AI Outbound Calling TCPA Compliance: The Rules Before You Dial

Your AI receptionist has been answering the phone for months and nobody has raised a compliance question about it. Then a vendor offers to point the same voice the other way, at your recall list, and the legal posture changes completely. Statutory damages under the Telephone Consumer Protection Act run $500 per call, and up to $1,500 if a court finds the violation willful or knowing.

The direction of the call is the whole distinction. A patient who dials your office chose to talk to you. A patient whose cell phone rings because your software decided to dial it is receiving a robocall, and on February 8, 2024 the FCC confirmed that an AI-generated voice counts as an artificial voice for exactly that purpose.

This post covers what has to be true before an AI voice dials a patient: the consent standard, the real conditions attached to the healthcare exemption, which call types fall outside it, what the call has to say out loud, and how fast a patient can shut it off. None of this is legal advice. It is the list of specific questions to put in front of whoever reviews your program.

Answering a call and placing one are not the same legal problem

An inbound call is not a robocall. The patient initiated it, so the TCPA's artificial-voice restriction does not reach your AI receptionist answering the phone. An outbound call is the reverse. Your own system chose to dial that number, and that choice is what federal law regulates, one call at a time.

The statute is specific about which direction it cares about. 47 USC 227(b)(1)(A)(iii) prohibits using an artificial or prerecorded voice to call a cellular number unless the call is made for an emergency purpose or with the prior express consent of the called party. Nothing in it applies to picking up a ringing phone.

Most vendors sell both sides as one product called voice AI, and the demo looks identical. It is not one product. If you have never drawn the line between what an assistant handles and what it hands to a person, start with what an AI receptionist does and where it stops, then treat outbound as a separate decision with its own paperwork.

An AI voice is an artificial voice, and the FCC settled that in 2024

On February 8, 2024 the FCC released a Declaratory Ruling holding that calls using AI technologies to generate human voices, including voice cloning, are artificial voices under the TCPA. They need the called party's prior express consent unless an emergency purpose or a written exemption covers them. It clarified existing law.

Each figure is a statute, a rule, or a filing count. None is a Cart Gaze result.

That last point matters more than it sounds. The ruling, FCC 24-17 in CG Docket No. 23-362, did not create a new rule with a future compliance date. It confirmed that the existing rule already reached this technology, so any system dialing patients in early 2024 was already covered and had no runway to get compliant.

Damages are the reason this is worth an hour of your attention. Under 47 USC 227(b)(3) a called party can recover $500 for each violation, or actual loss if greater, and a court may increase that to 3 times the amount for a willful or knowing violation. Courts generally count each call separately, so a 400-record list is 400 exposures, not one.

The volume is real rather than theoretical. WebRecon data reported in Goodwin's 2025 year in review counts 2,588 TCPA suits filed between January and November 2025, roughly flat against the year before. When the FCC delayed part of its own revocation rules, it named healthcare providers among the groups facing real implementation difficulty, which tells you this work is not trivial even for organizations that staff for it.

The healthcare exemption is real, and narrower than it sounds

Federal rules do exempt certain health care messages from the wireless consent requirement, but the exemption comes with conditions attached to every call. Break one and the call needs prior express consent again. The conditions cover who sends it, what it may say, how long it runs, and how often.

The rule is 47 CFR 64.1200(a)(9)(iv). It covers a health care message made by, or on behalf of, a HIPAA covered entity or its business associate, and it lists what has to be true:

• The purpose is on the enumerated list: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions.
• Frequency stays inside 1 message per day per patient, up to a maximum of 3 voice calls or text messages combined per week.
• The message is concise, generally 1 minute or less for a voice call.
• It contains no telemarketing, solicitation, or advertising, and no accounting, billing, debt collection, or other financial content.
• Every message offers an easy way to opt out, and opt-outs are honored immediately.

A patient's landline has its own version of the same idea at 64.1200(a)(3)(v), with the same 1 per day and 3 per week ceiling. Treat the tighter of the two as your operating limit rather than tracking line types you cannot reliably identify.

Map every outbound call type to the consent it actually needs

Consent posture is decided by what the message says, not by why you sent it. Treatment content can ride the healthcare exemption. Anything promotional or financial cannot, and needs prior express written consent instead. Sorting your call list by content is the real work that keeps an outbound program legal.

Treatment content can ride the exemption. Money and marketing content cannot.

