For years, it has been imperative that a hospital capture a patient’s cell phone number. Some time ago, it was for the convenience of tracking down a patient. Now, it is a necessity as many patients are forgoing even having an old-fashioned landline.

However, the Telephone Consumer Protection Act (TCPA), clarified by the Federal Communications Commission (FCC) in 2015, has created new roadblocks for health systems that want to use a patient’s cell phone as part of their debt collection efforts.

Without taking proper steps to understand the law, hospitals and health systems are risking multi-million dollar lawsuits and/or settlements. Hospital CFOs should make sure their business office is in strict compliance with the limitations on cell phone calls to avoid potential litigation.

So, how did we get here in an age when the average patient is tethered to their cell phone 24-7?

In 1991, when cell phones did not even flip and few people possessed them, Congress responded to a handful of consumer complaints about telemarketing calls to their mobile phones by enacting the TCPA. This act restricted the use of automatic dialing systems, prerecorded voice messages, and text messages to cell phones.

The medical debt collection industry was hindered by the rule, and in the summer of 2015, asked the FCC to clarify it. The hope was for collection agencies to gain more flexibility on the use of auto-dialing cell phones. The proactive move backfired when the FCC clarified that debt collectors must obtain express consent before dialing a cell phone number.

Health systems can eliminate much of the confusion by clearly capturing the patient’s permission in writing, after reading a document articulating the use of the cell phone number being requested.

Here are eight facts all hospitals should know from the HealthLeaders Media Feb. 22, 2016 article:

1. The act covers more than just collection calls.

The TCPA applies to calls reminding patients of an appointment, a test result, or any other message to the patient. If that call from the hospital or hospital representative is made to a patient’s cell phone, the TCPA requires express permission from the patient.

2. The TCPA does not require permission for all calls to a patient’s cell phone.

A provider may call a patient’s cell phone as much as it likes, even without the patient’s permission, as long as an auto-dialer is not used and no pre-recorded messages are left.

3. Avoidance of auto-dialed or prerecorded messages does not assure compliance.

If a provider’s debt collection agencies or other vendors use non-compliant methods, the provider can still be held responsible for violations of the TCPA.

4. Consent is provided when the cell phone number is obtained.

When the patient and/or subscriber of the cell phone provides the cell phone number to the provider, that person is providing consent to be contacted at that number by the hospital or health system, its accounting department, its collection agencies, or anyone else calling on the provider’s behalf. Providing the cell phone number is considered express consent to call and to use auto-dialers and recorded messages under the TCPA. But if the cell phone number was obtained in any other way, there is no consent.

5. It is always a good idea to get written consent anyway.

As any good lawyer would say, get it in writing. Obtaining written consent should not be difficult for a hospital. Just add a statement to the hospital admission forms that grants the hospital permission to reach the patient at any number provided. Even better would be a statement such as: “I hereby provide you my mobile number to communicate with me regarding my treatment or services rendered.” The courts have made clear that providers do not have to explicitly state that the permission includes the use of auto-dialers and pre-recorded messages, but acknowledging that those methods may be used could provide an extra layer of protection.

6. A cell phone number in the patient’s record does not necessarily include consent.

Just because it existed in past records does not mean permission is granted. For instance, if a spouse or friend fills out the paperwork for a patient admitted through the emergency department, it is not safe to assume the healthcare provider has consent for that cell phone number. The TCPA says consent comes when the subscriber or customary user provides the number, and though a person may be authorized to act on the patient’s behalf regarding the paperwork, it is risky to assume there is consent for cell phone contact.

The best course of action in that situation may be to employ a method of scrubbing all such ED-originated cell phone numbers from records before they are entered into the main system, or to flag them as potentially problematic. For instance, cell phone numbers originating in the emergency department could be automatically blocked for use until someone manually calls that number to confirm that the patient consents to its use.

7. Consent does not transfer from one episode of care to another.

If a patient gave her cell phone number during admission for a tonsillectomy in 2013, the permission applies for just that claim. Any future services would require capturing a new permission from the patient.

8. The TCPA requires that revocation of consent be documented.

The FCC’s recent clarification of the TCPA finds that any user of a cell phone number has a duty to track and record revocation of consent. If anyone in the organization contacts the patient by cell phone and the patient says he or she doesn’t want to be contacted by that number anymore, the provider must immediately document that revocation. Then the provider must have a process by which the number is scrubbed from its systems or flagged as unusable.

Court rulings in favor of plaintiffs in TCPA cases are usually small. But for lawyers and corporations, the losses’ costs can be in the millions.

“In 2014, the average consumer received $4.12 from a TCPA class-action settlement. Plaintiffs’ lawyers received an average of $2.4 million,” according the Wall Street Journal. TCPA lawsuit settlements with Walgreen’s Pharmacy over the last two years totaled $11 million.