Healthcare Loyalty Programs for Medical Clinics

1. What is a healthcare loyalty program?

Strip away the retail vocabulary and a clinic programme is made of a small number of moving parts. Some are almost universally appropriate — a member card carrying the practice's phone number harms nobody. Others, particularly anything that transfers value to a patient, are the reason this article has a compliance section rather than a compliance footnote.

Why healthcare loyalty is not retail loyalty

Four differences do all the work, and every design decision later in this guide traces back to one of them.

Frequency is clinical. In retail, more visits is the goal. In medicine, the right number of visits is whatever a clinician determines — and the evidence that more is better is thinner than most marketers assume. A Cochrane review of recall intervals for oral health in primary care patients found high-certainty evidence that, over four years, risk-based recall produced little to no difference in caries-affected tooth surfaces or gingival bleeding compared with fixed six-month recall.

The data is regulated. The mere fact that a named person is your patient is individually identifiable health information: 45 CFR 160.103 defines it as information relating to, among other things, "the provision of health care to an individual" that identifies them. A patient list is sensitive before a single clinical detail is attached to it.

Incentives are regulated. In the United States, remuneration that a practice knows or should know is likely to influence a Medicare or Medicaid beneficiary to obtain items or services from a particular provider can trigger the Beneficiary Inducements civil monetary penalty under section 1128A(a)(5) of the Social Security Act.

Trust is the product. An over-eager retail message costs a discount. An over-eager healthcare message costs a relationship, and sometimes a complaint.

Related concepts: patient experience, care continuity, customer loyalty cards, patient panel, membership plan.

2. Why medical clinics care about patient retention

The two statistics you should stop using

Both of these circulate constantly in healthcare marketing content. We traced both to origin and removed both from this article.

"It costs five times more to acquire a patient than to retain one." There is no retrievable primary source. The most credible trace runs back to unpublished 1980s consulting research at the Technical Assistance Research Project, cited second-hand in Loyalty Myths (Wiley, 2005) — whose authors conclude the reality "is far more complex." A peer-reviewed analysis by Pfeifer in the Journal of Targeting (2005) shows the ratio is meaningless unless you separate average from marginal cost. No healthcare-specific version exists at all.

"A 5% increase in retention increases profits 25–95%." This is a conflation of two separate statements. Bain's ">25%" figure is specific to financial services and is published without underlying data or methodology; the "almost 100%" is Bain's own restatement of the 1990 Harvard Business Review article "Zero Defections." No single source says "25 to 95 percent," and nothing in either concerns patients, clinics or health systems.

What can actually be said, with sources

Missed appointments are measurable and material. NHS England reported that of roughly 103 million outpatient appointments booked in 2021/22, 7.6% ended in a "did not attend" — around 650,000 slots a month. A peer-reviewed US study of ten Veterans Health Administration clinics found a mean no-show rate of 18.8%, with an estimated average marginal cost of $196 per no-show in 2008 dollars. Both come from specific systems with specific populations. Neither is a benchmark for a private clinic, and you should not use them as one.

Continuity is associated with better outcomes. A systematic review in BMJ Open (2018) found 18 of 22 eligible studies reported statistically significant reductions in mortality with greater continuity of care, across nine countries and both generalist and specialist doctors. The authors are explicit that all the evidence is observational. Continuity is not the same thing as appointment frequency, and this finding does not support "more contact is better" — it supports making care accessible and relationships durable.

Patients are already digital, and provider encouragement moves the needle. An ASTP/ONC data brief based on the 2024 HINTS survey reported that 65% of individuals accessed a patient portal at least once in the past year and 57% accessed records via an app. Among those encouraged by a provider to use the portal, 87% did so, against 57% of those not encouraged. That is cross-sectional and confounded — engaged patients are also more likely to be encouraged — but it is a real government survey rather than a vendor claim.

Related reading: retention strategies that survive contact with real businesses, retention for local businesses.

3. Healthcare loyalty vs patient retention vs patient engagement

4. Healthcare loyalty program models for medical clinics

1. Membership programs

A defined annual or monthly package, typically covering services insurance does not, sold at a stated price. The patient enrols, receives a member credential and a benefit summary, and is reminded before renewal. Example: a dental practice's in-house plan covering two hygiene visits and an examination at a fixed annual fee. Business goal: predictable revenue and a defined scope. Patient value: cost clarity.

Compliance: the highest-supervision model here. Membership pricing that touches services reimbursed by a federal health care programme, or that begins to resemble insurance, is regulated territory, and several states regulate dental and medical membership plans specifically. Auto-renewal terms are also live: the FTC's 2024 "click to cancel" Negative Option Rule was vacated by the Eighth Circuit on 8 July 2025 (Custom Communications, Inc. v. FTC), which reinstated the narrower 1973 rule — but ROSCA, FTC Act Section 5 and a growing set of state auto-renewal statutes continue to apply, and the FTC opened a fresh rulemaking in March 2026.

