Skip to main content
← All articles

SMS opt-out in Australian healthcare: what clinics must do

Hand-drawn phone and opt-out symbols

When a patient texts STOP, your clinic has to act, but what it must stop depends on the message. Under Australia’s Spam Act, marketing texts need a working opt-out and must cease within 5 working days of a request. Genuine service messages, such as an appointment reminder, generally sit outside that rule. The risk for most clinics is not the law itself. It is the gap between the rule and the way reception, your booking system and your messaging tool actually handle a reply.

This guide is for practice managers and clinic owners. It explains what an opt-out means in a healthcare setting, which messages it covers, how to process requests from any channel, and how to keep records that hold up.

Meddle
Keep Referral Intake in One Place
Meddle helps allied-health clinics capture, triage and match incoming referrals, so fewer are lost between your reception team and clinic systems.
Visit Meddle

TL;DR

  • An opt-out stops marketing messages. Appointment and payment reminders, and messages about a service the patient already uses, are generally not treated as spam.
  • Marketing SMS needs consent, a clear sender identity and a free or normal-cost unsubscribe that needs no login. Requests must be actioned within 5 working days.
  • A patient can opt out by reply, phone, email or in person. Your process needs to capture all four.
  • Record each patient’s SMS preference once, in one place, and make every tool read from it.
  • Keep sensitive clinical detail out of texts unless the patient has expressly agreed to that channel.

Table of Contents

What an SMS opt-out means for a clinic

An opt-out is a patient asking you to stop sending a type of message. In Australian law, the focus is marketing. The ACMA explains that opting out means asking the sender to stop marketing messages, and that messages without advertisements, such as appointment or payment reminders or messages about a service the person already uses, are generally not spam.

That distinction matters in an allied-health clinic, where most of your texts are operational:

  • appointment confirmations and reminders
  • rescheduling and cancellation notices
  • intake and referral status updates
  • forms to complete before a first visit

Promotional content is different. A newsletter-style text about a new group program, a seasonal offer, a discount on a product or a request to leave a review with an incentive all carry a commercial element. Those need consent and an unsubscribe path.

The mixed-message trap

The line blurs when you add promotion to a reminder. A text that confirms Tuesday’s physio appointment and then adds “book your next orthotics fitting for 10% off” is no longer a plain service message. Treat it as marketing, or keep the two apart. The simplest policy is that reminder templates carry no promotional content at all.

Which Australian rules apply

Three pieces of legislation come up most often when clinics send electronic messages. The RACGP tells practices to consider the Privacy Act, the Spam Act 2003 and the Do Not Call Register Act 2006, which generally prohibit unsolicited communications aimed at selling goods or services.

In practical terms:

  • Spam Act 2003 governs commercial electronic messages, including SMS. It sets the consent, sender identification and unsubscribe requirements.
  • Privacy Act 1988 and the Australian Privacy Principles govern how you use personal information. APP 7 regulates the use or disclosure of personal information for direct marketing.
  • Do Not Call Register Act 2006 covers telemarketing calls and faxes, so it is relevant if your follow-up for an opt-out includes phone outreach.

For health information specifically, the RACGP notes that in general practice it must not be used or disclosed for direct marketing without patient consent. The same logic is sensible for any allied-health clinic holding health records.

If you want a deeper look at the privacy side, our guide to the Australian Privacy Principles for healthcare walks through six clinic steps.

What a compliant opt-out looks like

Business.gov.au sets out the core requirements for commercial texts: businesses must get permission, include a clear unsubscribe option, and register their branded sender ID. On the unsubscribe itself, the ACMA’s fact sheet says a marketing SMS must generally include an opt-out method that is free or costs no more than a normal SMS, does not require a login or extra personal information, and keeps working for at least 30 days after sending.

The checklist for your templates:

  1. Say who you are. Use a recognisable clinic name as the sender, not a bare number.
  2. Make the opt-out obvious. A short line such as “Reply STOP to opt out of marketing texts” works for most clinics.
  3. Do not ask for anything extra. No portal login, no account creation, no requirement to supply more personal details.
  4. Keep it working. The opt-out must remain functional for at least 30 days after the message goes out.
  5. Act within 5 working days. Business.gov.au states that businesses must remove people no later than 5 working days after a request.

Five working days is a ceiling, not a target. If your system can honour a STOP reply immediately, do that. A patient who has asked to stop and gets another promotional text two days later is far more likely to complain.

