Medication Adherence Check-Ins

A prescription is written and the practice's involvement ends at the printer. What happens next is invisible: whether the patient filled it, whether they started it, whether they stopped three days in because of a side effect nobody asked about, whether they refilled on time, whether they finished the course at all. The practice finds out at the next visit, if there is a next visit, and usually finds out indirectly. The condition has not improved, so the dose gets changed, or a second agent gets added, on the assumption the first one was taken.

That assumption is where the harm and the cost both live. A course abandoned in week one looks clinically identical to a course that did not work, and the response to the two is completely different. Patients who stop because of a tolerable, manageable side effect are the most frustrating group of all, because a single conversation in the first week would usually have kept them on it, and nobody had that conversation because nobody knew to. Meanwhile the refill gap goes unnoticed until it is a month old, the next visit becomes a reset rather than a step forward, and the practice absorbs the extra visits without a code to bill them under.

The gap is not clinical judgment, it is cadence. Someone needs to ask three simple questions at predictable moments and route the answers to the right person. Doing that by hand means a staff member with a spreadsheet and a good memory, which works until they are on leave. This build turns the cadence into a system: enrollment at prescribe-time, scheduled check-ins tuned to where the patient is in the course, a refill-gap watch running underneath, and an escalation ladder that moves a concerning answer from an automated message to a named clinician with a clock on it.

Pipeline and stages

One pipeline, Adherence Program, one card per course so a patient on two monitored courses has two independent cards and two cadences.

• Enrolled: prescribed and enrolled, course not confirmed started.
• Course Started: the patient has confirmed first dose taken.
• Early Course: the first fourteen days, where the dense cadence runs and most abandonment happens.
• Steady Course: the long middle, on a lighter cadence.
• Refill Window: entered when refill_due_date is inside seven days.
• Escalated: Clinical: a holding stage while a clinician works a concern; automated messaging is suspended.
• Course Complete: terminal success.
• Discontinued: terminal, with a recorded reason.
• Lost to Follow-Up: terminal, after the unreachable ladder exhausts.

Cards never sit in an undefined state. A card in Escalated: Clinical always has a named owner and a due time.

Calendars

• Nurse Check-In Call: 15 minutes, round robin across nursing staff, the default landing place for a level-two escalation.
• Pharmacist Consult: 20 minutes, used for tolerability, timing, interactions and administration questions.
• Provider Follow-Up: 15 minutes, provider-specific, for anything that may change the plan.
• Adherence Review Block: a recurring internal block, 20 minutes daily, that the escalation queue and the overdue-check-in list feed into.

Custom fields

No field holds a readable medication name, dose or indication where it could be merged into an outbound message. The medication is identified internally by code, and the code is never sent.

• program_code: internal course identifier used in all messaging instead of clinical detail.
• program_type_code: short internal code standing in for the therapy class. Not a readable drug name.
• prescribing_provider
• course_start_date, course_length_days, program_end_date
• check_in_cadence: Dense, Standard or Light; set at enrollment and adjustable.
• last_check_in_sent, last_check_in_response_date, last_check_in_answer
• adherence_self_report: taking as directed, missed some doses, stopped taking, not started.
• missed_check_in_count
• tolerability_flag: none reported, mild, troubling. Set from the patient's own selection, never inferred.
• escalation_level: none, L1, L2, L3. escalation_owner, escalation_opened_at, escalation_closed_at
• refill_due_date, refill_confirmed_date, refill_gap_days
• pharmacy_on_file, pharmacy_contact_method
• patient_consent_sms, patient_consent_email, consent_captured_at, consent_language_version, consent_source
• preferred_channel, preferred_language, portal_activated, timezone
• discontinuation_reason: picklist: course finished, clinician stopped it, tolerability, cost or access, patient choice, unreachable, other.