2. Patient appreciation programs

Recognition with nothing transactional attached: the practice acknowledges relationship milestones and personal occasions. Example: a birthday note with no offer in it. Business goal: relationship warmth and less silent attrition. Patient value: being treated as a person rather than a slot. Compliance: the lowest-risk model on the list, precisely because nothing of value is exchanged.

3. Referral programs

The highest-return and highest-risk model in healthcare marketing. Example of the conservative form: a named thank-you and a handwritten note. Business goal: lower acquisition cost. Patient value: helping someone they know.

Compliance: the federal Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)) makes it a felony to knowingly and wilfully offer remuneration to induce referrals for items or services payable by a federal health care programme, and there is no safe harbor for patient loyalty rewards among the exceptions at 42 CFR 1001.952. State law is frequently broader and often not limited to federal-programme business — California Business & Professions Code § 650, for instance, reaches referral compensation at a purely cash-pay practice.

4. Wellness and education engagement

An opt-in content stream that pays off in understanding rather than visits. Example: a short series explaining what the practice offers, how to prepare for an appointment and how to reach the team after hours. Business goal: fewer avoidable calls and better-prepared patients. Compliance: content accuracy is the exposure. The FTC's Health Products Compliance Guidance (December 2022) sets the substantiation standard at "competent and reliable scientific evidence" — tests, analyses or studies conducted and evaluated objectively by relevant experts. Do not publish health claims your own clinicians would not sign.

5. Appointment and recall engagement

The workhorse of clinic engagement. Patients receive administrative reminders on schedules that clinicians and written protocol have already set. Business goal: fewer avoidable empty slots. Patient value: not missing care they already agreed to. Compliance: hold two things apart — who sets the interval (a clinician, always) and what the message says (as little as possible; see Section 13).

6. Service-based memberships

A membership scoped to specific non-covered services. Example: an optometry practice's annual package covering a contact-lens fitting and follow-up checks the patient's plan does not cover. Business goal: predictable ancillary revenue. Compliance: as model 1, plus one addition — the closer a bundle comes to functioning like insurance, the more state-specific the analysis becomes.

7. Digital patient and member cards

A persistent, non-clinical credential in the patient's phone: member status, practice contact details, benefit summary. Business goal: a durable contact point that does not depend on the patient keeping an app installed. Patient value: the practice's number is one swipe away. Compliance: low, provided the pass carries no health information. Covered in full in Section 6.

8. Benefit-based programs

Member pricing on things that are not medical care — the practice's retail skincare or eyewear range, for instance. Compliance: moderate, and there is a useful statutory hook here. The Beneficiary Inducements CMP has an exception at 42 U.S.C. 1320a-7a(i)(6)(G) for coupons, rebates or other rewards from a retailer that are "offered or transferred on equal terms available to the general public, regardless of health insurance status" and are "not tied to the provision of other items or services reimbursed" by Medicare or a state health care programme. That is a strong argument for keeping retail benefits genuinely public and genuinely separate from clinical services.

5. 18 loyalty program ideas for medical clinics

Membership and onboarding

1. Membership welcome sequence. Three messages covering what the membership includes, how to use it and who to call. Patient benefit: they actually understand what they bought. Business benefit: fewer support calls, higher benefit utilisation. Compliance: keep the benefit description exactly consistent with the written terms.
2. Benefit summary on the card itself. The two or three things membership includes, on the back of the digital pass. Compliance: non-clinical text only.
3. Renewal notice at 30 and 7 days. Advance warning before a membership renews. Compliance: the single most protective thing you can do about auto-renewal — clear terms, clear notice, easy cancellation.
4. New-patient orientation card. A wallet card for new patients with hours, phone, portal link and what to bring. Business benefit: materially reduces first-visit friction.
5. Multi-site member card. One card that works across every location in a group. Patient benefit: no confusion about which site holds their membership.

Recall, reminders and operations

6. Clinician-set recall reminder. "Your review is due" — where "due" was determined by a clinician, never by a campaign calendar. Compliance: a clinician or written protocol owns the interval, full stop.
7. Appointment reminder relay. Where the scheduling system supports it, a logistical reminder of an already-booked appointment. Compliance: minimum necessary content; check what your appointment data flow actually permits.
8. Waitlist and cancellation fill. Notify opted-in patients when an earlier slot opens. Business benefit: this is where empty-slot recovery actually lives — it converts a loss into an earlier appointment for someone who wanted one. Patient benefit: earlier access.
9. Post-visit "how to reach us" note. Hours, after-hours contact and how to get results. Business benefit: measurably fewer inbound calls.
10. Inactive-patient administrative check-in. One low-pressure note to patients with no contact for a defined period: "We still have you on file — here is how to reach us." Compliance: an administrative contact, not a call to book.

