Last Updated: October 12, 2026
Most sexual health outreach programs break the rules before the first patient answers the phone. The script names a test, the voicemail hints at a result, the text says too much, and by the second attempt the clinic has a privacy problem it cannot undo.
This guide from The Marketing Lab covers how to build HIPAA compliant patient outreach scripts for sexual health clinics that protect patients and still fill the schedule.
The core problem: sexual health outreach sits between two goals that pull against each other. You want the patient to come in, and you cannot say why.
The HIPAA Privacy Rule limits what a clinic can leave on a voicemail, send by text, or say to whoever picks up the phone.
That shift, from "your results" to "a program we offer," separates a compliant campaign from a liability.
Patient outreach in a sexual health setting starts with consent and a clear line around protected health information, or PHI. PHI links a patient to their care and must never travel through an unsecured channel.
Two consent types matter, and they are not interchangeable.
A patient can agree to one and refuse the other. Under the TCPA, promotional texts need prior express written consent, and A2P 10DLC registration requires separate consent checkboxes, STOP and HELP language, and a rates disclosure.
Customer-care messages serve existing care; promotional messages sell a service. Mixing them in one consent box creates a compliance gap.
Keep them separate in the intake form, portal, and CRM. If a patient opts out of promotional texts, care reminders can continue; if they opt out of everything, honor it and log the date.
A patient outreach call script should invite the patient to a general prevention program without naming any test, result, or diagnosis.
Start with identity, then the invitation, then a clear next step. Verify you are speaking with the patient before you say anything about the clinic's purpose. If someone else answers, do not confirm the patient is a patient. Ask to leave a general message and stop there.
The same script covers STI follow-up, PrEP follow-up, contraception, and injectable PrEP recall. If your scripts change by scenario, your schedulers will eventually say the wrong thing.
| Scenario | What the script says | What it never says |
|---|---|---|
| STI follow-up | "We're inviting all patients to a free prevention and education program." | Any test name, result, or diagnosis |
| PrEP cadence reminder | "We'd like to schedule your next visit in our prevention program." | "PrEP," "HIV test," or a lab name |
| Injectable PrEP recall | "It's time for your next visit in our prevention program." | Drug name, dose, or injection site |
| Contraception | "We offer a women's health and prevention education program." | Method name or reason for visit |
| Lab follow-up | "Please check your patient portal for a message from our team." | "Results," "labs," or a clinical finding |
English call script: "Hello, this is [Name] calling from [Clinic]. We're reaching out to all our patients about a free prevention and education program we offer.
Spanish call script: "Hola, le habla [Nombre] de [Clínica].
Neither script names a test, result, or diagnosis, just an invitation. In Miami-Dade and Broward, run the same script in Haitian Creole where the patient's preferred language calls for it, and log the language preference in the CRM.
A voicemail is the riskiest channel because you cannot verify who is listening. Treat every voicemail as if a family member or roommate will hear it.
English voicemail: "Hello, this is [Clinic] calling for [Patient]. We'd like to invite you to a free prevention and education program.
Spanish voicemail: "Hola, le habla [Clínica] para [Paciente]. Queremos invitarle a un programa gratuito de prevención y educación. Por favor llámenos al [número]. Gracias."
Not every call is a script problem. Some calls need a privacy officer, not a scheduler.
HIPAA-compliant voicemail scripts for medical offices leave only the clinic name, a callback number, and a generic invitation, nothing about the reason for the call.
English voicemail: "Hello, this is [Clinic] calling for [Patient]. We'd like to invite you to a free prevention and education program.
Spanish voicemail: "Hola, le habla [Clínica] para [Paciente]. Queremos invitarle a un programa gratuito de prevención y educación. Por favor llámenos al [número]. Gracias."
HIPAA-compliant patient text message examples follow one rule: the text announces a program, and the portal holds the detail.
Here is a do and don't table schedulers can keep at their desk.
| Do | Don't |
|---|---|
| Name the clinic and the program | Name a test, result, or diagnosis |
| Include STOP and HELP language | Send promotional texts without written consent |
| Link to the patient portal | Put clinical detail in the message body |
| Send during reasonable hours | Text more than the agreed frequency |
| Log the consent type | Assume one consent covers both types |
English text: "[Clinic]: You're invited to our free prevention and education program. Details in your patient portal.