Tags

• adherence-active, adherence-complete, adherence-discontinued
• cadence-dense, cadence-standard, cadence-light
• checkin-missed-1, checkin-missed-2, checkin-missed-3
• escalation-l1, escalation-l2, escalation-l3, escalation-open
• refill-window-open, refill-overdue-7, refill-overdue-14
• self-report-missed-doses, self-report-stopped, tolerability-reported
• patient-unreachable, portal-active
• consent-sms-yes, consent-sms-revoked, consent-email-yes, consent-email-revoked

Tag names are deliberately dull. tolerability-reported tells staff to look; it does not announce what was reported. Tags show up in exports, previews and on screens visible from a corridor, so none of them names a drug, a condition or a symptom.

Forms

• Adherence Program Enrollment: internal, completed at prescribe-time. Sets program_code, cadence, course length, refill date, pharmacy and whether consent is already on file. Creates the card.
• Check-In Response: patient-facing, portal-gated, three questions and nothing else: are you taking it as directed, have you had anything that is bothering you, do you want someone to call you. Answers are selections, not free text, so the routing is deterministic.
• Tolerability Report: patient-facing, portal-gated, opened from the check-in. Collects what the patient wants to report in their own words and routes straight to a clinician. It is a reporting channel, not a triage channel, and it says so on the form.
• Refill Confirmation: one question: have you picked up your next supply.
• Discontinuation Record: internal, captures discontinuation_reason and whether a clinician authorized stopping.
• Communication Consent: patient-facing, per-channel, versioned.

BO's role and guardrails

BO runs the cadence conversation and hands anything clinical to a person.

• BO may: confirm a check-in is due, send the portal link, record the three structured check-in answers if the patient replies in chat, reschedule a check-in, book a Nurse Check-In Call or Pharmacist Consult, confirm a refill was collected, update preferred_channel, and process opt-outs.
• BO may not: name the medication, state the dose, the schedule or the indication; advise on what to do about a missed dose; advise on whether a symptom is expected; suggest stopping, pausing, doubling or splitting anything; comment on interactions; discuss cost or coverage; or reassure a patient about a symptom.
• Guardrails: any inbound message containing symptom description, distress, or any word on the urgent-language list triggers an immediate human handoff, suspends BO in that thread, and opens an escalation at the configured level. Every automated outbound message carries a standing line pointing to the local emergency number for anything urgent, because a check-in cadence must never be mistaken for a triage line. BO's replies never contain clinical content in an SMS body or an email subject line.

Numbers and channels

• A dedicated care coordination number, separate from marketing, registered as transactional traffic, with two-way replies monitored during clinic hours and an explicit out-of-hours auto-response that names the nurse line and the emergency number.
• Patient portal as the only place a question, an answer or a clinical word appears. SMS and email are doorbells.
• Voice fallback: an outbound call task, placed by a person, for patients with no consented digital channel or no portal. Roughly a fifth of most patient panels live here and the build has to work for them.
• Nurse line: the published number that every escalation message points to, staffed during defined hours with a defined out-of-hours path.

1. A provider prescribes a course that warrants monitoring. Clinical staff complete Adherence Program Enrollment, which creates a card in Enrolled with program_code, course_length_days, refill_due_date, the cadence and the pharmacy.
2. If consent is not on file, the consent workflow runs first. The patient completes Communication Consent at the desk or by portal link. Without consent on a channel, the card is flagged for the voice fallback and no messages are sent on that channel.
3. On course_start_date, a start confirmation goes out: a neutral doorbell asking the patient to confirm in the portal that they have picked it up and started. The card moves to Course Started on confirmation.
4. If there is no start confirmation within 72 hours, the not-started branch runs: two further prompts, then a pharmacy check task, then a coordinator call. A course never silently fails to begin.
5. The card enters Early Course. On a dense cadence the check-ins land on day 3, day 7 and day 14. Each one is the same three-question Check-In Response form behind a portal link.
6. The patient answers. adherence_self_report, tolerability_flag and the call-request answer are written to the card, and the routing branches on them: taking as directed with nothing to report means the cadence simply continues.
7. Missed doses, stopped taking, anything bothering the patient, or a request for a call all route out of the cadence and into the escalation ladder at the level the practice has mapped for that answer.
8. A level-one escalation creates a coordinator task due within four business hours. A level-two books or offers a Nurse Check-In Call or Pharmacist Consult the same day and notifies the nurse queue. A level-three notifies the prescribing provider directly, suspends all automated messaging on that card, and moves it to Escalated: Clinical.
9. A missed check-in has its own ladder: a resend at 48 hours, a second-channel attempt at 96 hours, then a coordinator call task, then patient-unreachable and a notification to the prescriber. Silence is treated as a signal, not as consent.
10. At day 15 the card moves to Steady Course and the cadence drops to the lighter interval the practice has set for that program type.
11. Seven days before refill_due_date the card moves to Refill Window and the refill prompt runs. Confirmation sets refill_confirmed_date and returns the card to Steady Course with a new refill_due_date.
12. No confirmation by the due date opens the gap watch: refill_gap_days starts counting, refill-overdue-7 and then refill-overdue-14 are applied, a pharmacy verification task is created, and at fourteen days the prescriber is notified. A refill gap is treated as the strongest available adherence signal.
13. Any escalation closes with a clinician recording an outcome: continue unchanged, continue with a change, pause, or stop. The card returns to its cadence, or moves to Discontinued with a reason.
14. At program_end_date a completion check-in runs, the outcome is captured, the card moves to Course Complete, adherence-active is swapped for adherence-complete, and (if the clinical plan calls for it) a follow-up visit or a new enrollment is created rather than the patient simply dropping off the cadence.

