Consent in telehealth intake flows: treatment vs marketing consent

A telehealth intake usually needs several separate consents, not one checkbox. Consent to treatment by telehealth, an acknowledgment of your privacy notice, permission to use health information for marketing, consent to ad tracking and consent to marketing texts each answer a different legal question, and each belongs at a different point in the flow.

The rule that ties them together: the yes a patient needs to give to get care must never be bundled with the yes you would like for marketing. Keep them on separate controls, word each in plain language, and store each one with a timestamp next to the intake it belongs to.

This is a practical guide for operators, not legal advice. Your clinical and legal team decides the wording and which consents your brand needs.

What is consent in a telehealth intake?

Consent in an intake is any point where the patient agrees to something before the flow continues: being treated over video or asynchronously, receiving your privacy notice, being contacted, being tracked. Some consents are required for care. Others are optional and only serve your marketing.

If you are new to how HIPAA applies to an intake at all, start with our HIPAA intake playbook and come back here.

The six kinds of consent

Consent	What it answers	Required for care?	Main source of the rule
Telehealth consent	Does the patient agree to be seen by telehealth, with its limits?	Usually, depending on the state	State law, board rules, Medicaid policy
Treatment consent	Does the patient agree to the specific treatment or program?	Yes, set by your clinicians	Clinical practice and state law
Privacy notice acknowledgment	Did the patient receive your notice of privacy practices?	You must try to get it; care is not refused without it	HIPAA Privacy Rule, 45 CFR 164.520
Marketing authorization	May you use their health information to market to them?	No	HIPAA Privacy Rule, 45 CFR 164.508
Ad-tracking consent	May you send conversion data about them to ad platforms?	No	Your privacy policy, FTC, platform terms
SMS marketing consent	May you send them automated marketing texts?	No	FCC TCPA rules, 47 CFR 64.1200

Telehealth consent

Many states require the provider to tell the patient that care will be delivered by telehealth and to get their consent. The rules are not uniform. The Center for Connected Health Policy, a neutral telehealth policy resource, tracks them state by state and says on its consent requirements page that “the majority of states include some sort of telehealth specific informed consent requirement,” which can sit in statute, administrative code or Medicaid policy.

For a brand that treats patients in many states, that means the telehealth consent text may need to work for the strictest state you serve, or vary by the state the patient enters. Your counsel decides which.

Treatment consent

This is consent to the actual program: a medication, a protocol, a subscription that ships refills. What it must say is a clinical decision. The flow’s job is to show the text your clinicians approved, make the patient act on it, and record that they did.

Privacy notice acknowledgment

If you are a covered health care provider with a direct treatment relationship, the HIPAA Privacy Rule asks you to hand over your notice of privacy practices and, “except in an emergency treatment situation, make a good faith effort to obtain a written acknowledgment of receipt” (45 CFR 164.520). If you do not get it, you document your good faith efforts and why.

For telehealth the timing is specific. When the first service is delivered electronically, the rule says the provider “must provide electronic notice automatically and contemporaneously in response to the individual’s first request for service.” In an online intake, the first request for service is the intake itself, so the notice belongs inside the flow, not in a welcome email afterwards.

Note what the rule asks for: an acknowledgment of receipt, not agreement. “I have received the Notice of Privacy Practices” is the honest wording. “I agree to the privacy policy” is a different statement.

Marketing authorization under HIPAA

This is the one teams most often get wrong. The Privacy Rule says a covered entity “must obtain an authorization for any use or disclosure of protected health information for marketing,” with two narrow exceptions: a face-to-face communication and a promotional gift of nominal value (45 CFR 164.508(a)(3)). If a third party pays you for the marketing, the authorization must say so.

Marketing has a defined meaning: a communication about a product or service that encourages the recipient to purchase or use it (45 CFR 164.501). The definition excludes some communications, such as refill reminders about a drug currently prescribed to the patient and communications for their own treatment, as long as you are not paid by a third party to make them. A reminder that the patient’s next refill is due is not marketing. An email to an ED patient promoting your new hair loss program probably is, if it is built from their health information.

An authorization is also a formal document. Its core elements include a description of each purpose, an expiration date or event, and the individual’s signature and date. A pre-ticked “keep me updated” checkbox is not one.

Ad-tracking consent

Sending conversion events to Meta, Google, TikTok or Microsoft is a disclosure, and in a health flow the fact of the conversion can itself be sensitive. The FTC’s case against BetterHelp is the reference point: the FTC said BetterHelp “promised consumers that it would not use or disclose their personal health data except for limited purposes,” and the order requires it to “obtain affirmative express consent before disclosing personal information to certain third parties for any purpose.” BetterHelp agreed to pay $7.8 million (FTC press release).

Whether or not HIPAA applies to you, the lesson is the same: ad tracking needs its own, affirmative yes, and your flow must respect a no. We cover what pixels send in are Meta and Google pixels HIPAA compliant?.

SMS marketing consent

The FCC’s TCPA rules prohibit telemarketing or advertising calls made with an autodialer or a prerecorded voice to a mobile number without the called party’s “prior express written consent” (47 CFR 64.1200). The rule defines that consent as a written agreement bearing the person’s signature (an electronic signature can count) with a clear and conspicuous disclosure, and it says the person must not be required to sign “as a condition of purchasing any property, goods, or services.”

