Law 2300 of 2023
If your IPS calls or messages patients to collect payments, promote services or remind them of appointments, these are the rules the law sets and what it still leaves unresolved.
Ley 2300 de 2023 (Law 2300 of 2023), known in Colombia as the "Dejen de fregar" law, protects consumers' right to privacy by setting the channels through which, the hours during which and the frequency with which they can be contacted. It was written with collections in mind, but its article 5 extends it to any producer or supplier of goods and services that sends advertising by SMS, messaging apps, email or calls.
For an IPS (instituciones prestadoras de salud, Colombia's healthcare provider institutions), this touches three areas: collecting balances from patients, promoting services and day-to-day messages, such as appointment reminders and confirmations. The text answers the first two. It does not answer the third, and it is worth saying so plainly.
In short
- What it is: a law of Congress signed into law on July 10, 2023 and published in the Diario Oficial (Colombia's official gazette) No. 52.452 of that date. It has been in force since October 10, 2023 (article 10).
- Who it applies to: entities supervised by the Superintendencia Financiera (Superfinanciera, the financial regulator) and any natural or legal person that carries out collections directly, through third parties or by assignment of the obligation (article 1). It also applies to producers and suppliers that send advertising messages (article 5).
- Hours: Monday to Friday from 7:00 a.m. to 7:00 p.m. and Saturdays from 8:00 a.m. to 3:00 p.m., with no contact at all on Sundays or public holidays (article 3).
- Frequency: once there has been direct contact, no more than once a day and not through several channels in the same week (article 3).
- Channels: only those the consumer authorizes (article 2).
- Penalties: imposed by Superfinanciera and the Superintendencia de Industria y Comercio (SIC, the consumer protection and data protection authority), under article 9.
What the law says, article by article
| Article | Rule |
|---|---|
| 1 | Purpose and covered parties: entities supervised by Superfinanciera and anyone who carries out collections directly, through third parties or by assignment. |
| 2 | Contact only through the channels the consumer authorizes, disclosed in advance so the consumer can choose. |
| 3 | Hours, frequency and authorization for other hours. |
| 4 | Contacting personal references is prohibited. A guarantor or co-debtor is contacted under the same conditions. |
| 5 | Extension to advertising by SMS, messaging apps, email and calls, and adaptation of the Registro de Números Excluidos (the CRC do-not-contact registry). |
| 6 | Home or workplace visits to collect are prohibited, with exceptions. |
| 7 | The reason for nonpayment cannot be asked; payment alternatives can be explored. |
| 8 | Exceptions: confirmation of monetary transactions, voluntary savings and severance savings (cesantías), information requested by the consumer and fraud alerts. |
| 9 | Penalties by Superfinanciera and the SIC, under Ley 1266 de 2008 (Law 1266 of 2008). |
| 10 | Effective date: three months after enactment. |
In Sentencia C-278 de 2024 (Constitutional Court ruling C-278 of 2024), the Court declared the law constitutional on the specific challenge it reviewed.
Hours, frequency and authorizations
Article 3 has two rules. The first concerns frequency: once direct contact has been established, the consumer cannot be contacted through several channels within the same week or more than once on the same day. The second concerns hours: Monday to Friday from 7:00 a.m. to 7:00 p.m., Saturdays from 8:00 a.m. to 3:00 p.m., and no contact on Sundays and public holidays.
To be contacted at other hours, the consumer must expressly request it in a document that is separate from the contract governing the relationship and made after that contract was signed (article 3, paragraph). A clause within the same contract or promissory note does not serve that purpose.
Two legal opinions (conceptos) from Superfinanciera clarify the scope. In Concepto 2023111476-001, it says that contact exists from the moment the message is sent or the call is made to an authorized channel, without the law requiring any interaction with the person. In Concepto 2023109218-003, it says that the hours and frequency of article 3 also apply to advertising messages, whatever the product or service.
Collections, advertising or information: how to classify an IPS's messages
The law speaks of consumers and does not mention the health sector. What matters is the purpose of the message:
| Type | Examples at an IPS | What the text says |
|---|---|---|
| Collections | Balances for private-pay services, promissory notes, pending copayments, notice that an installment is due | Articles 1 to 4, 6 and 7 apply. For Superfinanciera, due date reminders meant to prevent late payment are collections (Concepto 2023093237-003). |
| Advertising | Checkup packages, private-pay services, discounts, a new specialty offered so the patient will use it | Article 5 applies the law on the same terms: article 3 hours, authorized channels and a simple mechanism to stop receiving messages. |
| Information | Reminder or confirmation of an appointment already booked, change of site or hours | The text does not mention it. |
Are appointment reminders covered by the law? The text does not settle it. By its purpose, a reminder of an appointment the patient requested is neither collections nor advertising, and article 8 exempts contacts made to send information requested by the consumer, but it does not mention medical appointments. In the opinions and circulars reviewed for this page, we found no statement on appointment reminders. What is clear is that a reminder that adds a promotion or a payment request is no longer purely informational. Invitations to health promotion and maintenance programs (programas de promoción y mantenimiento) do not appear in the law either; depending on how they are worded, they can be read as information or as a message that induces the use of a service, which is the definition of advertising Superfinanciera uses.
