Patient outreach power dial playbook: blocks, cadence and privacy gates

Counsel and privacy officer review notice

This playbook assumes that a healthcare organization has already completed the work that makes outreach lawful in its specific context: a written HIPAA analysis, business associate agreements with the covered entities involved, an approved minimum necessary policy, an approved script and voicemail policy, a recording and retention decision, and a privacy officer sign-off. It is a conditional fit and it is not legal advice. If any of those items is missing, the correct next step is that review, not a call block.

The call block, in two shifts

Patient outreach is a scheduling operation with a privacy overlay. The volume is real but the constraint is not dial count, it is keeping every call inside the approved script and the minimum necessary standard.

Morning, reminder block. Appointments due inside 72 hours. This is the highest-value block because a confirmed appointment reduces no-shows, which is the business reason the program exists.

Afternoon, callback block. Patients who asked for a reschedule, no-answer retries, and patients who need a different contact method. Keep this separate from the reminder block so you can see whether reminders or callbacks are driving the confirmation rate.

Privacy gates before the block

Load only lists the privacy officer approved, and keep clinical detail out of the queue where the script does not require it. The minimum necessary standard at 45 CFR 164.502 requires reasonable efforts to limit protected health information to what the purpose requires, and a reminder call does not require a diagnosis.

Business associate contracts sit at 45 CFR 164.504. Confirm that every system touching the call data is covered by those arrangements before any data moves, including the dialer, the note fields and the recording store. HHS guidance on cloud computing and business associate arrangements is a reasonable starting point for that review.

Screen the suppression list before the block loads, and treat any request to stop as immediate. TCPA revocation rules at 47 CFR 64.1200 recognize revocation by any reasonable method, and a verbal request on a call is a reasonable method.

Attempt cadence

Tighter than a sales cadence, on purpose. Persistent calling about a health matter generates complaints even when each call is legitimate.

• Attempt 1, 72 hours before: confirm or reschedule.
• Attempt 2, 48 hours before: different time of day.
• Attempt 3, 24 hours before: final confirmation attempt.
• Then stop and route the appointment to scheduling for a different contact method or a manual review.

Document every attempt with the outcome and any preference the patient stated. A patient who asked for no voicemail detail should not receive a detailed message from a different caller two days later.

Dispositions and preferences

• Appointment confirmed: with any time preference.
• Reschedule requested: with the callback window.
• Voicemail left, no clinical detail.
• Spoke with authorized person: with who they were.
• Wrong number: remove.
• Clinical question, routed: with the receiving team and date.
• Do not call: permanent, with the preferred contact method noted.

Preferences are dispositions too. “No voicemail detail” and “call after 4:00 PM” are operational instructions that belong in a field the next caller sees, not in free-text prose.

Working three lines under a privacy policy

DialBreeze rings up to three numbers per caller and the caller takes the live answer, with a recorded voicemail dropping on the rest. In a healthcare setting the line count decision is not just a productivity question. Answer detection is imperfect and two people can answer at once, and a dropped or mishandled call about a health matter is a privacy event, not just a bad call. Choose a line count the caller can handle cleanly.

Because AI summaries come from the recording, the calls worth summarizing need to be recorded, and recording patient calls requires a decision that accounts for state all-party consent laws and the organization’s retention policy. If recordings are not permissible, the program can run without AI summaries. That decision belongs to the privacy officer, not to the calling team.

Where the summaries go, and where they do not

Summaries should carry purpose, verification, outcome, requests and preferences. Clinical content belongs in the clinical record. Before any summary field is stored, confirm that the storage location is covered by the business associate arrangements in 45 CFR 164.504 and that the field set matches the approved minimum necessary policy.

A useful test: if the summary were read by someone with no legitimate reason to see it, would it disclose health information? If yes, the field set is too broad.

KPI targets as ranges

Reference points measured in DialBreeze production use (last 90 days to 2026-09-26, three-line sessions, one operator per session): median of about 85 dials per active calling hour, about 600 dials per operator day, and a 17.8 percent person-connect rate. Those are aggregate measured values from a sales-calling context, so treat them as a shape rather than a healthcare benchmark. They are a reference point from real use, not a promise for a patient outreach program, and any target should come from your own program history.

For a patient outreach program:

• Reach rate: the share of attempted patients reached, by contact method.
• Appointments confirmed over attempted: the core productivity metric.
• No-show rate against baseline: the outcome the program exists to move.
• Clinical questions routed same day: should be 100 percent.
• Preference capture completeness: 100 percent, including voicemail preferences.
• Complaints per thousand calls: the safety metric, reviewed monthly and taken seriously.

Marketing, authorization and the parts that belong to counsel

Outreach that promotes a service the patient has not received raises the authorization question at 45 CFR 164.508, while treatment communications follow a different path. Whether a particular campaign is treatment or marketing is a determination for the privacy officer. State medical privacy law can add requirements beyond HIPAA, and several states require all parties to consent before recording. Route those questions to counsel and to the privacy officer, and do not treat this playbook as legal advice.