1. Enrollment, Consent Gate and Start Confirmation

Trigger: Adherence Program Enrollment submitted.

Actions in order:

1. Create the card in Adherence Program at Enrolled. Write program_code, program_type_code, course_start_date, course_length_days, refill_due_date, check_in_cadence, prescribing_provider, pharmacy_on_file. Apply adherence-active and the matching cadence tag.
2. Compute program_end_date from start plus course_length_days.
3. Consent gate. If no channel has consent recorded as yes, call workflow 8, set preferred_channel to phone, create a coordinator task to arrange the voice fallback, and stop here. No messages are sent on an unconsented channel, ever.
4. Wait until course_start_date, then send the start prompt on preferred_channel. SMS: “Hi {{contact.first_name}}, it's {{practice_name}}. There's a quick one-minute check waiting in your secure portal: {{portal_link}}. For anything urgent call {{nurse_line}} or your local emergency number. Reply STOP to stop texts.”
5. Wait 24 hours. If not confirmed, resend once on the same channel with a shorter nudge.
6. Wait 48 hours. If still not confirmed, set adherence_self_report to not started, create a task to verify with pharmacy_on_file whether it was ever collected, and open an L1 escalation.
7. Wait 48 hours. If still nothing, notify prescribing_provider: a prescribed course has no evidence of ever having been started. This is the single highest-yield alert in the build.
8. On confirmation: set the real start date if the patient reports a different one, move to Course Started then Early Course, call workflow 2.

Exit: course confirmed started, or card moved to Discontinued with reason unreachable or patient choice.

2. Early Course Check-In Cadence

Trigger: stage becomes Early Course.

Conditions: consented channel only; held to quiet hours in timezone; suppressed entirely while escalation-open is present.

Actions in order:

1. Wait 3 days from course_start_date. Send check-in one. SMS: “Hi {{contact.first_name}}, your day-3 check-in from {{practice_name}} is ready. Three quick questions in your secure portal: {{portal_link}}. Urgent? Call {{nurse_line}}.” Email subject line: “Your check-in from {{practice_name}} is ready”. Set last_check_in_sent.
2. On response, write adherence_self_report, tolerability_flag and the call-request flag, set last_check_in_response_date, reset missed_check_in_count to zero, and branch: taking as directed and nothing reported and no call requested, continue; anything else, call workflow 5.
3. Wait to day 7. Send check-in two, same structure, copy varied so it does not read as a loop: “Hi {{contact.first_name}}, week one check-in. Same three questions, one minute: {{portal_link}}.”
4. Wait to day 14. Send check-in three. Add one extra portal question on whether the patient expects any barrier to continuing: asked in the portal, never in the message.
5. After day 14 with no open escalation, move the card to Steady Course and call workflow 3.
6. Any check-in sent and not answered within 48 hours calls workflow 4.