Appreciation and recognition

11. Patient anniversary acknowledgement. "Five years with the practice — thank you." No offer attached. Compliance: low risk because nothing is exchanged.
12. Birthday message. Warmth without a discount. Compliance: only if you already hold the date of birth for a legitimate purpose and the patient has consented to this kind of contact.
13. Referral thank-you and recognition. A named thank-you, no payment. Compliance: the conservative form of the highest-risk model — see Section 4.
14. Feedback request after a defined milestone. A short, genuine ask for experience feedback. Compliance: never gate or filter feedback by expected sentiment; the FTC treats manipulated reviews as deceptive.

Information and benefits

15. Practice announcements. New location, new hours, a clinician joining, parking changes. Patient benefit: genuinely useful logistics — the highest-tolerance message type there is.
16. Seasonal service availability notices. "Flu clinics run from October — book if it is right for you." Compliance: state availability; never tell patients what they need.
17. Member-only educational content. A short library explaining procedures, preparation and aftercare, written or reviewed by clinicians. Compliance: FTC substantiation standards apply to any health claim.
18. Member pricing on retail products. A stated benefit on non-clinical goods the practice sells. Compliance: keep it public-facing and unconnected to reimbursed services.

6. Digital membership cards for medical clinics

What a clinic membership card can usefully carry: the practice name and logo, the member's name, a member number or tier, the renewal date, a short benefit summary, the clinic's phone number, address and website, and a barcode or QR code for front-desk lookup. What it must never carry is set out in Section 13.

The distinction that matters most to clinic staff — and the one that most often needs stating out loud in an internal meeting — is what a wallet card is not.

Related reading: how digital membership cards work across industries, what a wallet pass actually is, and the membership card builder if you want to see the fields a pass can hold.

7. Healthcare loyalty cards in Apple Wallet and Google Wallet

Apple Wallet

Apple documents exactly five pass styles: boarding pass, coupon, event ticket, store card and generic. There is no "membership card" style — Apple names the store card as the style for loyalty and membership programmes, and the generic pass for membership cards and claim tickets. On the app question Apple is unambiguous: "Users can add a pass without installing the related app, or add a pass that doesn't have a related app at all." Three distribution routes are documented — from an app, from a web page download, or as an email attachment.

Passes update remotely through a web service and the Apple Push Notification service. Apple's documented flow is: the user installs an updatable pass; the device registers the pass with your server and provides a push token; the pass information changes and your server sends a push notification; the device queries your server for updated passes and requests each one that changed.

Relevance is the other surfacing mechanism, and Apple's own documentation page is titled "Showing a Pass on the Lock Screen." Its example is directly analogous to a clinic: "show a gym membership card at the gym." A pass may carry up to ten relevant locations, and maxDistance can only shrink the system's default radius, never widen it — Apple does not publish what that default is, so no honest article can tell you the geofence size in metres.

On health data: Apple Health and Health Records are a separate system from Wallet. Clinical records live in HealthKit as read-only HKClinicalRecord samples behind their own permission sheet. The only bridge Apple documents between the two is the "Add to Apple Wallet and Health" button, and Apple restricts it to verifiable vaccination records using SMART Health Cards or the EU Digital COVID Certificate. Apple's App Store Review Guidelines separately prohibit using health data gathered in health, fitness and medical contexts "for advertising, marketing, or other use-based data mining purposes," and require apps in highly regulated fields including healthcare to be submitted by the legal entity providing the services. Those guidelines govern apps rather than pass files — but they tell you exactly where Apple stands.

Google Wallet

Google's Wallet API organises passes into verticals — loyalty, offers, gift cards, tickets, transit, access, generic — plus a separate generic private pass for sensitive categories such as health insurance cards and government identification. Google's position on sensitive data is a direct quote worth pasting into any vendor conversation: "We do not allow the APIs to be used for processing sensitive data in Google Wallet without explicit permission from Google, as described in the Wallet API Acceptable Use Policy." Health insurance cards and vaccine cards run through dedicated programmes with their own eligibility-documentation requirements. A clinic membership card carrying no health information is an ordinary generic pass; anything sensitive is a different product on a different approval path.

Passes are saved through an "Add to Google Wallet" link — a signed JWT in a URL — which Google documents as working "anywhere hyperlinks are supported, such as websites, email, and SMS messages." No issuer app is required, though the user does need Google Wallet itself.