Penalties and complaints

Patients can report businesses that do not comply with the electronic message rules to the ACMA, as business.gov.au confirms on the same page. For a small clinic the reputational cost of a complaint is usually larger than any procedural cost of getting this right.

Consent: what you need before the first text

Opt-out only matters if you had permission to send in the first place. Consent can be express or implied, and the distinction shapes how careful you need to be.

Service messages

The OAIC says healthcare providers should assess consent case by case, but that consent can generally be implied for patient-specific communications such as notifications of results, recalls and follow-up after disease screening. Where you are not sure implied consent is reasonable, the OAIC says to consider other permissions under the Privacy Act 1988.

For an allied-health clinic, a patient who gives you their mobile number to book a session has a reasonable expectation of reminders about that session. They have not necessarily agreed to hear about your new services.

Marketing messages

For marketing, aim higher. The ACMA recommends express consent based on clear terms that specify what the marketing is for, who will use it, and how consent can be withdrawn. Its Statement of Expectations is an outcome-focused guide to better practice, designed to help businesses meet consumer expectations and minimum legal requirements.

The RACGP suggests practices obtain consent on patient registration sheets, as patients present to the practice, or through a directed consent campaign. A well-designed intake form can do this with two separate tick boxes:

  • “I agree to receive appointment reminders and service updates by SMS.”
  • “I agree to receive news and offers from the clinic by SMS.”

Keeping them separate means a patient can say yes to reminders and no to promotions, and your records show exactly what they agreed to. Our five-step consent alignment guide and the SMS consent checks cover the wording in more detail, and our guide to pre-appointment questionnaires shows where consent questions fit in the intake flow.

How to handle an opt-out, whatever the channel

The ACMA says a recipient may unsubscribe at any time, including by replying to the SMS or contacting the business through another channel. That means a patient can say it at the front desk, leave a voicemail, or email the practice manager. All of these count.

The channel that causes the most trouble is the informal one. A receptionist hears “please stop texting me” at check-out, nods, and nothing is recorded. Two weeks later a promotion goes out.

A simple five-step process

  1. Capture it where it happens. Give every team member the same one-line instruction: any request to stop texts goes into the patient record that day.
  2. Record the scope. Did the patient opt out of marketing only, or do they not want any texts, including reminders? Ask, and write down the answer.
  3. Update the master list. One suppression list, not one per tool. If your reminder system and your newsletter tool hold separate lists, they will drift apart.
  4. Confirm once. A single confirmation text or a note at the next visit is reasonable. Do not use the confirmation to sell.
  5. Audit monthly. Before any campaign, check the send list against the suppression list. The RACGP stresses that practices need robust procedures to ensure patients who have refused marketing are strictly excluded from those lists.

When a patient wants no texts at all

Some patients will not want SMS of any kind, including reminders. That is their choice, and a general exemption for service messages does not remove your obligation to respect a stated preference for how you contact them. Switch them to phone or email, and record the preference so the next person who books them in does not send a reminder by habit.

Recording SMS preferences so they stick

Avant recommends that practices document preferred contact details when patients register, obtain SMS consent on registration forms or online portals, and regularly check that details remain current. It also advises explicitly recording when a patient does not consent to SMS, to avoid privacy breaches.

A workable preference record has these fields:

Field Example value Why it matters
Mobile number and date confirmed Confirmed at registration Stops texts going to an old number
Reminders by SMS Yes / No Controls operational messages
Marketing by SMS Yes / No Controls promotional messages
Preferred alternative Email / phone Gives staff a fallback
Date and channel of last change Reply STOP, by text Shows when and how it was updated

The point is that every tool (booking, reminders, newsletters, referral updates) reads the same record. If staff have to retype a preference into three systems, one will be missed.

Referral updates and other messages

Allied-health clinics send more than reminders. Intake teams message patients about referral status, waitlist position, documents needed and first-appointment details. These are patient-specific and tied to a service the person has asked for, so they generally behave like service messages. They still need a sensible preference setting. A patient who has told you “no texts” should not get a referral update by SMS just because it is not marketing.

Referrers are a separate audience. GPs and NDIS support coordinators who send you referrals are business contacts, and any promotional messages to them are governed by the same consent and unsubscribe rules. Keep clinical correspondence (a referral acknowledgment) distinct from outreach (an announcement about your new service).

Exceptions and limits

The OAIC notes that a commercial electronic message that is purely factual, with no commercial element, may be partially exempt from certain Spam Act requirements. That is why plain appointment reminders generally do not need the same unsubscribe wording as a promotion. Do not stretch that exemption. If a message sells, it is marketing.