Exit: day 15 reached, escalation opened, or terminal stage set.

3. Steady Course Cadence and Completion

Trigger: stage becomes Steady Course.

Actions in order:

1. Schedule recurring check-ins at the interval set by check_in_cadence: Dense every 14 days, Standard every 30 days, Light every 60 days. Each one is the same three-question form behind a portal link.
2. Before each send, check for escalation-open, an answered check-in in the last seven days, or a booked appointment in the next three days. Any of those suppresses the send. A patient who is already talking to a clinician should not also be getting a robot.
3. Rotate three copy variants so the cadence does not become wallpaper. Variant two: “Hi {{contact.first_name}}, time for your regular check-in with {{practice_name}}: {{portal_link}}. Takes a minute.”
4. Wait until refill_due_date minus 7 days, then move to Refill Window and call workflow 6.
5. Wait until program_end_date. Send the completion check-in: “Hi {{contact.first_name}}, you're at the end of your course. One last short check-in from {{practice_name}}: {{portal_link}}.”
6. On completion response, capture whether the course was finished as prescribed, move to Course Complete, swap adherence-active for adherence-complete, and create the clinically specified next step. A follow-up booking, a repeat enrollment, or nothing. Notify prescribing_provider with the course summary.
7. If the completion check-in goes unanswered through the workflow 4 ladder, move to Course Complete with the outcome recorded as unknown. An unknown outcome is a real finding and belongs in the numbers, not hidden as a success.

Exit: Course Complete, Discontinued, or Lost to Follow-Up.

4. Missed Check-In Ladder

Trigger: a check-in has been sent and no response recorded after 48 hours.

Actions in order:

1. Increment missed_check_in_count, apply checkin-missed-1. Resend on the same channel: “Hi {{contact.first_name}}, we haven't heard back. Your check-in is still open: {{portal_link}}.”
2. Wait 48 hours. If still no response, apply checkin-missed-2 and switch channel: if the first attempt was SMS, send email with subject “Your {{practice_name}} check-in is still waiting”, and the reverse. Only channels with recorded consent are used.
3. Wait 72 hours. If still no response, apply checkin-missed-3, open an L1 escalation and create a coordinator call task due the same business day. The script tells the caller to confirm identity before saying anything beyond the practice name.
4. Wait 3 business days. If the call task is unsuccessful across two attempts at different times of day, apply patient-unreachable, stop all automated messaging on the card, notify prescribing_provider, and move to Lost to Follow-Up.
5. Any response at any rung clears the missed tags, resets missed_check_in_count, and returns the card to its cadence.
6. Cross-check: before declaring unreachable, the workflow checks refill_confirmed_date. A patient who is refilling on time but not answering check-ins is a different problem from a patient who has disappeared, and gets a different note to the prescriber.

Exit: response received, or Lost to Follow-Up.

5. Clinical Escalation Ladder

Trigger: a check-in answer of missed some doses, stopped taking, something is bothering me, or please call me; or a Tolerability Report submission; or BO detecting urgent language in any inbound message.

Conditions: the practice maps each answer to a level at configuration time. The mapping is a clinical decision, not a default, and it is reviewed with the prescribers.

Actions in order:

1. Apply escalation-open and the level tag. Write escalation_level and escalation_opened_at. Suspend every automated message on this card immediately.
2. L1: coordinator. Typical mapping: missed some doses, no tolerability concern. Create a coordinator task due within 4 business hours. The coordinator calls, records what they learn, and either closes the escalation or raises it. Patient-facing acknowledgement: “Thanks {{contact.first_name}}, someone from {{practice_name}} will call you today. If anything feels urgent in the meantime, call {{nurse_line}} or your local emergency number.”
3. L2: nurse or pharmacist. Typical mapping: stopped taking, tolerability flagged as troubling, or an explicit call request. Notify the nurse queue now, offer a same-day Nurse Check-In Call or Pharmacist Consult booking link, and create a task due within 2 business hours. If no slot exists today, the task escalates to the clinical lead for manual placement rather than offering tomorrow.
4. L3: prescriber. Typical mapping: urgent language detected, a safety-relevant report, or an L2 unresolved within its window. Notify prescribing_provider directly and immediately on their configured alert path, move the card to Escalated: Clinical, and create a same-day task with no round-robin: L3 always lands on a named person.
5. Urgent-language path. If the trigger was urgent language, the patient receives one message and only one: “{{contact.first_name}}, if you are having a medical emergency call your local emergency number now. Otherwise call {{nurse_line}} straight away. We have alerted the team.” BO stops. No automation attempts triage, reassurance, or advice.
6. Escalation timeout. Any open escalation past its due window re-notifies the owner, then the clinical lead, then appears on the daily digest. Escalations cannot silently age.
7. Closure. A clinician records the outcome: continue unchanged, continue with a change, pause, or stop. Write escalation_closed_at, clear escalation-open, and either resume the cadence (adjusting check_in_cadence to Dense for 14 days after any L2 or L3) or move the card to Discontinued with discontinuation_reason.