Location works through merchantLocations — up to ten per class and ten per object — triggering a notification when a user enters and dwells within a radius that Google sets and does not publish. Both platforms support QR, PDF417, Aztec and Code 128 barcodes, with further formats available on each.

Platform depth: Apple Wallet guide · Google Wallet guide.

8. Patient recall and re-engagement

The HIPAA line between recall and marketing

In the US there is a further reason to keep this clean. HIPAA's definition of marketing at 45 CFR 164.501 carves out refill reminders, treatment communications including case management and care coordination, and communications describing "a health-related product or service… that is provided by, or included in a plan of benefits of, the covered entity making the communication." So a clinic telling its own patients about its own services generally sits outside the marketing definition.

But those carve-outs fall away, in the regulation's own words, "except where the covered entity receives financial remuneration in exchange for making the communication" from a third party whose product is being described. Where marketing authorisation is required, 45 CFR 164.508(a)(3) sets it out — with exceptions for face-to-face communication and for "a promotional gift of nominal value provided by the covered entity" — and requires that the authorisation itself state that remuneration is involved.

9. Push notifications for medical clinics

What this channel is genuinely good at is narrow and real. The pass sits in the wallet without requiring an app install; it survives phone changes through the platform's own sync; and a push reaches a patient who explicitly chose to keep the card. What it is bad at is equally clear: a small character budget, no privacy guarantee, and no acknowledgement that a human read and understood anything.

Channel background: what wallet marketing is · how push automation works.

10. Healthcare loyalty program examples by practice type

Primary care clinic

Objective: continuity and fewer avoidable empty slots. Structure: no rewards at all — a digital patient card plus recall and administrative reminders. Patient experience: the clinic's number and hours in the wallet, prompts when a clinician-set review is due, waitlist notifications for earlier slots. Communication: two to three messages a month, maximum. KPI: recall response rate and no-show rate. Compliance: the panel is likely to include federal-programme beneficiaries, which puts the Beneficiary Inducements CMP squarely in scope — which is exactly why this structure has no rewards in it.

Dental clinic

Objective: membership-plan enrolment and hygiene recall attendance. Structure: an in-house membership plan with a digital member card carrying plan tier and renewal date. Communication: welcome, renewal notice at 30 and 7 days, hygiene recall on the clinician-set interval. KPI: plan enrolment and renewal rate. Compliance: dental membership plans are state-regulated and can sit close to the definition of insurance; the recall interval is clinical, and the Cochrane evidence in Section 8 should inform how you talk about it.

Dermatology clinic

Objective: separating medical dermatology from cosmetic services cleanly. Structure: benefits and membership applied only to the cosmetic side; the medical side gets administrative communication and nothing else. Patient experience: two visibly different relationships with one practice. KPI: cosmetic membership enrolment; medical-side recall response. Compliance: this separation is the compliance strategy for a mixed practice. Blur it and a cosmetic incentive becomes an inducement attached to medical care.

Physiotherapy clinic

Objective: plan-of-care completion and reactivation. Structure: engagement and administrative reminders only, keyed to a plan the treating clinician set. KPI: plan completion rate, reactivation rate. Compliance: never let a marketing calendar extend a plan of care. The clinician's plan is the schedule.

Optometry clinic

Objective: examination recall and eyewear ancillary revenue. Structure: a recall programme plus member pricing on the retail eyewear range, kept separate from the examination itself. KPI: recall response, retail attachment. Compliance: keeping the retail benefit genuinely separate from the clinical service is what keeps it a retail benefit — see the statutory exception discussed under model 8 in Section 4.

Med spa and aesthetic practice

Objective: membership revenue and repeat elective bookings. Structure: the model closest to consumer loyalty — a paid membership with genuine benefits, a member card and package tracking. KPI: membership revenue and renewal.

Specialty clinic

Objective: continuity for complex, long-duration patients. Structure: education and administrative engagement; no incentives. KPI: engagement with educational content; attendance at protocol-driven reviews. Compliance: the higher the acuity, the more careful the content and the lower the tolerable message frequency — and the more important it is that the programme name discloses nothing (see Section 13).

Wellness-focused practice

Objective: membership revenue for non-covered services. Structure: a service-based membership with clearly stated non-clinical benefits. KPI: enrolment, renewal, benefit utilisation. Compliance: where the practice also delivers regulated medical services, separate the two as strictly as in the dermatology example.