That last point decides the design. A text consent cannot be required to finish intake or check out. The FCC has also adopted further rules on revoking consent, and the 2024 edition of the regulation notes that some of those amendments were delayed. Ask your counsel how the current rules apply to the texts you plan to send, including transactional ones like shipping updates.

Where each consent goes

Order matters for two reasons: the patient should see each consent when it makes sense to them, and nothing should leave your systems before the consent that covers it.

1. Before any tracking fires: ad-tracking consent. If you plan to send conversions to ad platforms, ask before the first event you would send. A short banner or the first screen works. Until the patient says yes, send nothing about them.
2. At the start of intake: privacy notice. Show the notice, or a link that opens it in the flow, and collect the acknowledgment as the patient begins their request for service.
3. Before clinical questions: telehealth consent. Put it before the medical history so the patient knows how they will be seen before they share it.
4. After eligibility, before checkout: treatment consent. The patient now knows which program they qualify for, so the consent can name it. This is where your clinicians’ text goes.
5. At contact capture or after checkout: optional marketing. The HIPAA marketing authorization and SMS marketing consent are optional by definition. Place them where the patient can say no without losing anything, often on the contact step (unticked) or the confirmation screen.

Two placement mistakes to avoid. Do not put marketing checkboxes inside the treatment consent screen, where they read as part of what is required. And do not hide the telehealth or treatment consent behind a link on the checkout button (“By clicking Pay you agree to…”). For a required consent, an explicit action on its own control is easier to defend.

Wording principles

These are drafting habits, not legal text. Your legal team writes the words.

• One consent, one control. Each consent gets its own checkbox or button, so the record shows exactly what was agreed.
• Say what happens. “We will send your email address, hashed, to Meta and Google to measure our ads” is clearer than “I agree to marketing cookies.”
• Required and optional look different. Mark optional consents as optional. Never pre-tick them.
• Name the program in treatment consent. “I consent to treatment in the weight management program” beats a generic “I consent to treatment.”
• Show the full text at the moment of consent. Linking to a page that may change later makes it hard to prove what the patient saw.

Recording and timestamping

A consent you cannot prove is close to a consent you never got. For each consent, store:

Field	Why
Which consent (an id, not just a label)	So reports and integrations can tell them apart
The answer (yes or no)	A no is also a record
Timestamp, in UTC	When it was given
Version of the text shown	So you know what the patient actually read
The intake or submission it belongs to	So it travels with the record your clinicians review
Withdrawal, if any, with its own timestamp	Optional consents can be taken back

Keep the version history of the consent text itself.

How to do it in PathwAI

In PathwAI, consent is a first-class step on the visual builder canvas: patients must acknowledge before continuing, and the consent is timestamped and stored with the intake data. A concrete setup for a telehealth program looks like this:

1. Draft the flow. Describe the program in plain English and the AI agent generates a draft with eligibility, intake, consent and checkout steps, copy and routing. It is a draft: consent wording must be reviewed by your clinical or legal team, and nothing publishes without your explicit approval. No patient data or PHI is used in generation prompts.
2. Place the consent steps. Put the privacy notice acknowledgment and telehealth consent before the medical history, and the treatment consent after the eligibility routing, so the eligible path reaches it and an ineligible patient gets a custom message, a waitlist or another treatment path instead.
3. Paste the approved text. Replace the draft wording with your legal team’s text, then share a preview link for their sign-off before publishing.
4. Gate tracking on consent. With the Data Platform, conversions go server-side to Meta, Google Ads, TikTok and Microsoft Ads only for visitors who consented. Identifiers such as email and phone are SHA-256 hashed and PHI such as date of birth and condition is stripped before any event leaves. There are no third-party ad pixels, only first-party cookies.
5. Watch the consent step. Step-level analytics show completion and drop-off on every screen, so you can see if a consent step loses people and test clearer wording against a control.

PathwAI signs a BAA on the Enterprise plan. Details on safeguards are on our HIPAA page.

Checklist

• Legal has listed which of the six consents your brand needs, by state if required.
• Ad-tracking consent is asked before any event leaves, and a no sends nothing.
• The privacy notice is delivered inside the intake, with an acknowledgment of receipt.
• Telehealth consent comes before the medical history.
• Treatment consent names the program and comes after eligibility.
• Marketing authorization and SMS consent are optional, unticked and on their own controls.
• No optional consent is a condition of checkout.
• Each consent is stored with its answer, UTC timestamp, text version and submission.
• Consent text changes are versioned, and old submissions keep their version.

Frequently asked questions

Can one checkbox cover treatment, privacy and marketing?

It is a poor design. Treatment consent is required for care, the privacy notice needs an acknowledgment of receipt, and marketing uses need their own permission. Bundling them makes it unclear what the patient agreed to and makes the optional parts look required.

Is a refill reminder marketing under HIPAA?

The Privacy Rule’s definition of marketing excludes refill reminders about a drug currently prescribed to the patient, as long as any payment you receive for sending them is reasonably related to your cost. Promoting a different product built from their health information is another matter. Ask counsel about your specific messages.

Do telehealth consent rules differ by state?

Yes. The Center for Connected Health Policy says the majority of states have some telehealth-specific informed consent requirement. Your legal team decides whether one text covers every state you serve or whether it varies by the patient’s state.

Does PathwAI write our consent text?

The AI agent drafts a flow, including placeholder consent copy, but that copy is a starting point. Consent wording must be reviewed and approved by your clinical or legal team before you publish.