Health plan member outreach in 2026: fix the data before texting

TL;DR

Health plan member outreach in 2026 often fails at the data layer before the message matters. Text reminders work: a Cochrane review found they raised immunization receipt from 161 to 208 per 1,000 people. But every text needs a valid, consented number for the right member, and enrollment files often lack one. Build the data remediation track first, then put texting and provider portal alerts on top of it.

• Validate and date every phone number before the first send, reassigned number check included.
• Deduplicate members and households, or one parent gets three fluoride texts.
• Replace Word and spreadsheet tracking with an intervention log you can count.
• Record consent and opt-outs by caller and message category; the FCC replaced its revoke-all rule on September 30, 2026.
• In the median reporting state, 23.4% of Medicaid and CHIP children ages 1 to 20 got at least two topical fluoride applications in 2024.

Outreach works when it reaches the member

Good news first: texting works. A Cochrane review found that text message reminders raised immunization receipt from 161 to 208 per 1,000 people, on high-certainty evidence. Plans are shifting: in Engagys' annual State of Engagement survey, reported by RISE in November 2025, text messaging posted double-digit growth in adoption and effectiveness while call center outreach declined.

Every one of those messages needs a working number for the right person. The Medicaid unwinding showed what stale contact data costs at scale: KFF counted at least 25,198,000 disenrollments, 69% of them for procedural reasons, which can occur when the state has outdated contact information.

CMS drew the practical conclusion during unwinding. Its May 2024 bulletin lists section 1902(e)(14)(A) waivers that let states update beneficiary contact information with data from managed care plans. The enrollment file, in other words, is not always the best copy of a member's phone number.

The FCC rewrote the TCPA opt-out rules on September 30, 2026

Automated texts to members fall under the FCC's Telephone Consumer Protection Act rules. Since April 11, 2025, under 47 CFR 64.1200(a)(10), a member can revoke consent by any reasonable method, a reply such as STOP included, and you must honor it within ten business days.

The revoke-all provision, which would have applied one opt-out to every unrelated message from the same caller, never took effect. FCC order DA 26-12 had pushed it to January 31, 2027. In an order adopted on September 30, 2026, the FCC replaced it: a caller may treat an opt-out from an informational message as covering only that category, while a telemarketing opt-out still covers all telemarketing. Callers may also designate an exclusive opt-out method, such as standard reply words, if every message discloses it. The order takes effect 30 days after Federal Register publication.

For a plan that sends fluoride reminders, renewal reminders and refill texts under one name, that makes category a data field. Tag every message with one, and record on every opt-out the category it came from. The consent record needs who gave consent and their relationship to the member, the caller and category it covers, plus its source and date. One store, read by every program and vendor before it sends. None of this is legal advice: your counsel decides which consent basis each program relies on, and a pending FCC notice may move the rules again.

Carriers add a gate that messaging providers enforce. Twilio, for one, blocks messages to U.S. numbers from a 10DLC number that is not associated with an approved A2P brand and campaign.

How we built this breakdown

Three rules apply below.

• Regulatory and quality measure facts come from the rule, the measure owner or the federal report itself.
• Examples are published case studies, linked, or our requirement records with identifying details removed.
• Where we publish our own numbers, any group with fewer than three data points is not published.

One disclosure. Mercury Development builds custom healthcare software, so we have a stake in how outreach programs get scoped. The guides ranking for member engagement, from WestCX to Experian Health, agree that member contact data decays. None we checked says what to build first.

Data track and messaging track at a glance

Validate the phone number before you text it

Treat the phone field in an enrollment file as an unverified claim. The X12 834 transaction set carries enrollment between the sponsor of the insurance product and the payer, and whatever number the sponsor recorded travels with it. In Medicaid managed care that sponsor is the state, and a wrong number stays wrong until someone fixes it.

Run four checks, in order.

1. Format. Normalize every number to the E.164 numbering plan and reject what will not parse.
2. Line type. A lookup such as Twilio's line type intelligence separates mobile numbers from landlines, which generally cannot receive SMS.
3. Reassignment. The FCC says millions of phone numbers are reassigned each year, and its Reassigned Numbers Database held over 305.9 million numbers by February 2023. Query it against the date you obtained consent. It tells you whether the number was permanently disconnected since then, not who holds it now. If you had the member's consent and the database answered wrongly, the safe harbor in 64.1200(m) can protect you.
4. Provenance. Store where each number came from and when it was last confirmed. A number a member gave a care manager last month outranks the one in an old enrollment record.

One member, one record: deduplication across enrollment files

Enrollment files restate the population every cycle, and members who leave and come back may return with a changed identifier, address or guardian. Deduplication runs at two levels.

At the member level, match on more than the member ID: name, date of birth, address history and guardian. Keep the match rule and its confidence with the merged record, so a care manager can split a wrong merge.

At the household level, pediatric outreach texts a parent or guardian, and one phone number can sit on several children's records. A shared number does not prove a shared guardian. Group children only under a guardian relationship you can verify, and keep the text generic, a prompt to call or log in with no child's name or service, because you cannot be sure who reads it. Without grouping, one parent of three gets three texts.

Deduplicate before you count gaps, too: a duplicated child is a gap that never closes on one of its records.

Late or wrongly shaped enrollment files are one of the client side causes in our breakdown of healthcare software project delays.

Replace the outreach spreadsheet with an intervention log

In one health plan outreach program we scoped, staff tracked interventions in Word documents and spreadsheets they built themselves, because nothing else recorded what had been tried. That spreadsheet is the most valuable dataset in the program and the least usable.

