Consent management for clinic marketing: what you actually have to record

Most practices believe they have consent because there is a checkbox on the intake form. The test is not whether somebody ticked something. The test is whether, asked today, you could produce a record showing who consented, when, how, and to what.

That is a data model, and almost nobody has built one.

The four fields, and the fifth people forget

Consent needs to record:

Who. The patient, identified in a way that survives a record merge. If two duplicate records are merged and the consent lives on the one that lost, you have consent you cannot evidence.

When. A timestamp, not a date, and stored in a way that does not shift when somebody changes a timezone setting.

How. The mechanism. Intake form, subscribe form, verbal at reception recorded by a named person, a reply to a re-permission email. These are not equivalent and a regulator will not treat them as such.

To what. The topics. Consent to receive appointment communication is not consent to receive promotional email, and consent to hear about one service line is arguably not consent to hear about all of them.

And the fifth: which version of the wording. This is the one that is almost never stored, and it is the one that turns a consent record into evidence. If you changed the intake form language in March, a consent captured in January was given against different wording. Storing a version reference costs one column and answers the only question that actually matters in a dispute.

Where the record belongs

Not in the form tool. Form platforms are built to deliver submissions, not to be systems of record, and they get replaced every few years by whoever is redesigning the website.

The consent record belongs in the system of record for the patient, which is the practice management system or the clinical CRM. Everything else reads from it.

This matters because of what happens next. A marketing platform holding its own separate subscription status will, over time, disagree with the clinical system, and when they disagree nobody knows which is right. One record, one owner, everything else downstream. The wider list separation this sits inside is covered in HIPAA-compliant email marketing for clinics.

Revocation has to propagate

An unsubscribe click in one platform is not revocation. It stops that platform sending, and it does nothing about the other four systems that also hold the contact.

Revocation needs to write back to the system of record and flow outward from there. The practical test is simple and most practices fail it: revoke consent on a test record, wait a day, then check every system that could send to that person. SMS gateway, review request tool, the automation nobody remembers configuring, the appointment system’s optional marketing add-on.

Where marketing relies on protected health information, a HIPAA authorization applies rather than a simple opt-in, and that carries an explicit right of revocation. The obligation is not to make revocation possible. It is to make it effective.

The audit question

If somebody asked you today to produce, for a named patient, the complete record of what they consented to and when, how long would it take?

Practices that can answer in minutes have a consent system. Practices that would need to search an inbox, ask a coordinator what they remember, and check three platforms have consent theatre, which is worse than having none because it produces confidence without evidence.

Run this once against a real record. It takes twenty minutes and it will tell you more about your position than any policy document.

Building it from where you are

Practices almost never start clean, and the list is usually of mixed and undocumented provenance.

Establish what you can evidence. Not what you believe was collected. What is recorded and producible. Everything else is unevidenced.

Treat unevidenced as clinical-only until re-permissioned. Those contacts still get appointment reminders and aftercare, because that is clinical necessity rather than marketing. They do not get campaigns.

Re-permission deliberately. One clear message from the clinical system, since asking for consent is not itself marketing. State what you will send, roughly how often, and how to stop. Do not attach an offer, because an offer makes the message marketing and you have then marketed to people who did not consent.

Expect a low response, and be pleased about it. A list where a fifth actively re-consent is a fifth who want to hear from you. It will outperform the previous list on every metric, and it converts an unquantified liability into something you can defend.

Then fix capture at the source, so the same problem does not rebuild itself. Which platform can hold that record depends on whether the vendor signs a BAA on your tier. A separate marketing opt-in on the intake form, written in plain language, with the version reference stored alongside the timestamp.

The grey area worth resolving in advance

The recurring internal argument is whether a specific message needs marketing consent, and it is better settled by structure than by debate.

The workable rule: if it goes out from the clinical system it is clinical, and if it needs the marketing system it needs consent. That converts a judgement call into a routing decision, and routing decisions can be enforced by access control in a way that judgement calls cannot.

It also handles the awkward cases without argument. A review request sent from the marketing system needs consent, which is the defensible position anyway. A recall for an overdue check is clinical, until somebody attaches an offer to it, at which point it needed to come from the other system.

What to do about verbal consent

Reception routinely captures consent verbally, and practices either over-rely on it or discard it entirely. Neither is right.

Verbal consent is valid and it is weak evidence, which means it should be recorded with the same five fields as any other and flagged as verbal. Who took it, when, and against what wording, meaning the script reception was actually reading rather than the one in the policy folder.

If a meaningful share of your list rests on verbal consent, that is worth knowing before somebody asks, and it is a good candidate for re-permissioning in writing.

One column that solves most disputes

If you take one thing from this: store the version reference of the consent wording alongside the timestamp.

It costs a single column and one small process change. It is the difference between saying “they consented in January” and being able to show precisely what they were shown when they did. Almost no practice stores it, and it is the first thing anybody investigating would ask for.

Why this is worth the trouble

The compliance argument is the obvious one and it is not the strongest.

The stronger argument is that consent is the only marketing asset a practice fully owns. Advertising accounts can be suspended, algorithms change, and a channel that worked last year can stop. A list of people who explicitly asked to hear from you is the one route to your own patients that nobody can take away, and it is worth exactly as much as it is documented.