The rules for texting patients in Australia

You can text your patients. The rules don't stop a clinic messaging its own patients about their own care. What they do is draw a line between a message about the treatment someone had with you and a message that promotes something, and they put conditions on both. Cross the line without noticing and the same text that was fine on Monday needs consent you don't have on Tuesday.

This is the full set of rules that touch a patient SMS in Australia, in plain English, with the regulator's own sentence quoted wherever a rule matters. It's written for a clinic owner, not a lawyer, and it isn't legal advice. If something here is going to decide what you send to a thousand people, have a lawyer read it first.

The four regimes, in one table

The rest of this guide takes them one at a time.

1. The Spam Act 2003: consent, identify, unsubscribe

The ACMA runs this one. Its plain-language page says: "If you plan to send marketing messages or emails, you must first have consent from the person who will receive them." And a line that matters if you use an agency or a booking system to send for you: "Even if someone else is sending out your marketing messages for you, you must still have consent from each person who will receive your messages" (ACMA).

There are two kinds of consent.

Express consent is the tick box, the signed form, the yes on the phone. The ACMA: "People can give express consent by one of the following: filling in a form; ticking a box on a website; over the phone; face to face." Keep a record of "who gave the consent, when and how", because "Under the Spam Act, it's up to you to prove that you have a person's consent."

Inferred consent is the one clinics usually rely on for their own patients. The ACMA allows it "if the recipient has knowingly and directly given their address and it is reasonable to believe they would expect to receive marketing from your business", and says this "is usually when a person has a provable, ongoing relationship with your business, and the marketing is directly related to that relationship." Two warnings sit right next to that. "It does not cover sending messages after someone has just bought something from your business." And: "Inferred consent is not as reliable as getting someone's express consent."

One more rule people miss: "You cannot send an electronic message to ask for consent, because this is a marketing message." So texting the whole database "reply YES to hear from us" is itself the thing you needed consent for.

Identify yourself. Every message must "accurately identify your name or business name" and "include correct contact details for you or your business", and that information "must remain correct for at least 30 days after you send the message." If someone sends on your behalf, "the message must still identify you as the business that authorised the message."

Make it easy to unsubscribe. The ACMA's list, verbatim, because every point on it is a separate way to get it wrong:

every commercial message must contain an 'unsubscribe' option that: presents unsubscribe instructions clearly; honours a request to unsubscribe within 5 working days; does not require the payment of a fee; does not cost more than the usual amount for using the address (such as a standard text charge); is functional for at least 30 days after you sent the message; does not require the person to give extra personal information or log in to, or create, an account to unsubscribe from marketing messages.

Its own SMS examples are "Reply STOP" and "Unsub: (1800-number)". And a tip that catches a lot of clinics using a branded sender name: "if you are using an alphanumeric message header in SMS, these are generally not capable of receiving return messages." If your texts come from "SKINCLINIC" instead of a number, "Reply STOP" is a dead instruction. Full walkthrough in the Spam Act for clinics.

Last one from the same page: you cannot "use or supply a list that has been created with address-harvesting software". Your own patient list isn't harvested. A bought list might be.

2. The Privacy Act: your patient list is health information

This is the regime most SMS-vendor blogs skip, because it doesn't apply to a retail shop. It applies to you.

Anything in your booking system that shows what treatment someone had is health information, which the Privacy Act treats as sensitive information. The OAIC's direct-marketing guideline, APP 7, says "an organisation must not use or disclose personal information it holds for the purpose of direct marketing unless an exception applies", and the general exceptions "apply to personal information other than sensitive information" (OAIC, Chapter 7). For sensitive information there's a separate rule, APP 7.4, and it requires consent.

The OAIC has a page written specifically for health service providers, and it's the most useful document in this whole guide. It says "For many communications, a patient's consent to receiving the communication can usually be implied", and it lists when that's easier: where "the patient has previously received and/or discussed with you the particular service addressed in the particular communication", "the patient regularly attends the clinic", "the patient recently attended", and "the patient would reasonably expect you to communicate" with them (OAIC, Communications with patients).

Then it draws the line. "Under APP 7, direct marketing using sensitive information, such as health information, is only permitted with the implied or express consent of the individual. Therefore, if consent cannot be implied for sending a specific communication to a patient, express consent is required." And it gives the example that defines the marketing side: "express consent is needed for communications that are not targeted to an individual patient's specific healthcare and which are sent in a more indiscriminate manner to a practice's entire database. These communications might include, for example a letter sent to an entire practice's database about the availability of the influenza vaccination".

So for a clinic, two lanes:

• Recall. Individually about the service that patient had with you, their own re-treatment interval, no offer. Consent can usually be implied. The OAIC lists "recalls" among the messages where "it is reasonable to imply the patient's consent".
• Marketing. Anything sent to a group regardless of their individual care, anything promoting something new, anything with an offer. Needs consent you can point to.

The test that sorts one from the other is a single question, and it has its own short page: could this exact message have gone to any other patient unchanged?

