- Shipped
- October 25, 2026 at 4:12 PM UTC
- Author
- Kamo
- Commit
- 29e22ca
- One consent-gated door **************** for chart messages, reminders, video links, recall messages and confirmation replies: the patient's own consent per channel (TCPA/HIPAA, never presumed, tied to the number), the org do-not-contact / do-not-email lists, quiet hours for anything automated. Sent messages land on the patient's timeline only (never fanned to a CRM lead sharing the number) and in ehr_patient_message with carrier status. - Consent ledger endpoints, /check (consent + minimum-necessary clinical-word prompt), /send, /sent. - Appointment reminders: practice settings (lead times, channel, templates whose placeholders cannot reach the reason, type, clinician or specialty; quiet hours never narrower than 9 pm - 8 am), a singleton-locked job that claims each reminder before sending (once per appointment, lead and start), calendar-day leads on the practice clock across DST, skips recorded with reasons. - Inbound relay from VOIPService (internal): STOP/START into the patient ledger, unfiled replies onto the patient timeline, C confirms the reminded visit; carrier receipts update delivery status. - Video visits: a room per video appointment or walk-in through MediaService's provider abstraction, public patient link vs members-only clinician link, send-link-now; desk confirmation. - Recall: send the recall message through the same door and log the outreach automatically.