11. How to build a healthcare loyalty program

1. Define the patient-experience objective. One sentence, no metrics. "Patients should never miss a review because we failed to tell them" is an objective. "Increase visits 15%" is not — in a clinical setting that is a target pointed at the wrong thing.
2. Identify the appropriate audience — and just as importantly, who is excluded. Federal-programme beneficiaries, minors, and patients under active treatment for sensitive conditions may each warrant different handling.
3. Choose the mechanic. Engagement, membership, recall, referral, digital card, or a defined combination. Use the decision framework in Section 18.
4. Define benefits precisely. Write the benefit schedule as though a regulator will read it, because one might. Name what is included, what is excluded, what it costs and when it renews.
5. Legal and compliance review — before you build. Incentives, referral mechanics, membership pricing, consent language, auto-renewal terms and data flows all get reviewed here. This is not a formality and it is not last.
6. Choose technology against the checklist in Section 16. If any patient identifier will be held by a vendor on your behalf and you are a HIPAA covered entity, you are looking for a business associate with a signed agreement — not a marketing tool with good screenshots.
7. Design the digital experience: the card, the sign-up flow, the front-desk process and the staff script. Sign-up at the front desk with a QR code is where most clinic programmes are won or lost.
8. Write communication rules. Maximum frequency, approved message categories, who signs off clinical-adjacent wording, and a hard prohibition on health details in any push or pass field.
9. Launch small. One location, one patient segment, a defined period. Train the front desk before the patients arrive, not after the first confused one.
10. Measure against the framework in Section 14 — including whether patients are better served, not only whether utilisation rose.
11. Review and improve on a set schedule. Quarterly for messaging, annually for benefits, terms and compliance posture.

• Patient-experience objective written and agreed by clinical leadership
• Audience defined, with exclusions documented and a reason recorded for each
• Programme terms written — benefits, price, duration, renewal, cancellation
• Legal and compliance review completed and recorded, before build
• Consent language drafted, specific, and the withdrawal path tested end to end
• Vendor due diligence complete — security, data location, sub-processors, and a signed business associate agreement if any PHI is involved
• Pass content reviewed against the information safety checklist: zero health details
• Message categories, frequency ceiling and approval owner defined in writing
• Front-desk script and sign-up flow tested by someone who does not work in marketing
• Both platforms tested on real devices — Apple and Google, add and update
• Baseline metrics captured before launch, so the "after" has a "before"
• Review date set for messaging, benefits and compliance posture

12. Healthcare loyalty program compliance considerations

Privacy: HIPAA

Under 45 CFR 160.103, individually identifiable health information includes information relating to "the provision of health care to an individual" that identifies them — which is why a named list of your patients is itself sensitive, before any clinical detail is attached. HIPAA's marketing definition at 45 CFR 164.501 excludes refill reminders, treatment communications and care coordination, and communications describing the covered entity's own health-related products or services. Those treatment and operations carve-outs fall away "where the covered entity receives financial remuneration in exchange for making the communication" from a third party whose product is described. Where authorisation is required, 45 CFR 164.508(a)(3) sets it out, with exceptions for face-to-face communication and promotional gifts of nominal value.

Vendors: business associates

If a vendor creates, receives, maintains or transmits protected health information on your behalf, it is a business associate. 45 CFR 164.502(e) requires satisfactory assurances "documented through a written contract or other written agreement"; 45 CFR 164.308(b) imposes the parallel Security Rule obligation and extends it to subcontractors. There is no informal version of this and no verbal version of it.

Incentives: the Beneficiary Inducements CMP

Section 1128A(a)(5) of the Social Security Act (42 U.S.C. 1320a-7a(a)(5)) reaches remuneration offered to a Medicare or state health care programme beneficiary that the offeror "knows or should know is likely to influence" that person to obtain items or services from a particular provider. "Remuneration" expressly includes waivers of coinsurance and deductibles and "transfers of items or services for free or for other than fair market value."

Statutory exceptions matter here too — including remuneration that "promotes access to care and poses a low risk of harm" (42 U.S.C. 1320a-7a(i)(6)(F)) and the retailer rewards exception at (i)(6)(G) discussed under model 8 in Section 4.

Referrals: the Anti-Kickback Statute

42 U.S.C. 1320a-7b(b) makes it a felony to knowingly and wilfully offer, pay, solicit or receive remuneration to induce referrals of items or services payable under a federal health care programme. The safe harbors at 42 CFR 1001.952 are voluntary and non-exclusive — falling outside one is not itself a violation — but there is no safe harbor for patient loyalty rewards.

Advertising and auto-renewal: the FTC

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices. The FTC's Health Products Compliance Guidance (December 2022) sets the substantiation bar for health claims at competent and reliable scientific evidence. On membership auto-renewal, the position moved recently: the FTC's 2024 Negative Option Rule was vacated by the Eighth Circuit on 8 July 2025, reinstating the narrower 1973 prenotification rule, and the FTC opened a new rulemaking in March 2026 — but ROSCA, Section 5 and state auto-renewal statutes continue to apply throughout. Separately, the FTC's Health Breach Notification Rule reaches health apps and similar technologies not covered by HIPAA, so a consumer-facing wellness programme sitting outside a covered entity is not therefore unregulated.