Two more lines from APP 7 worth keeping. "An organisation should not assume that an individual would reasonably expect their personal information to be used or disclosed for the purpose of direct marketing just because the organisation believes that the individual would welcome the direct marketing." And on consent itself: it must be informed, voluntary, "current and specific". Consent given three years ago on an intake form for "appointment reminders" is not consent for a promotional text today.

Where the Spam Act covers a message, APP 7 steps back ("APP 7 does not apply to the extent that ... the Spam Act 2003 ... apply"), but the sensitive-information rule still stands. Treat them as stacking, not alternatives. APP 7 and clinic marketing goes deeper.

3. AHPRA: a text is advertising

If you're a registered health practitioner, or you advertise a regulated health service, AHPRA's advertising rules apply to what you text as much as to your website. The summary page sets the standard: "Information in advertising should not be false, misleading or deceptive" and "Any claims made in advertising must be supported by acceptable evidence" (AHPRA summary).

Three rules land directly on reactivation messages.

No testimonials. "Advertising must not use testimonials or purported testimonials, that is, recommendations or positive statements about the clinical aspects of a regulated health service. 'Clinical aspects' refers to statements about symptoms, diagnosis, treatment, outcome." So "Sarah said her skin's never looked better" is out. AHPRA does add that "comments about customer service or communication style that do not include a reference to clinical aspects are not considered testimonials".

Careful with inducements. "Advertising that uses bonuses, discounts, gifts, or prizes may directly or indirectly encourage the unnecessary use of regulated health services." A win-back discount isn't automatically banned for a non-prescription service, but it needs its terms stated and it can't push someone toward a treatment they don't need. For injectables the TGA rule below makes the point moot.

No outcome promises. Patient stories and before-and-after images "may create an unreasonable expectation of beneficial treatment". That includes a line like "get your glow back".

The AHPRA rules for patient text messages page has the wording to use instead.

4. The TGA: don't name the product

The TGA regulates medicines, and most cosmetic injectables are prescription-only. Its FAQ for clinics: "Most cosmetic injectables contain substances that are in Schedule 4 to the Poisons Standard and, in accordance with the Therapeutic Goods Act 1989 (the Act), cannot be advertised to the public" (TGA FAQ).

That includes the workarounds everyone used for years: "We no longer expressly permit references to terms such as 'wrinkle reducing injections' or 'dermal fillers' where those terms would result in a reasonable consumer understanding the intention of the content is to promote the use or supply of a prescription-only medicine ... This includes through acronyms, nicknames, abbreviations and hashtags".

What to do instead, in the TGA's words: "clinics should focus their advertising on the types of consultations available instead of referring to prescription-only medicines or substances used in the treatments they offer."

A reactivation text is public advertising if it's sent unprompted. So the message says "your next appointment" or "a review with Jess", not the product. Once the patient replies and you're in a private conversation, the TGA says "information shared between a health practitioner and their patient during a private consultation or treatment, is not subject to the advertising rules", and "solicited information (requested or asked for by a patient) is less likely to meet the legislative definition of 'advertise'". The first text is the exposed one.

Two traps the TGA calls out: your online booking page counts ("Publicly available booking systems that draw consumers to a service on the basis that specific therapeutic goods are used ... are likely to be an advertisement"), and a disclaimer doesn't save you ("a statement advising the viewer that the 'information is provided for education purposes only', does not discharge the obligation"). More on why your recall text can't name the treatment.

Putting it together: a text that passes all four

Hi Priya, it's Mel from [Clinic name]. It's been about 6 months since your last skin treatment with us, so it's about time for a review. Want me to hold you a spot next week? Reply with a day, or STOP to opt out.

Walk it through. Sender identified by person and clinic (Spam Act). Tied to the service she had and her own interval, no offer, no promotion, so it sits in the recall lane (Privacy Act). No testimonial, no discount, no outcome claim (AHPRA). No product named (TGA). Working opt-out that a phone can actually reply to (Spam Act). It's also 200 characters, so it'll cost two SMS credits on most platforms; the templates guide has versions under 160.

Now the same idea done wrong:

[Clinic] here! Miss your injectables? 20% off this month only. Book now! No reply.

Points straight at a Schedule 4 product category (TGA), leads with a discount on it (TGA and AHPRA), goes to everyone regardless of what they had (Privacy Act marketing lane, needs express consent), no sender person, no opt-out that works (Spam Act). Five breaches in 90 characters, and it's the most common reactivation text in the industry.

The checklist before any send

• Who is this going to, and why them specifically? If the answer is "everyone who hasn't been in", it's marketing.
• What consent do I have for each of them, and where is it recorded?
• Does the message name me and my clinic, and will that stay correct for 30 days?
• Can they reply STOP, and does STOP reach a human or a system that acts within 5 working days?
• Does it name a product, a nickname for a product, or a discount on one?
• Does it quote a patient, promise a result, or show a before-and-after?
• Who is answering the replies in the next hour?

That last one isn't a legal rule. It's the one that decides whether any of this was worth doing. Once the rules are handled, the guides on what to text and how to pull the list from your booking system are where the bookings come from.