Turn it into an intervention log built from linked events, not one row with one outcome. The send is an event: who was contacted, on which channel and number, with which template and when. Delivery, a reply, an opt-out, a scheduled visit and a gap closed by claims are separate events attached to it, each with its own time and source. A wrong number event feeds back into the contact record and demotes that number.

We have built this pattern before, on the provider side. Our medical billing case study started from weekly CSV snapshots filtered by hand with macros, with duplicate documentation kept in both billing software and spreadsheets. The replacement imported snapshots daily and routed work by rejection code. The AR manager no longer spent several days a week in spreadsheets, and the client increased the number of claims worked by 80% without hiring new staff.

The fluoride gap, end to end

Fluoride is a clean test case: the guideline and the measure are both public. The USPSTF recommends, at grade B, that primary care clinicians apply fluoride varnish to the primary teeth of all infants and children younger than 5, starting at the age of primary tooth eruption. The CDC says varnish can prevent one-third (33%) of cavities in primary teeth. The Smiles for Life oral health curriculum reports that all 50 state Medicaid programs reimburse primary care clinicians for applying it to young children's teeth.

The gap is still wide. The Child Core Set measure TFL-CH tracks the share of enrolled children ages 1 to 20 who received at least two topical fluoride applications as dental or oral health services in the year. For calendar year 2024 the median across 52 reporting jurisdictions was 23.4%, and for ages 1 to 2 it was 15.3%, per CMS performance rates for the 2025 Child Core Set.

One health plan outreach team described the program it wanted: an alert in the provider portal at login, listing members eligible for fluoride, plus a text to members who had not had it. Each half sits on data.

• The eligible list comes from claims: age band, applications so far this year, and both dental and oral health services, since TFL-CH counts either. If dental benefits sit with a separate administrator, settle whose claims feed the list before you design the alert.
• The alert needs attribution: which members belong to the provider who just logged in.
• The text goes to a verified guardian's validated, consented number.
• Hold out a random slice of eligible members who get usual outreach but no text, then compare their claims with the texted group's. Comparing reached with unreached members only shows who was easier to reach.

Provider portal alerts need clean provider data too

Provider data has the same problem. When CMS reviewed Medicare Advantage online provider directories between November 2017 and July 2018, 48.74% of listed locations had at least one inaccuracy, across 52 organizations and 10,504 locations.

That review is old, but the mechanism holds: a portal alert is only as good as the link between a member and the provider who logs in. Attribution, practice locations and staff accounts have to be right before an alert reaches someone who can apply varnish this week. Pilot with practices whose rosters you have verified. Log when each alert was shown and opened, then match later varnish claims to it: a view is exposure, the claim is the action.

Teams that build provider-facing browser surfaces are compared in our ranking of healthcare web development companies.

What goes into the first release

The table is the scope. It hides two things.

First, ingestion. Each enrollment file needs validation, a rejection report and a change history per member, so when a number changes you know which file changed it.

Second, sequencing. Run the data track across the whole file, then pilot the messaging track on a slice: one measure, verified practices, validated numbers, a registered 10DLC campaign. What waits is a campaign builder, more channels, more measures and predictive targeting. Each gets better once the log holds a few months of real outcomes.

Which first release fits your program

Medicaid managed care plan. Your numbers arrive in the state's file. Put validation and household grouping first, and ask your state how it takes corrected contact information from plans today.

Dental benefits administrator. You may already hold the fluoride claims and the dentist relationships. Start with the gap list and the provider portal alert, then add member texts.

Medicare Advantage plan. By CMS's own review, provider data is the weak side. Clean rosters and attribution before you alert anyone.

Provider group running its own outreach. Your numbers come from patients directly, and the FCC's healthcare exemption in 64.1200(a)(9)(iv) is written for providers, with its limits. Start with the intervention log and measure what your staff already do.

For dental benefits programs, our ranking of dental software development companies covers the practice side systems those claims come from.

What our own requirement records show

We reviewed by hand our requirement records for staff-facing care management, outreach and administration software, compiled in September 2026, leaving out records that did not describe the current state. Around half described the current state as a record-keeping problem before it was a software problem: bad contact data in member files, interventions tracked in spreadsheets and Word documents, double entry between systems that do not talk, or status the people doing the work could not see.

Every one of those records still opened with a screen: a portal, an app, alerts or texts. The data problem showed up in how buyers described their week. The request showed up as features.

Why we put the data track in sprint one

Opinion, stated plainly. We would rather text a smaller group of members on numbers we trust than the whole file on numbers we do not.

The reason is readability. A pilot run on a dirty file cannot tell you whether texting works. A failed message, a wrong person and a member who ignored you all look like the same missing visit. Clean the data, hold out a random slice, and the pilot answers the question you paid for.

Two limits. A data track cannot create a number that was never collected; for members with none, the provider portal and the visit itself are the channel. And if a vendor already validates your file every month, keep that service and spend the budget on the log.

Written by Alexey Rodionov, Lead Front-end Developer at Mercury Development since 2020. Alexey is a Google Developer Expert in Web Technologies and a Chromium contributor whose code ships in Chrome DevTools, Google's Bubblewrap and Microsoft PWABuilder. The requirement reviews behind this article come from the engineering practice he works in.

Send us your file layout and we will split the first release

Tell us where your member contact data comes from, how your team tracks outreach today and which gap you want to close first. We will come back with a first release split into a data track and a messaging track, plus what we would leave for later.