Exit: clinician-recorded closure. Only a person closes an escalation.

6. Refill Window and Gap Watch

Trigger: refill_due_date minus 7 days, or stage becomes Refill Window.

Actions in order:

1. Apply refill-window-open. Send the prompt: “Hi {{contact.first_name}}, it's about time for your next supply. Confirm or get help in your secure portal: {{portal_link}}.” The message never names what the supply is.
2. Wait 4 days. If refill_confirmed_date is empty, send a second prompt that offers help rather than repeating the ask: “Hi {{contact.first_name}}, need a hand sorting your next supply? Reply HELP and we'll call you.”
3. On refill_due_date. If still unconfirmed, start counting refill_gap_days and create a pharmacy verification task: staff check with pharmacy_on_file whether it was dispensed, because a patient who collected but never confirmed is not a gap.
4. Gap day 7. Apply refill-overdue-7, open an L1 escalation, and set adherence_self_report to a provisional missed-doses state pending the call.
5. Gap day 14. Apply refill-overdue-14, raise to L2, and notify prescribing_provider with the gap length. A two weeks-long gap changes the clinical picture and the prescriber should be the one deciding what it means.
6. Access branch. If the patient reports a cost or access barrier on the portal form, route to the coordinator with the practice's own access-support process. The automation never discusses price, coverage or alternatives. It routes to a human who can.
7. On confirmation at any point: set refill_confirmed_date, clear the overdue tags, roll refill_due_date forward, return the card to Steady Course.

Exit: refill confirmed, dispensing verified with the pharmacy, or card moved to Discontinued.

7. Daily Adherence Digest and Queue Health

Trigger: scheduled, each weekday before the first clinic block.

Actions in order:

1. Recalculate refill_gap_days and course day-counts on every active card.
2. Build the internal digest: all open escalations by level with age and owner, every escalation past its due window, all checkin-missed-3 cards, all refill-overdue-7 and refill-overdue-14, all cards with no start confirmation past 72 hours, all patient-unreachable from the last seven days, and all cards reaching program_end_date this week.
3. Send it to the clinical lead and the coordinator queue. The digest contains patient identifiers and belongs on an internal channel with access controls: never a personal inbox, never a group chat.
4. Create one task per unowned item. Reassign anything owned by someone out of office.
5. Weekly, add the roll-up: completion rate, start-confirmation rate, check-in response rate by channel, escalation volume by level and by trigger answer, and median time from escalation open to clinician contact.

Exit: never; this is what keeps the ladder honest.

8. Consent, Quiet Hours and Content Guardrail

Trigger: enrollment with no consent on file, Communication Consent submission, or any inbound opt-out keyword.