A few other limits to hold in mind:

  • Sender identification still matters for factual messages. Patients should know who is texting.
  • Consent is not forever. If a patient withdraws agreement, your lawful basis for that type of message ends.
  • Opt-out does not erase the record. You can keep the fact of the opt-out, and you should, so you do not message them again by accident.

Keep sensitive details out of the text

SMS is not a private channel. Phones are shared, lock screens show previews and numbers change hands. Avant advises that messages should not contain sensitive health information, such as specific test results, unless the patient has given express consent for that communication method. It adds that mobile numbers tend to be more reliable, but practices should limit content to reduce the risk of others seeing sensitive information.

For allied health, that means:

  • Use “your appointment on Thursday at 2 pm” rather than naming the condition or program.
  • Avoid the practitioner’s specialty where it reveals a sensitive service, such as psychology or continence physiotherapy, unless the patient has agreed.
  • Send links to a secure portal instead of clinical content.

For more on this, the overview of secure messaging in healthcare covers how to limit sensitive information in patient texts, and our six-step secure patient messaging checklist turns it into a clinic routine. If you are building reminder wording from scratch, see SMS appointment reminders for Australian practices.

Our perspective

We build referral intake and triage software for allied-health clinics, so we see where messaging breaks down: not in the policy, but in the hand-offs. A referral arrives by fax, email or a GP’s system. Someone enters the patient’s mobile number. A reminder goes out. Then the patient says they do not want texts, and that message lands in a different place from the one the next staff member checks.

Our perspective — overview diagram

Our view is that preferences should be captured at intake, once, in structured form, and then used by everything downstream. That is why we treat the preference as part of the referral record rather than an afterthought in a separate messaging tool. When your intake team can see at a glance that a patient accepts reminders but not marketing, the right decision is the easy one.

We also think clinics should be wary of treating “it’s only a reminder” as a blanket pass. Keep reminder templates clean, keep promotion in a separate and consented channel, and keep clinical detail out of any text. Those three habits remove most of the risk.

— Taylor

Where Meddle fits

Meddle captures referrals from GPs, NDIS support coordinators and other referrers in one place, triages them and matches each patient to the right practitioner. Because intake is where contact details and preferences are first collected, it is a natural point to record how each patient wants to hear from you. You can see how the workflow runs on the How Meddle Works page.

SMS Notifications is an optional add-on at A$50 per month per practice, listed with the other add-ons on our pricing page. The core platform is AA$40 per practitioner per month ex GST, with a A$250 minimum, and there is a free 30-day pilot. Patient data is hosted in Sydney. If you want to see how intake and messaging preferences would work in your clinic, you can book a 30-minute demo at the link below.

Practical checklist for your clinic

Use this as a quick audit:

  • [ ] Registration and intake forms have separate tick boxes for reminders and marketing.
  • [ ] Marketing texts identify the clinic and include a free or normal-cost opt-out that needs no login.
  • [ ] Reminder templates contain no promotional content.
  • [ ] Any opt-out, by any channel, is recorded on the patient’s file the same day.
  • [ ] There is one suppression list, checked before every campaign.
  • [ ] Requests are actioned well inside 5 working days.
  • [ ] Texts avoid specific test results and sensitive service detail.
  • [ ] Contact details are confirmed at registration and reviewed regularly.
  • [ ] Staff know the process, and new starters are trained on it.

If you want to widen the audit, the 12-step guide on securing patient records and APP 11 is a sensible next step.

FAQ

Generally, no. The ACMA says messages without advertisements, such as appointment reminders, are generally not spam. If you add any promotion, the message becomes marketing and needs consent, sender identification and an unsubscribe. Even for plain reminders, honour a patient’s request to switch off texts.

How long do we have to process an opt-out?

For marketing messages, you must stop within 5 working days of the request. The ACMA notes that the request can come by replying to the SMS or through another channel. Aim to action it the same day.

Can a patient opt out in person at reception?

Yes. An opt-out does not have to be a text reply. Reception staff should record it on the patient’s file immediately and confirm whether it covers marketing only or all texts.

Can we text test results to patients?

Avoid it unless the patient has given express consent to receive that kind of information by SMS. Avant advises keeping sensitive health information, such as specific results, out of texts without that consent. A neutral prompt to call the clinic or log in to a secure portal is safer.

To see how structured intake could help your team record preferences consistently, book a 30-minute demo.

Sources

This article is general information for healthcare businesses and isn’t legal, clinical or privacy advice. Check current requirements with the relevant regulator or a qualified adviser.