What WhatsApp can and cannot do as a hospital channel
WhatsApp patient communication works well for a narrow set of jobs: appointment confirmations and reminders, visit preparation instructions, a bill-ready notification, a report-ready notification with a secure link, and simple two-way rescheduling. It works badly as a clinical channel, because messages are read on shared devices, forwarded without thought, and retained indefinitely on hardware the hospital does not control.
The channel's advantage is reach. It is the messaging application most Indian patients already have open, which means adoption does not need to be manufactured. That same ubiquity is the risk: a message that would have been a sealed envelope is now a notification on a lock screen that a family member can read.
So the design question is not whether to use it but what may travel over it. A hospital that answers that question explicitly, in writing, before switching the channel on will avoid the majority of the problems that follow.
Template approval and how business messaging actually works
Business messaging on WhatsApp does not allow a hospital to send arbitrary text to a patient at will. Outbound messages initiated by the business must generally use templates submitted for approval in advance, and there are rules about what those templates may contain — promotional content is treated differently from transactional content, and rejections are common when the two are mixed.
This has a practical consequence for hospitals: every message type must be designed as a reusable template with variable slots, and the variables should carry the minimum needed. A reminder template that says your appointment with the doctor is confirmed for the given date and time, with a location, is approvable and safe. The same template with the department name spelled out may be approvable and is considerably less safe, because it discloses that the patient is attending oncology or psychiatry.
Once a patient replies, a service window opens during which freer conversation is possible. Build the workflow around that: use the approved template to open, and handle the actual conversation inside the window. Trying to force a full conversation into templated outbound messages produces both rejections and a bad patient experience.
Template design rules worth enforcing
- Never place a diagnosis, department or test name in a variable
- Keep transactional and promotional templates strictly separate
- Include an unambiguous opt-out instruction
- Use a link to an authenticated portal instead of attaching content
- Version each template and record which version was sent
Opt-in and consent under the DPDP Act
Health data is sensitive by nature and India's Digital Personal Data Protection Act, 2023 requires that consent for processing personal data be free, specific, informed and unambiguous, with a genuine ability to withdraw it. In practice this means a checkbox buried in a registration form that says the patient agrees to receive communications is a weak basis for sending clinical notifications over a consumer messaging app.
Design the opt-in as its own decision. Tell the patient what will be sent, over which channel, and what will never be sent. Record the timestamp, the version of the notice shown, and the channel consented to, because the obligation is to be able to demonstrate consent later, not merely to have collected it.
Withdrawal must be as easy as granting. If a patient replies STOP, the effect should be immediate and should propagate to every system that could send — a hospital where marketing and appointment reminders run from separate stacks routinely keeps messaging a patient who opted out of one of them. Where the messaging integration and the patient record share the same platform, as with a system such as HealUDoc, that propagation is easier to guarantee than when consent lives in a separate campaign tool.
What must never be sent over chat
Draw the line at content whose disclosure to a third party could harm the patient. Diagnoses, test results, prescriptions, images, discharge summaries and anything relating to a sensitive category of care do not belong in a message body. The safe pattern is a notification that something is ready, plus a link to an authenticated portal where the patient must identify themselves.
The reason is not primarily regulatory, it is practical. Phones in Indian households are frequently shared, notification previews are visible on the lock screen, and a message about a pregnancy, an HIV test, a psychiatric appointment or a termination can reach exactly the person the patient was hiding it from. There is no consent form that undoes that harm.
Staff need this as a rule, not as guidance. The failure mode is always the same: a well-meaning coordinator screenshots a report for a patient who is asking urgently and cannot come in. Give the coordinator an authorised alternative — a portal resend, a call, a scheduled counselling slot — so the rule does not force them to choose between the policy and the patient.
Designing the escalation to a human
Any messaging channel a hospital opens will receive messages it was not designed for, including clinical questions and emergencies. A patient who types that they have chest pain into an appointment reminder thread has made a reasonable assumption about what the channel is. The system must handle that assumption safely.
Two mechanisms are needed. The first is a permanent, visible statement in the automated flow that the channel is not monitored for emergencies, with the alternative given explicitly — the emergency number, the hospital's own casualty line. The second is keyword and intent escalation that routes anything resembling a clinical concern to a human queue with a defined response time, rather than looping the patient through menu options.
Staff the queue honestly. A channel advertised as responsive during stated hours, and genuinely answered during those hours, builds more trust than one that promises always-on service and delivers a bot. Publish the hours in the automated reply and hold to them.
“The bot was fine until somebody typed that her father had collapsed. Now the first thing every conversation sees is the emergency number, and anything clinical goes straight to a person.”
Identity, shared numbers and wrong recipients
The phone number on a hospital record is not a reliable identifier. Numbers are shared across a household, recycled by operators, entered wrongly at a busy counter, and belong to an attendant rather than the patient more often than most hospitals assume. Every one of those cases sends hospital communication to the wrong person.
Build a verification step into onboarding — a confirmation message the patient must respond to before the number is treated as verified — and re-verify periodically for patients who have not attended in a long time. Flag numbers that appear on multiple patient records for review rather than blocking them, because legitimate cases exist: an elderly parent using an adult child's phone is common and legitimate.
Where the registered number belongs to an attendant, that should be recorded as such and should constrain what may be sent. A number marked as a caregiver contact should receive logistics and not clinical notifications, unless the patient has specifically authorised more.
Measuring whether the channel is actually working
The honest measures are operational: no-show rate for reminded versus unreminded appointments, inbound call volume to the appointment desk, time from report-ready to report-viewed, and opt-out rate. Message delivery and read receipts describe the channel's plumbing, not its value, and a dashboard built on them will look impressive while telling you nothing. HealUDoc dashboards can put the no-show comparison next to the appointment data it came from, which is the only way to tell whether the channel earned its place.
Watch opt-out rate as the early warning. A rising opt-out rate almost always means frequency has crept up or promotional content has leaked into a transactional channel. It is the cheapest available signal that the programme is annoying the people it is meant to serve, and it moves before satisfaction scores do.
Review the message mix quarterly. Channels degrade by accretion — one department adds a health-tip broadcast, another adds a camp announcement, and within a year the reminder that actually reduces no-shows is buried among messages the patient has learned to ignore.
