Skip to main content
← All articles

SMS Consent for Australian Clinics: 5 Checks Before You Send

Sketch illustration framing the SMS consent title

Yes, clinics can send SMS for routine appointment and administrative messages, and consent can often be implied when the message relates directly to a patient’s care. Express consent is required for direct marketing or anything built from sensitive health information, under rules shaped by the Spam Act, the Privacy Act and ACMA’s consent expectations. Every consent decision belongs in the patient record, with sender ID and an unsubscribe option on any commercial message.

TL;DR:

  • Keep appointment, billing, and rescheduling texts administrative; adding a promotion to any reminder can trigger commercial message consent, sender identification, and unsubscribe requirements.
  • Clinics need express consent for marketing and sensitive content; staff should verify the number and confirm permission before texting clinical details.
  • Record consent in the patient’s clinical file with its purpose, type, timestamp, verified number, and staff member; renew the record when the message purpose changes.
  • Store consent in the EMR and link it to message logs; reconcile withdrawals and ensure the provider supports exportable audit trails and automatic unsubscribe processing.
Meddle
Find a practitioner who fits
Meddle matches patients with healthcare practitioners based on their needs and preferences, helping simplify the appointment booking process.

Table of Contents

Most compliance risk comes from treating every SMS the same way. Administrative reminders and marketing messages sit under different rules, so the first job is sorting your message types before you send anything.

  1. Classify each SMS by purpose: administrative (booking, billing) or direct marketing.
  2. Capture express consent for marketing or sensitive content; rely on implied consent only when the message is tied directly to the patient’s own care.
  3. Record consent with date, time, purpose, channel and the staff member who obtained it.
  4. Add clear sender identification and a working unsubscribe method to every commercial message, and action opt-outs without delay.
  5. Audit consent records and refresh staff training on a regular schedule.

Pro Tip: Build the consent question into your existing intake form instead of a separate step. Clinics that ask once, at booking, get cleaner records than those chasing consent after the fact.

Three frameworks govern SMS to patients, and they overlap more than most practices expect.

  • The Spam Act 2003 requires consent, accurate sender identification and a working unsubscribe for commercial electronic messages, though purely administrative messages with no marketing content are often exempt.
  • The Privacy Act 1988 and the Australian Privacy Principles treat health information as sensitive information, so using it for direct marketing or any secondary purpose generally needs express consent under APP 6 and APP 7.
  • Implied consent only covers communication that is directly related to the primary purpose of care, where the patient would reasonably expect that contact. Anything beyond that, including marketing, newsletters or health promotions, needs express, purpose-specific consent.

ACMA’s Statement of Expectations, published in mid-2024, asks businesses to favour express consent backed by clear terms and an accessible unsubscribe process for SMS and email marketing. It does not replace the Spam Act, but it signals how the regulator expects businesses, including clinics, to behave in practice.

Mixing administrative and promotional content in one message is one of the more common mistakes. An onboarding text that reminds a patient of their appointment and also promotes a new service is no longer a simple administrative message, and it can trigger full Spam Act consent requirements.

Appointment reminder combined with a service promotion

What’s appropriate to send by SMS and what isn’t

Not every clinical update belongs in a text message. The safest rule is to match the content to the risk, not the convenience.

  • Low risk, generally fine: appointment reminders, rescheduling confirmations, billing or payment reminders, simple service notifications.
  • Higher risk, needs more care: diagnostic results, mental health or sexual health details, anything a third party could read on the patient’s phone without consequence to the patient.
  • Template language that works: “Reminder: your appointment with [practice] is on [date] at [time]. Reply STOP to opt out.” Keep it short, factual and free of clinical detail.
  • Before sending anything sensitive, confirm the number belongs to the patient and that they have actually agreed to receive that type of content by SMS.

RACGP’s Criterion C1.2 on communications recommends restricting SMS to administrative coordination unless a clinician judges exceptional circumstances justify otherwise, which keeps patient expectations about privacy realistic rather than assumed.

A checkbox in a CRM is rarely enough on its own. RACGP guidance points to documenting the specific outcome of the consent conversation in the patient’s health record, not just the fact that consent exists.