Actions in order:

1. Capture. Record patient_consent_sms and patient_consent_email as separate values, plus consent_captured_at, consent_language_version and consent_source. Store the exact wording the patient saw, versioned, not a paraphrase of it.
2. Separation. Consent for adherence check-ins is recorded separately from marketing consent. A patient can be opted out of newsletters and still receive their check-ins, and opting out of check-ins never silently removes them from the program. It switches them to the voice fallback and tells the prescriber.
3. On opt-out. Set that channel's flag to no, apply the revoked tag, remove the card from every active ladder on that channel, create a coordinator task to continue by phone, and send exactly one confirmation: “You're unsubscribed from texts from {{practice_name}}. We'll call you instead about anything that needs your attention.” Then nothing further on that channel.
4. Quiet hours and frequency. Hold every automated send to the practice's configured window in the patient's timezone. Cap sends per patient per rolling 24 hours across all adherence workflows, and across other programs the patient is enrolled in, so a patient on two courses with an open refill window does not get four messages in an afternoon. Over-cap sends queue to the next window.
5. Content guardrail. Before any send, verify the body and the subject line contain no merge field sourced from a clinical table: no medication name, no dose, no schedule, no indication, no symptom, no program_type_code, no readable diagnosis. Permitted merge fields are an explicit allow-list. First name, practice name, portal link, nurse line, booking link, generic date. A send that fails is blocked and raised as an internal alert, never silently rewritten.
6. Escalation suppression. While escalation-open is present, all automated sends on the card are blocked regardless of schedule. Clinical conversations are not interrupted by cadence.

Exit: runs permanently as the guard layer under every other workflow.

The prescription stops being the end of the interaction. Within three days the practice knows whether the course started; within a week it knows whether the patient is tolerating it; within two weeks the patients who would have quietly abandoned it have had a conversation instead. The two failure modes that used to be indistinguishable (the course that did not work and the course that was never taken) become separate facts in the record, which changes what the next clinical decision is built on.

Operationally, the change is that adherence work becomes a queue with owners and clocks instead of a conscientious staff member's spreadsheet. Escalations have levels, windows and named people. Refill gaps surface at seven days rather than at the next visit. And the patients who cannot or will not use a portal are explicitly handled by a voice fallback rather than being counted as non-responders.

Metrics to watch

• Start-confirmation rate within 72 hours of course_start_date, and the count of courses with no evidence of ever being started. The second number is usually the one that surprises people.
• Check-in response rate overall and split by channel, by cadence and by course day. Response rate almost always falls across a long course, and the shape of that fall tells you where to re-time the touches.
• Course completion rate and unknown-outcome rate. Report them side by side; a high completion rate next to a high unknown rate is not a good result.
• Discontinuation reasons as a distribution. Tolerability versus cost or access versus patient choice points at completely different fixes.
• Refill gap incidence, median refill_gap_days, and how many gaps turned out to be reporting artefacts once the pharmacy was checked.
• Escalation volume by level and by trigger answer, plus median time from escalation_opened_at to first clinician contact. If L2 contact time drifts past its window, the ladder is decorative.
• Escalation outcome mix: continued unchanged, changed, paused, stopped. A ladder that never changes anything is over-triggering; one that always changes something is under-triggering.
• Unreachable rate and portal activation rate, which together tell you how much of the panel the digital cadence actually covers.
• Guardrail health: blocked sends caught by the content check, opt-out rate per channel, and over-cap queued sends. A rising blocked-send count means someone edited a template; find out which one.

Prerequisites

• A clinician-signed mapping of answers to escalation levels. This is the single prerequisite you cannot shortcut. Which answer is L1, which is L2, which is L3, what the response windows are, and who owns each level must be decided by the prescribers and written down before anything is configured.
• An agreed urgent-language list, reviewed clinically, plus a documented out-of-hours path for what happens when an L3 fires at nine on a Saturday night.
• A staffed nurse line with defined hours, and an honest answer about out-of-hours coverage. If there is no coverage, every automated message must point to the emergency number and the cadence should not run outside hours at all.
• Which programs get monitored and at what cadence. Monitoring everything produces noise nobody reads; pick the courses where early abandonment actually changes outcomes.
• A patient portal patients can activate, plus a voice fallback process for the ones who cannot.
• Role-based access so the digest, the escalation queue and the tolerability reports are visible only to the roles that need them, reviewed on a schedule.

Integrations

• Calendar sync (Google Calendar or Outlook) for nurse, pharmacist and provider availability, with real same-day capacity held for L2 escalations rather than a booking link into a full calendar.
• Your prescribing and records system for the clinical record. This build tracks cadence and escalation; the medication record stays where it lives, and escalation outcomes should be written into the chart by your normal process.
• Pharmacy contact route for dispensing verification, often a phone call, sometimes a portal. Record the method per pharmacy.
• Reporting export for the adherence roll-up. Exports carry patient data and get the same handling as the system.

