A2P 10DLC and the legal mess of patient SMS in 2026

If your practice is sending appointment reminders, follow-up questions, or review-outreach SMS to patients in 2026, A2P 10DLCis the regulatory frame that governs how those messages reach the phone. Most healthcare practices have never heard the term. Most healthcare vendors are quietly hoping you never ask. Here's what it actually means.

What A2P 10DLC is

A2P stands for application-to-person — automated messages sent from a business application to a consumer. 10DLC stands for 10-digit long code— the standard local phone number format (vs short codes like “33444”).

In 2021, the major U.S. carriers (AT&T, Verizon, T-Mobile) rolled out a registration requirement for any business sending automated SMS through standard 10-digit phone numbers. The framework is governed by the Campaign Registry (a carrier-funded entity that operates as the system of record) and enforced at the carrier level.

The requirement: each business must register its brand and each individual campaign (use case) before sending A2P messages. Unregistered or improperly registered traffic gets throttled, surcharged, or outright blocked.

Why it matters for healthcare practices

For healthcare, three real consequences:

1. Deliverability. Unregistered A2P traffic routinely sees 60–90% blocked or filteredby carriers in 2025–2026. A practice that thinks it's sending appointment reminders may be reaching less than half of patients.
2. Cost. Unregistered traffic is surcharged heavily — often $0.005–$0.04 per message on top of normal rates. At even modest volumes that adds up fast.
3. Regulatory exposure. Beyond carrier rules, healthcare SMS is also governed by the Telephone Consumer Protection Act (TCPA) and the HIPAA Privacy Rule. TCPA requires prior express written consent for non-emergency healthcare SMS. Violations are commonly settled at $500–$1,500 per message.

What registration actually requires

To register a healthcare-related A2P 10DLC campaign you need:

• Brand registration. Your business EIN, legal name, address, contact info, plus a vetting score paid for via the Campaign Registry.
• Campaign registration. Each use case (appointment reminders, review outreach, billing, etc.) is a separate campaign with its own approved message templates, opt-in language, and opt-out flow.
• Sample messages reviewed for compliance with CTIA Messaging Principles. Healthcare campaigns face additional scrutiny — anything that mentions specific conditions, medications, or treatments triggers review.
• Opt-in proof. Carriers can audit. You should be able to show when and how each recipient consented to receive the type of message you sent them.

The healthcare-specific challenges

Healthcare faces a few unique 10DLC complications:

• Mention of medications, procedures, or conditions in templates triggers higher scrutiny. Carriers route these through manual review and frequently reject them.
• Practice rebrands and multi-location ops. Each legal entity needs its own brand registration. Common mistakes include one parent organization trying to message from multiple clinic brands under a single campaign.
• Sender number warm-up. Even registered numbers benefit from a deliberate ramp from 0 → 200/day over a few weeks. Cold-launching a 1,000-message/day campaign on a new number invites filtering.
• HIPAA-shaped templates.“Reminder for your dermatology appointment” is fine. “Reminder for your Mohs surgery” is a disclosure. Templates need pre-review.

What we'd look for in a vendor

If you're evaluating a vendor who sends SMS to your patients on your behalf, ask them directly:

• Are you A2P 10DLC registered for the campaign type we'd run?
• What's your sample-message library, and have those samples been approved?
• What's your opt-in record-keeping process?
• What's your average deliverability rate by carrier (AT&T, Verizon, T-Mobile)?
• What happens when a patient texts STOP — how fast does that opt-out propagate across SMS, email, and call?

If they can't answer cleanly, your messages are going to spam folders or getting blocked. That's a problem you inherit, not one they own.

The short answer for practices

A2P 10DLC is a regulatory floor, not a ceiling. Done right, it gets you 95%+ deliverability on patient SMS at standard carrier rates. Done wrong — or skipped — your messages don't arrive and your team thinks the patients are ignoring them. Insist on a vendor that has done the registration work and can prove it.