  1. Ask for express consent at intake, face to face, by phone or through an online form, and record it immediately.
  2. Capture the minimum fields: patient identifier, verified phone number, consent type (express or implied), purpose, date and time, and the staff member who obtained it.
  3. Use plain scripts. For reception: “We’d like to send appointment reminders and occasional updates by SMS. Is that okay, and is this the best number?” For online intake: a single checkbox reading “I agree to receive SMS messages about my appointments and care from [practice].”
  4. Re-confirm consent if the purpose changes, such as moving from reminders to marketing content, and log any withdrawal the same way you logged the original consent, with date, time and method.

Pro Tip: Store the consent note as a short line in the clinical record, not just a flag in your booking system. A timestamped sentence like “SMS consent confirmed by patient, reminders only, 14/02/2026” holds up far better under review than a database field with no context.

Our consent management guidance walks through this process step by step if you’re building a policy from scratch.

Consent only protects a clinic if it’s recorded somewhere staff can actually find and trust. That means your EMR, your messaging vendor and your audit process all need to agree with each other.

  • Store the consent flag in the EMR and link it to the message log, so anyone reviewing a patient’s file can see what was sent and why.
  • Choose a vendor that provides clear sender ID, a working unsubscribe, transparent data handling and data residency, and audit logs you can export.
  • Limit staff access to messaging tools, verify phone numbers at intake and reconcile opt-outs against your send list on a regular schedule.
  • When evaluating a new SMS provider, check for Australian data handling, consent-capture fields, automated unsubscribe processing and exportable audit trails before signing up.

Our secure patient messaging checklist covers the audit logging side of this in more detail, and clinics outside Australia researching parallel long-term care texting rules can see how secure texting compliance is handled under a different jurisdiction, useful context but not a substitute for Australian rules.

We built our SMS Notifications and CRM Integration features to take the manual work out of this process. Here’s what that looks like in practice:

  • SMS Notifications and CRM Integration plans include consent workflow hooks that timestamp every message sent and every opt-out received.
  • Those logs map directly to the recordkeeping and unsubscribe requirements outlined above, so a clinic’s audit trail stays intact without a separate manual process.
  • Our matching engine reports a high success rate connecting patients with the right practitioner, and we apply the same privacy-first approach to messaging data as we do to clinical matching.
  • We still recommend validating any integration or data handling detail with your practice’s privacy officer before rolling it out, since every clinic’s policy settings differ.

Balancing access, safety and compliance

Good SMS practice isn’t about avoiding text messages. It’s about knowing which messages carry risk and writing down what you did about it. A clear policy and a one-line note in the record protect patients and your clinic in equal measure.

— Taylor

We know most clinics don’t want another spreadsheet to track consent, they want the texting to just work. Our SMS Notifications and CRM Integration plans build the consent and audit logging described above directly into your booking and messaging workflow.

Meddle

  • SMS Notifications and CRM Integration plans include timestamped consent and opt-out logs for medico-legal recordkeeping.
  • Our pricing page lists current plan details, and our help centre walks through implementation steps for clinics rolling out SMS for the first time.

Check pricing to see which plan fits your practice, or browse the help centre for setup guidance before you switch on SMS for your patients.

FAQ

What are the new SMS rules in Australia?

There’s no single new SMS law, but ACMA’s 2024 Statement of Expectations asks businesses to favour express consent, clear terms and an accessible unsubscribe process for SMS marketing. It sits alongside the existing Spam Act 2003 rather than replacing it, so administrative messages with no marketing content can still be exempt from full consent requirements.

Health information is sensitive information under the Privacy Act 1988, so using it for direct marketing or any purpose beyond direct care generally requires express consent under the Australian Privacy Principles. Implied consent is accepted only when the communication relates directly to the patient’s primary purpose of care and they’d reasonably expect it.

SMS consent is a patient’s agreement to receive text messages from a clinic, and the type required depends on what the message contains. Administrative messages like appointment reminders can often rely on implied consent, while marketing or anything built from sensitive health detail needs express, purpose-specific consent recorded in the patient’s file.

Healthcare consent is generally either express, where the patient actively agrees to a specific purpose, or implied, where consent is reasonably assumed because the communication is part of ongoing care. RACGP guidance recommends recording the type of consent, the purpose and the date whenever either is relied upon, rather than treating a single CRM checkbox as sufficient.

Sources

For the full detail behind this guidance, these are the primary sources clinics should bookmark.