Guide

How a US dental practice can follow up new patient inquiries without putting health details in the wrong place

By Frenz Adrian Sarabia, founder of G-SYNQ · Updated 13 October 2026

Short answer: Reply to every new patient inquiry right away with a short personal message that confirms the request and offers a time to call or book. Keep health and insurance details out of the form and out of automatic messages, and take the HIPAA, CAN-SPAM and text-consent questions to your own attorney. I make no HIPAA claim about anything I build, and this isn't legal advice.

Want me to check your own follow-up? Get my free review ↗

This is a method guide. I haven't built a follow-up system for a dental practice, so there are no results here and I won't suggest any. What I can do is explain how I'd set it up and which rules I'd check first, with links to the regulators' own pages.

Where do new patient inquiries slip?

Mostly in the gap between the inquiry and the first answer. The front desk is with a patient, or the office is closed, and the inquiry waits. The person has usually asked more than one practice. I explain why the first reply matters in how fast to reply to a new inquiry. For a dental practice there's a second problem: the more a form asks, the more likely it collects something that shouldn't be sitting in a marketing tool.

What should the form ask?

As little as possible: name, phone or email, whether they're a new patient, and when suits them for a call or a visit. I'd leave symptoms, conditions and insurance for the phone call or the practice's own system. If you run Facebook or Instagram lead forms, there's a platform reason too. Meta's list of questions prohibited on instant forms includes health information, such as medical conditions and treatments, and insurance information, such as the insurer's name and plan details. Meta says a form that breaks the list won't run. It says "including but not limited to", so read the whole list.

What should the first reply say?

Short, personal and administrative. As an illustration only:

Hi Dana, thanks for contacting [practice]. The best next step is a quick call or a visit so we can talk through what you need. You can pick a time here: [booking link]. If you'd rather we call you, just reply to this email.

It doesn't give clinical advice, doesn't say what treatment someone needs, doesn't quote a price you haven't approved, and doesn't promise a result. The practice approves every word before it goes live.

What does the rest of the follow-up do?

1. They book. A confirmation, then reminders a day before and an hour before.
2. They miss it. A friendly message with a link to rebook, and a task for your team.
3. They asked but didn't book. A short follow-up, then a task for a person to call.
4. They ask you to stop. Every message stops, and the contact is marked.

The automatic messages go by email, and by SMS only where the person has ticked a consent box on the form. I don't set up WhatsApp.

What does HIPAA have to do with it?

I'm not going to answer whether your setup is HIPAA compliant, because that's not mine to answer and I make no such claim. What I can tell you is what HHS says. Its page on covered entities and business associates (last reviewed 21 August 2024) lists dentists as covered entities, but only if they transmit information electronically in connection with a transaction for which HHS has adopted a standard. It says that when a covered entity engages a business associate to help carry out its health care activities, it must have a written business associate contract or other arrangement. HHS's page on business associates (last reviewed 30 July 2026) describes a business associate as someone engaged to carry out certain functions or provide certain services that involve using or disclosing protected health information.

Whether what a person types into your inquiry form counts as protected health information, and whether a form or CRM vendor then needs an agreement with you, depends on your facts. That's why I keep health details out of the form, and why that question goes to your healthcare attorney before you connect any tool.

What do the email and text rules say?

For email, the FTC's CAN-SPAM compliance guide asks commercial email for accurate header information, honest subject lines, a valid postal address and a clear opt-out that is honored within 10 business days. It says you can't contract away your responsibility by hiring another company to send. For calls and texts, the FCC's guide to unwanted robocalls and texts says commercial texts require written consent, and that autodialed texts to a mobile phone are banned without prior consent. A form fill isn't automatically that consent, so get the consent wording checked. I cover both in more detail, with a real build, in the dealer guide. Your state may have its own advertising and privacy rules too, so check with your state dental board and your attorney.

What results can you expect?

I have no dental or US clinic result to show. The closest I can show is the US manufactured-home dealer on my Work page: 182 form leads at $17.11 each on $3,114 of spend, lifetime to 23 September 2026. That's leads, not appointments or patients, in a different industry. What I can offer a dental practice is the method and the care with the rules above, not a number.

A checklist for your practice

The way I work with US businesses in general is on the US page.