State law is often broader than federal law

Two concrete examples. California Business & Professions Code § 650 makes unlawful the offer or receipt of "any rebate, refund, commission, preference, patronage dividend, discount, or other consideration… as compensation or inducement for referring patients" — and unlike the federal AKS it is not limited to federal-programme business, so a refer-a-friend reward at a purely cash-pay California practice can be unlawful with no Medicare involvement at all. California's Confidentiality of Medical Information Act (Civil Code § 56.10) requires authorisation before disclosure and, unlike HIPAA, carries a private right of action.

13. What information should be on a healthcare wallet pass?

Useful next step: draft the field list in the wallet pass planning worksheet before anything gets built.

14. How to measure healthcare loyalty programs

Two disciplines separate a credible healthcare programme from a repurposed retail one.

Rising visit volume is not a success metric. If your programme's headline result is that patients came in more often, the first question is whether they needed to. That question should be asked by a clinician, not by whoever built the dashboard.

Adaptable tools: retention dashboard · retention planner — both built for general business; apply the clinical caveats above.

15. Common healthcare loyalty program mistakes

1. Rewarding clinical behaviour. Why it matters: it creates a financial reason to seek care and, in the US, can trigger inducement liability. Better: reward membership and non-clinical activity only.
2. Treating compliance as a final step. Why it matters: every expensive redesign comes from finding out late. Better: legal review before technology selection.
3. Collecting more data than the programme needs. Why it matters: every additional field is additional liability with no upside. Better: collect the minimum that makes the programme work, and document why each field exists.
4. Over-communicating. Why it matters: healthcare frequency tolerance is far lower than retail, and an opt-out is hard to reverse. Better: a written frequency ceiling, actually enforced.
5. Weak or implied consent. Why it matters: "they gave us their number at reception" is not consent to marketing. Better: specific, recorded, withdrawable in one tap.
6. Blurring marketing and clinical voice. Why it matters: a promotional message that reads like clinical advice is the worst outcome available. Better: separate message categories with separate approval owners.
7. Substituting a marketing tool for a clinical system. Why it matters: wallet passes and push tools have no clinical audit trail, no acknowledgement of receipt and no record-keeping guarantees. Better: clinical communication stays in clinical systems.
8. No written programme terms. Why it matters: undefined benefits become disputes and undefined renewal becomes a complaint. Better: published terms covering benefits, price, duration, renewal and cancellation.
9. Ignoring accessibility. Why it matters: a patient population is more likely than a retail one to include people with visual, cognitive or dexterity limitations — and peer-reviewed survey evidence shows lower-income patients report relatively stronger preference for telephone contact. Better: keep a non-digital path, always.
10. No measurement, or the wrong measurement. Why it matters: without a baseline nothing is attributable; with the wrong KPI you optimise toward utilisation. Better: the five-layer framework in Section 14.
11. One-size-fits-all benefits. Why it matters: a benefit appropriate for a cosmetic patient may be an inducement for a medical one. Better: segment by service line, not just by tenure.
12. Unclear patient value. Why it matters: if a patient cannot say in one sentence what the programme gives them, it is an internal initiative wearing a patient-facing costume. Better: write the patient's one sentence first, and if you cannot, stop.

16. Healthcare loyalty program software: what to look for

Core capability

• Apple Wallet and Google Wallet pass creation, both platforms, from one sign-up link
• Membership management — tiers, status, renewal dates, expiry
• Pass updates and push messaging, with the platform limits described honestly rather than glossed
• Design control — logo, colours, fields, layout
• QR sign-up suitable for a front desk, printed materials and a website
• Multi-location support if you operate more than one site

Communication and control

• Segmentation, so a message can be limited to the right cohort
• Scheduling and automation, with a frequency ceiling you can enforce
• Consent capture and a one-tap opt-out that genuinely works
• Approval workflow, or at minimum a role structure letting clinical leadership sign off wording
• Analytics granular enough to show opt-outs, not just opens

The seven healthcare-specific questions

• Will any patient identifier be held by the vendor? If yes, and you are a covered entity, you need a business associate agreement — ask for it in writing before the trial, not after
• Where is data stored, and who are the sub-processors? A vendor that cannot answer this in one email has answered it
• What security controls exist, and what evidence backs them? Ask for documentation, not adjectives
• What is the data export and deletion path, including on termination?
• Does the vendor claim to be "HIPAA compliant"? Handling communication does not make a platform HIPAA compliant. Ask precisely what they mean, and ask for the BAA
• Does the vendor claim EHR, EMR or portal integration? Ask which systems by name, and for a reference customer using it
• Do integrations and an API actually exist? Verify rather than assume — many wallet tools deliberately have neither, which is fine if they say so

General evaluation ground: vendor scorecard · free loyalty software buyer's guide. The seven questions above are the healthcare-specific additions.

