What this automation does
Reminders alone are a solved problem. The gap is what happens after the patient replies. This workflow closes that gap and turns cancellations into refilled slots instead of empty chairs.
- Sync the schedule. Appointments, visit types and providers come from the EHR or scheduling system every few minutes, along with any changes and cancellations.
- Check consent first. Before any text goes out, the workflow checks the patient’s SMS consent flag and opt-out status in a consent table. No consent means email or a staff call, according to your policy.
- Send on a cadence. Typical cadence is a few days before and the day before, adjusted by visit type. Procedure visits can add an earlier prep reminder that links to the patient portal.
- Read the reply. A fixed rule catches STOP and similar opt-out words before anything else. Every other reply goes to a small, fast model that classifies intent as confirm, cancel, reschedule, question, opt-out request in plain words, or unclear.
- Act on it. Confirmations update the appointment status. Cancellations free the slot. Reschedule requests get two or three open times from the scheduling API. Questions and unclear replies land in the staff message queue with the conversation attached.
- Refill the slot. When a slot opens inside a short window, patients on the waitlist for that provider and visit type get a text, and the first to accept is booked.
- Extra touch for higher-risk visits. A simple, explainable rule (recent no-shows, long time since booking, new patient) marks appointments for a staff call or a voice reminder on top of the text.
When it is worth building
Build this when the front desk spends real hours each week on confirmation calls, when patients reply to reminder texts with sentences your system cannot parse, or when same-day cancellations leave slots empty while a waitlist sits in a spreadsheet.
Skip it if you are a single-provider practice whose built-in EHR reminders already work, or if an off-the-shelf patient messaging product covers two-way replies and waitlists for your EHR. The custom route makes sense for multiple locations, multiple systems, or when you want waitlist and risk rules your vendor does not support.
TCPA consent and HIPAA in practice
Two sets of rules shape every design choice here.
TCPA. Automated texts to mobile numbers generally need the patient’s consent, and marketing texts need a stricter form of consent than reminders. The FCC’s 2015 TCPA ruling exempts some healthcare messages from HIPAA covered entities, such as appointment reminders, but only under conditions: free to the patient, short, sent to the number the patient gave, no more than one a day and three a week, and an easy opt-out. Many practices capture consent anyway rather than rely on the exemption. Keep reminders purely transactional, with no promotions mixed in. Record the consent source and timestamp, accept opt-outs in any reasonable form (“please stop texting me” counts, not only STOP), and stop sending promptly. Send during daytime hours in the patient’s time zone. Business texting in the US also requires A2P 10DLC registration through your messaging provider, and unregistered traffic gets filtered by carriers.
HIPAA. Reminders are a normal part of treatment communication, but the message vendor still handles PHI, so it needs a BAA, as do the host and model provider. Apply minimum necessary to message content: name, date, time, location and a reply instruction. The AI that reads replies receives the reply text and appointment ID, not the chart.
Architecture
| Layer | What we use | Why |
|---|---|---|
| Schedule source | EHR or scheduling API (DrChrono, Acuity), or partner-approved access for Epic and athenahealth | Reminders must reflect the live schedule, including late changes |
| Messaging | Twilio Programmable Messaging on an account covered by a BAA, registered for A2P 10DLC | Reliable two-way SMS with delivery receipts |
| Consent store | A Postgres table of consent, source, timestamp and opt-outs | Consent must be checked before every send and survive system changes |
| Reply understanding | Claude Haiku 5.5 through a BAA-covered API, with a fixed intent schema | Fast and inexpensive for short replies |
| Orchestration | Self-hosted n8n on HIPAA-eligible cloud | Built-in Twilio and Postgres nodes, and PHI stays in your environment |
| Staff handoff | The practice’s existing patient message queue | Staff already work there, so nothing gets missed in a new tool |
How to build it
- Pull the schedule and define visit types. Decide cadence and message wording per type, and which types are excluded (for example, telehealth visits with their own link flow).
- Audit consent. Find where consent is captured today. Add clear SMS consent language to intake, and backfill the consent table from existing records where your counsel agrees it applies.
- Register and sign. Complete A2P 10DLC brand and campaign registration and sign the BAA with the messaging vendor before real messages go out.
- Write templates with staff. Short, plain, no clinical details, and a neutral sender name for sensitive specialties.
- Build the reply handler. Opt-out rule first, then intent classification with a confidence field. Anything low-confidence or clinical-sounding goes to staff, and phrases on a clinician-written urgent list trigger a fixed “call 911 or the office” reply plus an alert.
- Connect rescheduling. Offer open slots from the scheduling API and book the chosen one. Where write-back is not available yet, hold the request for staff to confirm.
- Add the waitlist. A simple table of patient, provider, visit type and earliest acceptable date, with first-to-accept booking.
- Pilot one provider for two weeks, then roll out by location.
The downloadable starter template below covers steps 5 and 6 using Twilio, Postgres and a generic scheduling webhook.
What breaks in production
- Replies to old messages. A patient answers last week’s reminder after rescheduling. Tie each reply to the patient’s next upcoming appointment, and ask when it is ambiguous.
- Shared family phones. One parent’s phone has three children’s appointments. “C” could mean any of them, so list them and ask which.
- Landlines in the mobile field. Texts fail silently. Use delivery receipts to fall back to a call.
- Sync lag. A reminder goes out for an appointment cancelled minutes earlier. Re-check status right before each send.
- Carrier filtering. Shortened links and inconsistent wording get filtered. Use your own domain and the templates you registered.
- Clinical questions by text. “Is it normal that my incision is red?” is not a scheduling question. The AI never answers it, and it goes to clinical staff.
Timeline and cost
Most practices go live in two to four weeks. Lumeor builds this in the range of $4,000 to $12,000. The low end is one scheduling system with confirm and cancel handling. The high end adds rescheduling write-back, waitlist fill, several locations and voice calls for higher-risk visits. Running costs are mainly per-message SMS fees and phone number fees from your messaging provider (check current pricing), plus a small amount of model usage per reply. For the voice side, our AI calling platform project used Twilio with LLM-driven assistants, and the Twilio tool page covers its limits. Pair this with patient intake automation, which is the natural place to capture SMS consent.
How to measure success
- No-show rate by visit type and provider, before and after
- Share of appointments confirmed by text
- Cancelled slots refilled from the waitlist
- Staff hours spent on confirmation calls
- Opt-out rate per reminder sent, which tells you if cadence is too heavy
- Replies routed to staff, and how many of those the AI could have handled