patient contact schema narrowly. Create custom fields for what the program actually uses — first_name, phone, whatsapp, preferred_channel, and an appointment or location key — and validate them in the field schema explorer. Derive computed traits from engagement events (reminder_sent, confirmed, no_show, rebooked), not from clinical data. Behavioral traits are not PHI; clinical values are. What must not live in marketing attributes:
  • Diagnosis codes, treatment plans, medication details, or lab results.
  • Visit reasons that reveal a health condition.
  • Provider notes or insurance details.
Keep those in your EHR or practice-management system. If a campaign genuinely needs a clinical cohort, the cohort membership is itself PHI: assemble it in your source system, import the audience, and designate it PHI-adjacent in the registry instead of copying clinical values into attributes. Designation follows provenance, and it travels with every campaign that uses the audience — see Register PHI-adjacent audiences. Designate the patient audience so the BAA gate attaches to it:
The write is a full replacement, so read the current registry first and send the complete set back. From this point on, any campaign that selects a designated audience is refused at launch until the BAA is executed and in term — which is exactly the guarantee you asked for when you chose the posture. Health messaging fails on consent bookkeeping, not on delivery. Wire it before the first reminder:
  • Verify per contact, per channel. SMS consent does not grant WhatsApp consent. Pull destination verdicts for a sample of your patient list with the consent inspector and confirm the channel mix you planned matches the consent you hold.
  • Record the consent evidence. Keep who consented, when, on which channel, and to which disclosure text. Your counsel defines the disclosure; Orbit records and enforces the verdict.
  • Honor opt-outs globally and immediately. Keyword handling, propagation to suppressed destinations, and re-opt-in semantics are covered in SMS opt-out & opt-in rules. If your counsel separates treatment messaging from marketing messaging, configure the classes accordingly rather than mixing them in one audience.
  • Cap and suppress. Apply message suppression so a patient who opted out, rebooked, or was contacted elsewhere is never re-enrolled by a later run.
  • Schedule inside permitted windows. Set tenant quiet hours for messaging. For voice, the federal calling window is a platform guard: outbound calls outside it are blocked and the guard cannot be disabled, so plan reminder-call schedules inside it.

​
4. The appointment lifecycle flow

Build on Appointment reminders end to end — it carries the scheduler, the channel fallback, and the delivery verification. This section adds the program shape around it: two-way response handling and the no-show win-back.
Reminder schedule. A workable default cadence is T-24h with the two keywords, then a short T-2h reminder for patients who have not confirmed. Every SMS carries your opt-out language. Emit one event per appointment state change (confirmed, no_show, rebooked) from your scheduling system with a stable appointment_id, and key every condition on that id so a newer booking can never be cancelled or reminded by an older run. Two-way confirm and reschedule. Map inbound keywords to actions: CONFIRM writes the confirmed event and ends the remaining reminders; RESCHEDULE replies with your booking link, or hands the conversation to an AI agent or the inbox for locations that prefer staffed rescheduling. WhatsApp locations use the equivalent approved template with the same two actions. Keep the keyword set to two words; every extra keyword is a misspelling you will support. No-show win-back with caps. When no_show lands, wait a day, then send one win-back message with the rebook link. Two rules keep it defensible:
  • Cap it with your tenant frequency caps — for example, two win-back messages per patient per 30 days — and let suppression absorb opt-outs and manual exclusions.
  • End the run on rebooked, keyed to appointment_id, so a patient who rebooked by phone never receives the win-back the next morning.
A fallback channel is still a new send: it must pass the same consent, quiet-hours, and suppression checks as the primary.

​
5. Voice layer

Two controls cover calls in this program:
  • Recording consent. If reminder callbacks, reschedule calls, or agent calls are recorded, play the consent prompt before recording starts and record the outcome per call. The walkthrough is Execute the DPA and BAA, then manage per-call recording consent.
  • Post-call surveys. One-touch IVR capture after the call closes the loop on access and quality. Survey responses attach to a visit, so treat them with the same retention posture as the rest of the program when you export them. Setup is Post-call CSAT and NPS surveys.
Schedule reminder calls inside the federal calling window; the platform blocks outbound voice outside it regardless of tenant settings.

​
6. Evidence for audits

Assemble the evidence on a cadence, not on demand. A weekly export is a workable default for an active healthcare workspace:
  • BAA execution state and term.
  • hipaa.phi_audiences.set audit rows — the sequence of registry writes is your designation history.
  • Consent and opt-out changes for the designated audiences.
  • Launch precheck refusals and send-gate refusals, with their reasons.
  • AI turn audit records, if you opted in for AI-handled patient conversations.
Pull them through the audit log export, and roll BAA posture plus PHI access logging into a signed download with the compliance evidence binder. A refusal row is not a defect by itself: it means either compliance work is pending or a designation and a campaign disagree, and the row tells you which.

​
7. Rollout checklist

The canonical sequence is the production go-live checklist; this is the healthcare annotation of it:

​
Troubleshooting

​
See also