17. Where PushNotice fits

What it does, verifiably. Patients save a membership or loyalty pass to Apple Wallet on iPhone or Google Wallet on Android from a single link or QR code. Pass content can be updated and a notification sent without any companion app. Passes can be associated with places, so a card can surface when a patient is nearby — a paid-tier feature. Higher tiers add tagging and segmentation, and multiple workspaces for multi-location groups. Pricing runs from a free plan at $0 through Starter at $29 per month and Pro at $79 per month, with an agency tier for white-label use. There is no public API and no POS or EHR integration — we would rather say that here than have you discover it in week three.

Our position on healthcare is the conservative one, and it is already published on our clinic and dental pages: keep passes free of health information, diagnoses and treatment details, and use them for logistics — membership status, practice announcements, and reminders whose schedule your clinicians own. PushNotice does not provide legal or compliance advice. If your programme would involve protected health information passing to any vendor, that is a business associate conversation with a signed agreement, and it is one to have before a trial rather than after.

Vertical pages: wallet marketing for clinics · wallet marketing for dental practices · plans and limits.

18. Healthcare loyalty program decision framework

Step one: pick the mechanic from the problem

• Patients do not know what we offer or how to reach us → engagement and communication programme, plus a digital card carrying contact details.
• We have recurring non-covered services and unpredictable revenue → membership programme with defined benefits and a renewal date.
• Patients miss clinician-set reviews → recall workflow, with the interval owned by a clinician and the reminder owned by administration.
• Slots go empty at short notice → waitlist and cancellation-fill notifications. The highest-yield mechanic on this list and the least regulated.
• Word of mouth is our best channel and we want more of it → referral recognition, subject to Gate 1 below.
• Members have nothing tangible and forget their benefits → digital membership card in Apple Wallet and Google Wallet.
• Patients drift away without ever formally leaving → reactivation: one low-pressure administrative contact, not a campaign.

Step two: run it through all three gates

Gate 1 — does anything of value pass to a patient? If no, proceed to design with ordinary privacy and consent discipline. If yes, compliance review is required before you build.

Gate 2 — does the programme involve health information? If no, a standard wallet pass is appropriate. If yes, do not place that information into a generic wallet pass: Google routes sensitive categories through a separate private-pass programme requiring explicit permission, and Apple keeps clinical records in HealthKit rather than Wallet. A health-information programme needs legal and security review, and probably belongs in your portal or clinical system rather than a marketing tool.

Gate 3 — the one people forget. Would a thoughtful clinician in your practice be comfortable if a patient described this programme back to them in the consulting room? If not, the problem is not the wording.

Frequently asked questions

The core questions

Rewards, referrals and legality

Wallet cards and platforms

Recall, measurement and software

Methodology, sources & disclosure

What is sourced, and how

Four categories of claim appear here and they are treated differently. Regulatory sources — eCFR, the United States Code, HHS Office for Civil Rights guidance, OIG policy statements and advisory opinions, FTC business guidance and California statute — are cited to the section and quoted where the exact wording carries the meaning. Platform documentation — Apple's Wallet Passes reference, pass update web service, Lock Screen relevance and App Store Review Guidelines; Google's Wallet API generic and private-pass documentation, update and notification references, and health passes documentation — was consulted 28 August 2026 and quoted rather than paraphrased where precision matters. Research is peer-reviewed or from an official statistics publisher, reported with its own numbers and caveats. Everything else — the six frameworks, the matrices, the decision tree, the checklists, the practice-type structures and the ordering of the eleven build steps — is PushNotice analysis and labelled as such.

What was deliberately excluded, and why

Three things. The "5× cheaper to retain than acquire" statistic, because it has no retrievable primary source and a peer-reviewed rebuttal exists. The "5% retention increase produces 25–95% more profit" figure, because it is a conflation of two separate unsourced Bain statements, one of which is specific to financial services, and neither of which concerns healthcare. NHS England's "reminders reduce DNAs by up to 80%" claim, because it rests on uncontrolled single-site improvement work and is contradicted by the pooled Cochrane estimate of RR 1.14. We also excluded every vendor survey of the "X% of patients prefer texts" type, because none we found published a sample, a sampling frame or a response rate.