Marketing is where practices get caught. A reactivation campaign, a seasonal offer on a cash-pay service, and a med-spa promotion all feel routine from inside the office, and none of them is a treatment message. The exemption does not reach them, and the standard they need is prior express written consent, which is a higher bar than a phone number written on an intake form.

Money is the second trap, and the rule excludes it by name. Balance due, payment plan, and collections calls are financial content. They sit outside the exemption regardless of how gently they are worded or how much the patient would probably want the reminder.

One call type deserves a separate judgment call. Lab results are on the permitted list legally, and they are still a poor fit for an unattended script, because a result a patient does not understand generates a question the script cannot answer. Legal and appropriate are different tests, and an outbound program should pass both. The operational side of reminder cadence, including how a booking and a reminder work together, is covered in AI appointment scheduling and reminders.

What the call has to say, and how fast a patient can stop it

Two duties attach to every artificial-voice call. The message has to identify the entity responsible at the start and give a callback number, and it has to offer an automated way out. A patient who revokes consent in any reasonable way has to be honored, and quickly enough to matter.

47 CFR 64.1200(b)(1) requires the message to state clearly, at the beginning, the identity of the business or entity responsible for initiating the call. 64.1200(b)(2) requires its telephone number, not the dialer's. 64.1200(b)(3) requires an automated, interactive voice or keypress opt-out, offered within 2 seconds of that identification, which records the number and ends the call.

Revocation has its own clock. Under 64.1200(a)(10), a request made in any reasonable manner has to be honored within a reasonable time not exceeding 10 business days from receipt. Most of the FCC's 2024 revocation amendments took effect on April 11, 2025.

One piece of that package is still on hold. The sentence making a single revocation apply to all robocalls and robotexts from the same caller on unrelated matters sits under a Bureau waiver, extended by a January 6, 2026 order to January 31, 2027. Building your system to the waiver means rebuilding it when the waiver lapses, and it means a patient who asked once has to ask again on another channel.

A disclosure that the voice itself is AI-generated is a live FCC proposal in the same docket, not a final rule, so check its status before relying on either answer. Some states are already ahead of it. California's AB 2905, Chapter 316 of the Statutes of 2024, amended Public Utilities Code section 2874 effective January 1, 2025 to require that the announcement tell the person called if the prerecorded message uses an artificial voice.

AI voice, staff call, or text: choose per use case

No channel wins every outbound job. An AI voice reaches patients who ignore texts and never gets bored on call 400. A text is cheaper, leaves a record, and carries different rules. A staff call is not a robocall at all, and on some call types that alone settles it.

Reach and consistency on one side, a per-call legal exposure on the other.

For confirmations and reminders, a text is usually the better first choice and the voice call is the fallback for patients who do not text. The rules for that lane are genuinely different from these, and they are worth reading on their own in TCPA compliance for patient texting before you assume one consent record covers both.

For recall and reactivation, an AI voice reaches people a text never will, and the copy drifts promotional faster than anyone expects. For clinical follow-up, route to a person. An AI voice must never assess symptoms or give medical advice, whichever direction the call was placed in.

State law then stacks on top of all of it. Mini-TCPA statutes carry their own damages, with Texas SB 140 reaching up to $5,000 per violation, and their own operating limits, with Oregon's HB 3865 restricting contact to 8 a.m. to 8 p.m. and capping calls at 3 per consumer per day. If you also record these calls, a separate set of state all-party consent rules applies to the recording.

Field note

Before the first outbound AI call goes out

• Every number on the list came from the patient, with a dated record of when and how.
• Scripts have been read for promotional or billing language that would void the exemption.
• The opt-out has been used from a real phone, and that number stopped receiving calls.
• A healthcare attorney has reviewed the call types, the consent sources, and the scripts.

Decide per call type, then have counsel read the program

Work through your outbound list one call type at a time. Check the content, the number's origin, the opt-out history, and the frequency window before anything dials. Then have a healthcare attorney read the actual program, because statutory damages run per call and this area is heavily litigated in court.

Route by content and consent, not by campaign. Every outbound call needs a record.

Walk the flow once. Promotional or billing content needs prior express written consent and gets no help from the healthcare exemption. A number the patient did not give you does not get auto-dialed. An opt-out already on file ends the matter. Everything else has to fit inside 1 call a day and 3 a week, with a disclosure and a working way out.

Start narrow rather than switching on a list of 2,000. One call type, one consent source, one week of recordings someone actually listens to. If you would rather see where your front office is losing patients before you add another outbound channel, the free Growth Leak Audit works from your own numbers first.