Spanish text: "[Clínica]: Le invitamos a nuestro programa gratuito de prevención y educación. Detalles en su portal del paciente.
Patient outreach attempt tracking works only when the log is simple enough to use on every call. A scheduler fielding dozens of calls a day will not fill out a complex form.
Track five fields per attempt, no more.
A realistic floor is around 30 calls and 5 bookings per scheduler per day. Anything above that usually means shortcuts that cost you documentation.
Every response needs a defined path and an owner. In our experience, programs rarely fail on the script, they fail on the absence of a written rule for what happens after the patient replies.
Start with identity verification: confirm you are speaking with the patient using two data points (name plus date of birth). If the patient replies by text or portal message, verify through the portal before moving any clinical detail.
| Patient response | Action | Owner | Documentation |
|---|---|---|---|
| Books an appointment | Confirm and send details to the portal only | Scheduler | Appointment logged in CRM pipeline |
| Opts out of one channel | Stop that channel, keep other consented channels open | Scheduler | Date, channel, message type logged |
| Opts out of everything | Honor immediately, stop all outreach | Scheduler | Date and scope logged; privacy officer notified |
| Asks a clinical question | Do not answer in the thread; route to provider | Provider | Request logged in CRM, reply through portal |
| Says "stop texting me" | Treat as opt-out for SMS, confirm in writing via portal | Scheduler | Consent record updated with timestamp |
| Disputes consent | Stop the channel, route to privacy officer | Privacy officer | Incident logged with date and channel |
| No response after three attempts | Stop outreach, mark as closed for this cycle | Scheduler | Final attempt logged with outcome |
A reply is not proof of identity. A shared phone, a family member, or a wrong number can all generate a response that looks like the patient.
Some responses are not scheduling problems. They are privacy events, and they need a named owner.
The attempt log is only as good as the audit behind it. In programs we run, a weekly review of 10 to 20 logged attempts catches script drift before it becomes a pattern.
A clinical question sent by text is not a conversation. It is a handoff. The provider owns the answer, the scheduler owns the routing, and the privacy officer owns anything that looks like a disclosure.
Keep it to identity, a general invitation, and a callback number. Something like: "This is [Name] calling from [Clinic] about a prevention and education program we offer to all patients. Please call us back at [number]." Never name a test, result, medication, or diagnosis, and never reference PrEP, HIV, or STI status on a recording. In our experience the safest pattern is a general program invitation plus a callback number, with all clinical detail moved to a live conversation or the patient portal.
Yes, with the right consent and message design. Use separate consent checkboxes for customer-care versus promotional texts, include STOP/HELP language, disclose message and data rates, and keep the text itself free of clinical detail. A compliant text reads like: "Hi [Name], this is [Clinic]. We'd like to invite you to a prevention education visit. Reply YES to schedule or STOP to opt out." Anything specific to a test, result, or medication belongs in the portal, not an SMS.
Frame the invitation as a program offered to all patients, not as a response to a specific result. Build your eligible list from the EHR, but let the script stay neutral: "a women's health and prevention education program" or "a prevention program we offer to patients." No test or diagnosis names on phone, voicemail, or SMS. If the patient asks why they were contacted, the scheduler says the program is offered broadly and moves the conversation to the portal or a live visit.
Log the date and time, channel (call, voicemail, text, portal), the script version used, whether the patient was reached, and the outcome (booked, declined, no answer, wrong number). Patient outreach attempt tracking should live in your CRM, not a spreadsheet on a shared drive, so the next scheduler sees the full history. Pair it with a realistic floor such as 30 calls and 5 bookings per person per day, and review the log weekly to catch scripts that stop converting.
Sexual health outreach fails when scripts leak PHI, consent is assumed instead of recorded, and no one owns the follow-up. The Marketing Lab builds HIPAA-compliant patient journeys and outreach systems inside clinics, using VaultStream for the CRM, pipelines, and two-way messaging and GroundSwell for local outreach that fills the schedule. Book a free 30-minute strategy call at https://thelab.marketing/schedule and get outreach that protects patients and books visits.
Bring us your patient acquisition, 340B program, or compliance bottleneck. We will show you what a 30-day launch looks like for your clinic — in English or Spanish, month to month, no long contract.