Where we could not verify something

Stated in the text rather than smoothed over. The clearest example is the TCPA status of wallet and app push notifications: 47 CFR 64.1200 addresses calls, prerecorded voice, SMS and fax, and we found no FCC ruling extending it to push. That is an absence of authority, not a clearance, and Section 9 says so. Similarly, neither Apple nor Google publishes its default geofence radius, so this article gives no figure in metres — and you should treat any article that does with suspicion.

Disclosure and limitations

PushNotice sells wallet marketing software, and Section 17 describes our own product. We have tried to make that section unusually explicit about what PushNotice is not, including the absence of any HIPAA claim, any API and any EHR integration. The author is not a physician, healthcare professional, compliance attorney or HIPAA specialist, and this article is not legal, compliance or medical advice. Regulatory positions change: the FTC's negative-option rulemaking and the proposed HIPAA Security Rule are both live as of the review date. Verify at the source before acting.

Primary sources

Privacy and HIPAA: 45 CFR 160.103 (definitions); 45 CFR 164.501 (marketing); 45 CFR 164.508(a)(3) (authorisation); 45 CFR 164.502(e) and 164.308(b) (business associates); HHS Office for Civil Rights guidance on marketing; proposed HIPAA Security Rule, 90 FR 898 (6 January 2025).

Inducements and referrals: 42 U.S.C. 1320a-7b(b) (Anti-Kickback Statute); 42 CFR 1001.952 (safe harbors); 42 U.S.C. 1320a-7a(a)(5) and (i)(6) (Beneficiary Inducements CMP and exceptions); 42 CFR 1003.110; OIG Policy Statement Regarding Gifts of Nominal Value (7 December 2016); OIG Special Advisory Bulletin, Offering Gifts and Other Inducements to Beneficiaries (August 2002); OIG Advisory Opinions 08-07 and 12-21.

Advertising and consumer protection: FTC Health Products Compliance Guidance (December 2022); FTC Negative Option Rule and Custom Communications, Inc. v. FTC (8th Cir., 8 July 2025); FTC advance notice of proposed rulemaking on negative option marketing (March 2026); FTC Health Breach Notification Rule.

State law examples: California Business & Professions Code § 650; California Confidentiality of Medical Information Act, Civil Code § 56.10.

Platform documentation: Apple Developer — Wallet Passes (Pass, PassFieldContent, barcodes), Adding a Web Service to Update Passes, Showing a Pass on the Lock Screen, Distributing and Updating a Pass, Wallet Get Started; Apple App Store Review Guidelines 5.1.1 and 5.1.3; Apple HealthKit clinical records documentation. Google — Wallet API generic passes, generic private pass, updates, push notification triggers for generic and loyalty passes, MerchantLocation, BarcodeType, health passes, Terms of Service and Acceptable Use Policy.

Research and statistics: Jacobson Vann JC et al., "Patient reminder and recall interventions to improve immunization rates," Cochrane Database of Systematic Reviews 2018, CD003941.pub3. Gurol-Urganci I et al., "Mobile phone messaging reminders for attendance at healthcare appointments," Cochrane Database of Systematic Reviews 2013, CD007458.pub3. Fee PA et al., "Recall intervals for oral health in primary care patients," Cochrane Database of Systematic Reviews 2020, CD004346.pub5. Pereira Gray DJ et al., "Continuity of care with doctors — a matter of life and death?", BMJ Open 2018;8:e021161. Kheirkhah P et al., "Prevalence, predictors and economic consequences of no-shows," BMC Health Services Research 2016;16:13. Al-Turbag M et al., "A systematic review and meta-analysis of appointment reminders for enhancing hospital attendance," Journal of Hospital Management and Health Policy 2026;10:2. Fridman I et al., "Preferences for Electronic Modes of Communication Among Older Primary Care Patients," JMIR Formative Research 2023;7:e40709. NHS England, "Reducing did not attends (DNAs) in outpatient services" (2023). NHS England Digital, Hospital Outpatient Activity 2024-25. AHRQ, Guide to Patient and Family Engagement. Richwine C, ASTP/ONC Data Brief No. 77 (June 2025). Pfeifer PE, "The optimal ratio of acquisition and retention costs," Journal of Targeting 2005;13(2).

About the author

Sajid Ali is Founder and CEO of PushNotice, a wallet marketing platform for small and multi-location businesses. He writes about wallet passes, loyalty mechanics and customer communication from a technology and business perspective. He is not a physician, healthcare professional, compliance attorney or HIPAA specialist, and the regulatory material in this article is a summary of publicly available primary sources provided so that clinic owners and their advisers can have a better-informed conversation — not a substitute for one. Connect on LinkedIn.

Related guides