Numbers and messaging registration

• Provision a dedicated care coordination number and complete A2P 10DLC brand and campaign registration in the United States, describing the campaign accurately as transactional patient care coordination. Do not register it as marketing; a filtered check-in that staff believe was delivered is worse than no check-in.
• Keep this number and campaign separate from any marketing traffic so opt-outs do not cross-contaminate.
• Automatic, immediate opt-out handling on the recognized keywords, with plain-language confirmation and no further sends on that channel. Opt-in wording, help wording and opt-out wording must appear where the carrier rules require.
• Quiet hours configured in the patient's local time. Set the per-patient daily cap across every program the patient is enrolled in, not per workflow. The cap is only useful if it is global.
• Expect link filtering. Use one stable portal domain and a consistent sender; rotating shorteners get blocked.
• Decide in advance what the two-way inbox does out of hours. An unanswered reply to a health check-in is a real risk, so the auto-response must name the nurse line and the emergency number explicitly.

Protected health information and consent

An adherence program is one of the easiest places to leak PHI, because the natural way to write a helpful reminder is to name the medication. Resist that completely.

• Keep PHI out of SMS bodies and email subject lines. No medication name, no dose, no schedule, no indication, no condition, no symptom, no lab value, no “time for your diabetes medication”. Treat both surfaces as readable on a lock screen, by a family member on a shared phone, and in a carrier log. The message says a check-in is waiting and links to the portal; the portal says what the check-in is about.
• Apply minimum necessary to every template and every digest. For patient messages that means first name, practice name, link, nurse line. For internal digests it means the identifiers staff need to act, not a full clinical summary pasted into a notification. A digest that is convenient to read over someone's shoulder is too detailed.
• Capture consent explicitly and per channel, and version it. Record the exact wording shown, the version, the timestamp, the method and the source. Keep care-coordination consent separate from marketing consent, honor revocation of either without destroying the other, and keep revocation events as history rather than overwriting a field. An opt-out from check-ins should trigger a human conversation about how to stay in contact, not a silent removal from clinical monitoring.
• Get a signed business associate agreement in place before any patient data flows. The platform acts as a business associate when it processes patient data for the practice, and so does every downstream vendor in the chain: the SMS carrier or aggregator, the email sending infrastructure, any AI or transcription service touching message content, the calendar provider if appointment detail carries clinical meaning, and any warehouse or spreadsheet you export the roll-up into. Identify each one and confirm each is covered. An agreement with the platform does not extend to an integration you connected yourself.
• Treat the free-text tolerability reports as the most sensitive thing in the build. Patients will describe symptoms in their own words. Those submissions, the call notes attached to escalations, call recordings, voicemail transcripts and BO's conversation logs are all PHI. Set retention periods, restrict access by role, and verify that deletion reaches exports and backups.
• Keep the audit trail complete. Every send, every suppression, every consent event, every escalation open and close, and every clinician outcome should be attributable to a person or a named workflow with a timestamp. If an escalation is ever questioned, the trail is the answer.
• Never let automation perform triage. No automated message may advise on a dose, interpret a symptom, reassure, or tell a patient to continue or stop. Every message carries the emergency-number line. The escalation ladder exists so that a human makes every clinical call, and the suppression rule exists so that a patient in a clinical conversation never receives a scheduled nudge in the middle of it.

All of the above is operational practice, not legal advice. Which requirements apply to your practice, how consent must be worded for your jurisdiction and your patient population, what your retention periods must be, which vendors need agreements and in what form, how state privacy law interacts with federal requirements, and whether a given message counts as treatment communication or marketing are all questions for the practice's own compliance counsel and privacy officer. Have them review the escalation mapping, the templates, the consent wording, the vendor chain and the retention configuration before the first check-in goes out, and again every time a template or an integration changes.

Scope and build cost are set per practice. Book a call at bookings.appbo.io to work through yours.