Why 'Not Covered by the TCPA' Is the Wrong Assumption to Start With

Most businesses don't get fined for malice — they get fined for assuming. The assumption usually sounds something like this: "They're my past customers, so the TCPA doesn't apply," or "It's just an appointment reminder, not marketing." Both are wrong often enough to be dangerous.

The math explains why guessing is expensive. TCPA violations run $500 to $1,500 per call or text, and multiple penalties can stack on a single call, according to industry compliance guidance. A reactivation campaign to a few thousand past customers isn't a rounding error if the consent foundation is wrong — it's a seven-figure exposure.

Three assumptions cause the most trouble:

• "They're an existing customer, so I'm exempt." The established business relationship (EBR) carve-out has been limited since 2012 — it can no longer substitute for prior express written consent on autodialed or prerecorded telemarketing calls, per the FDIC compliance manual.
• "Healthcare reminders don't count." Appointment reminders can qualify for exemption — but only under strict conditions, and marketing content voids the protection entirely, as healthcare compliance analysis makes clear.
• "Informational means exempt." The line between informational and promotional is thinner than most businesses think — courts have found calls that promote a product fall outside the healthcare exemption entirely.

Here's what makes this moment particularly risky: the exemptions aren't just narrow, they're shrinking. The TRACED Act directed the FCC to attach conditions to every exemption — who can call, who can be called, and call limits — and the FCC's 2021 Final Rule codified those limits into federal regulations. The FCC has even proposed letting residential consumers opt out of exempt calls altogether. And in 2020, the Supreme Court struck down the government-debt exemption entirely — proof that even long-standing carve-outs can disappear overnight.

The practical takeaway for any business running customer outreach — win-back campaigns, old-quote follow-ups, renewal reminders — is that exemption status is a legal conclusion, not a starting assumption. That's why CallMyCustomers builds every campaign on a foundation of proper consent capture and immediate opt-out handling, with every message reviewed before it goes out. The question isn't whether exemptions exist. They do. The question is whether your specific message, to your specific list, on your specific technology, fits inside one — and that's exactly what the rest of this article will help you determine.

The Full List of TCPA Exemptions (and the Conditions Attached)

Not every call or text falls under the TCPA's restrictions — the law carves out specific exemptions, but each one comes with conditions that trip up businesses who assume "exempt" means "unregulated." Understanding exactly which communications qualify, and under what limits, is the foundation of sound compliance planning.

Under Section 8 of the TRACED Act, the FCC enumerated nine exemption categories in its October 2020 proposed rule, later codified in the February 2021 Final Rule effective March 29, 2021. Critically, the rule requires each exemption to specify who can call, who can be called, and any call limits — exemptions are no longer blanket permissions.

The full exemption list includes:

• Emergency-purpose calls made necessary in situations affecting consumer health and safety
• Calls made with prior express consent (prior express written consent for telemarketing)
• Non-commercial calls to residential lines, and commercial calls to residential lines that do not constitute telemarketing
• Calls from tax-exempt nonprofit organizations
• HIPAA-related healthcare messages, package delivery calls, financial institution calls, healthcare provider calls to wireless numbers, inmate calling service calls, and carrier calls to their own subscribers

The healthcare exemption deserves special attention because it's the most misunderstood. Under 47 C.F.R. § 64.1200(a)(3)(v), prerecorded healthcare messages from HIPAA-covered entities to residential landlines are completely exempt — no consent required. For cell phones, a 2015 FCC Declaratory Ruling allows exempt healthcare messages under strict conditions: no more than one message per day and three combined messages per week, calls capped at one minute, and texts at 160 characters.

Here's the catch: marketing messages are never covered by the healthcare exemption, even when they relate to health products. In Sullivan v. All Web Leads, autodialed calls offering health insurance lost exemption protection because they promoted a product without an established treatment relationship. Courts have warned that marketing calls "masquerading as healthcare messages" fall outside the exemption entirely.

Two more boundaries matter for compliance planning. First, the Supreme Court struck down the government-debt-collection exemption in July 2020, so those calls are no longer exempt. Second, since 2012, an established business relationship cannot substitute for prior express written consent on autodialed or prerecorded telemarketing calls — even though the EBR window runs 18 months after a purchase.

The trend is unmistakable: exemptions are narrowing, not expanding. The FCC has proposed letting residential consumers opt out of exempt calls, and new call-limit and opt-out rules took effect July 20, 2023. With penalties of $500 to $1,500 per violation, businesses running promotional outreach — win-backs, old-quote follow-ups, seasonal offers — should treat those campaigns as fully TCPA-covered. That's why CallMyCustomers builds explicit consent capture into its booking flow and honors opt-outs immediately, keeping reactivation campaigns on the right side of every exemption boundary.

The Healthcare Exemption: The Most Useful and Most Misunderstood

For dental practices, med spas, and clinics, the HIPAA-related healthcare exemption is the most valuable carve-out in the entire TCPA — and the easiest one to misuse. A 2015 FCC Declaratory Ruling allows autodialed or prerecorded calls and texts to cell phones conveying HIPAA-covered healthcare messages without prior express consent, but only under strict conditions.

The exemption covers appointment reminders, lab results, prescription notifications, and similar treatment-related communications. To qualify, the message must satisfy a three-factor legal test: it must concern a product or service that is inarguably health-related, be sent to a patient with an established healthcare treatment relationship, and address that individual's specific healthcare needs.

The limits are equally strict, and they are enforceable numbers, not guidelines:

• Voice calls must be one minute or less; texts must be 160 characters or fewer
• Maximum one message per day and three combined messages per week, per provider
• The message must contain no promotional or financial content
• The sender must be a HIPAA-covered entity or business associate

Case law shows how narrow the boundary really is. In Zani v. Rite Aid (2d Cir. 2018), flu shot reminder calls qualified as exempt healthcare messages even with some marketing flavor, and Bailey v. CVS Pharmacy (D.N.J. 2018) similarly found texts about prescription readiness plus flu shot availability exempt. But Sullivan v. All Web Leads (N.D. Ill. 2017) went the other way: autodialed calls offering health insurance were not healthcare messages because they promoted a product and lacked an established treatment relationship.

The Second Circuit's warning deserves emphasis — calls "masquerading as healthcare messages" lose the exemption when laden with promotional material. As industry compliance analysis makes clear, the two most dangerous misconceptions are that healthcare messages are always exempt and that contacting patients for important health reasons puts you outside the TCPA entirely. Neither is true.

The practical takeaway for clinics is simple: keep informational and promotional messaging strictly separated. A reminder text that adds "ask about our whitening special" can convert an exempt message into a TCPA violation, with penalties running $500 to $1,500 per violation. That is why a service like CallMyCustomers keeps promotional reactivation campaigns consent-based and separate from treatment communications, with every message approved before it goes out.

What Is NOT Exempt: Marketing Messages, EBR Reliance, and Government Debt Calls

If your outreach falls into one of these categories, the TCPA's exemptions won't save you — and assuming otherwise is how businesses rack up five-figure fines. Violations run $500–$1,500 per call or text, with multiple penalties possible per violation, so a single misclassified campaign can get expensive fast (Providertech).

Marketing messages never qualify for the healthcare exemption. Even for dental practices, med spas, and clinics, promotional content requires prior express written consent — no matter how health-related the offer may be (mPulse). Case law draws the line sharply: in Sullivan v. All Web Leads, autodialed calls offering health insurance were ruled non-exempt because they promoted a product without an established treatment relationship (Bass, Berry & Sims). The Second Circuit has likewise warned that promotional calls "masquerading as healthcare messages" fall outside the exemption.

The established business relationship carve-out is not a consent loophole. While an EBR once excluded calls from the "telephone solicitation" definition, since 2012 telemarketers can no longer rely on it to avoid consent requirements for autodialed or prerecorded telemarketing — prior express written consent is required (FDIC). In other words, "they bought from us before" does not equal "we can robocall them now."

Government debt collection is no longer exempt either. The 2015 exception for calls collecting debt owed to or guaranteed by the U.S. government was struck down as unconstitutional by the Supreme Court in July 2020 — those calls are fully TCPA-covered again (FDIC).

For service businesses, the practical takeaway hits closest to home with reactivation outreach. Win-back campaigns, old-quote and estimate follow-ups, and past-quote price-match offers are all promotional messages, fully TCPA-covered — a lapsed customer or an unsigned estimate doesn't create an exemption. That's why consent capture at the booking flow and immediate opt-out handling are built into how campaigns like these should be run, and why the owner approves every script and offer before anything goes out.

The broader trend points one direction: exemptions are narrowing, not expanding. The TRACED Act directed the FCC to add conditions to exempted calls — who can call, who can be called, and call limits — and the FCC's 2021 Final Rule codified those limits, with new opt-out requirements taking effect July 20, 2023 (Federal Register). The FCC has even proposed letting residential consumers opt out of calls made under an exemption (Federal Register).

The safe planning assumption: treat every marketing communication as TCPA-covered and get proper consent up front.

Compliance Planning That Assumes Exemptions Will Keep Narrowing

The safest compliance plans don't ask "what's exempt today?" — they assume the exemptions list will keep shrinking, and build outreach that would survive even if every carve-out disappeared. That's not pessimism; it's the direction regulators have been moving for a decade.

The trajectory is clear. The 2015 healthcare exemption came with tight conditions — calls under one minute, texts under 160 characters, no more than one message per day and three per week. The FCC's 2021 Final Rule added call limits and opt-out requirements to previously exempt categories, and the FCC has proposed letting residential consumers opt out of exempt calls entirely. Meanwhile, the Supreme Court struck down the government-debt exemption in 2020, and the 2024 unlawful-text rules extended National Do-Not-Call protections to text messages and required consent one seller at a time.

Practical planning follows four habits:

• Capture explicit consent in the booking flow, before any outreach begins — not retroactively.
• Honor opt-outs immediately; the new exempt-call rules treat opt-out handling as a condition of the exemption itself.
• Keep informational messages strictly separate from promotional ones — as federal case law shows, a reminder that drifts into marketing loses its exemption entirely.
• Never rely on an "established business relationship" to justify telemarketing calls — the FDIC notes that since 2012, EBR cannot substitute for written consent.

The stakes justify the caution. TCPA violations run $500 to $1,500 per call, with multiple penalties possible on a single call, and TRACED Act robocall fines reach $10,000 even without criminal intent. A reactivation campaign to a few thousand past customers multiplies that exposure fast.

This is why the operational model behind every CallMyCustomers campaign matters: the owner approves every script, offer, and message before anything goes out. When a real person signs off on each message before it's sent — and opt-outs are honored the moment they arrive — the campaign stays inside the consent framework no matter how the exemption lines shift. Treat every outreach as covered, and the narrowing landscape becomes background noise instead of a liability.