What an IPS must do to comply
- Classify each campaign as collections, commercial or informational before launching it, and do not mix content in the same message.
- Record the channels each patient authorizes (article 2) and, for advertising, their prior authorization. The processing of that data is also governed by Ley 1581 de 2012 (Law 1581 of 2012), which treats health data as sensitive.
- Respect the hours of Monday to Friday from 7:00 a.m. to 7:00 p.m. and Saturdays from 8:00 a.m. to 3:00 p.m., using the Colombian public holiday calendar.
- Count contacts per person, not per campaign: in collections and in advertising, one contact a day and a single channel per week, adding up all campaigns and all agents.
- Keep the authorizations for other hours in a separate document made after the contract.
- Check the CRC Registro de Números Excluidos before sending advertising, as the SIC indicates in its Circular Externa 001 de 2024 (External Circular 001 of 2024), and offer a simple way to opt out (article 5, paragraph 2).
- In collections, do not contact personal references (article 4), do not ask the reason for nonpayment (article 7) and do not visit the patient's home or workplace (article 6).
- Keep evidence of each contact and of each decision not to contact.
How Omcall handles it
The Omcall dialer, the campaign module of the call center for IPS, runs every contact through a policy engine before dialing or sending. Each campaign has a category (collections, commercial, reminder, survey, informational or health program) with its own time window and limits:
- for collections and commercial campaigns, it applies the legal time window, blocks Sundays and Colombian public holidays and lets the IPS shorten the hours, never extend them on its own;
- it counts contacts per person across campaigns: per day, per week, per channel and with a single channel per week; in collections, by default, unanswered attempts also count;
- it checks exclusions, do-not-call lists (you can import numbers), consent for commercial messages and authorizations for other hours with their evidence;
- it stores each decision with the rule applied and the next permitted time, in a log that cannot be edited.
Campaigns go out by voice and WhatsApp, with people or with AI agents, and the engine also evaluates SMS and email. If you use another dialer, it can query the same policy through the API. Appointment reminders that help reduce no-shows and WhatsApp confirmations are a category of their own: you can treat them as informational or apply the Law 2300 hours to them with a single setting.
Time windows, limits and how reminders are treated are configurable parameters. The initial configuration is a proposal pending legal review, and the final decision belongs to your IPS. How we process data is described in our privacy policy. In the demo we review your current campaigns.
Related regulations
- Statutory Law 1581 of 2012: health data is sensitive (article 5) and its processing requires prior, informed authorization (article 9).
- Statutory Law 1266 of 2008: framework of powers for the penalties in article 9.
- External Circular 001 of 2024 of the SIC: powers of the Delegatura para la Protección de Datos Personales (the SIC's personal data protection division) and checking the Registro de Números Excluidos.
- Resolución 1552 de 2013 (Resolution 1552 of 2013): assignment and timeliness (the wait between the request and the assigned date) of the appointments you later send reminders for.
This content is for information only and does not constitute legal advice. The rule in force is the one published in the Diario Oficial; always check the official text and its updates. This page is a translation: the Spanish text published by the authority is the one that applies.
Frequently asked questions
Yes, when the IPS collects payments or advertises. Article 1 covers all natural and legal persons that carry out collection efforts directly, through third parties or by assignment of the obligation, without distinguishing by sector. Article 5 extends the law to producers and suppliers of goods and services, private or public, that send advertising messages. The law does not mention the health sector, so an IPS's messages that are neither collections nor advertising fall into an area the text does not clarify.
The text does not settle it. The law regulates collections and advertising messages, and by its purpose, a reminder of an appointment the patient requested is neither of the two. Article 8 exempts contacts made to send information requested by the consumer, but it does not mention medical appointments. If the reminder includes a promotion or a payment request, it is no longer purely informational. The prudent course is to define how you treat reminders with your legal advisor and keep that decision documented.
Monday to Friday between 7:00 a.m. and 7:00 p.m., and Saturdays between 8:00 a.m. and 3:00 p.m. Article 3 rules out any contact on Sundays and public holidays. Contact at other hours is allowed only if the patient expressly requests it, in a document that is separate from the contract governing the relationship and made after it was signed. The same hours apply to advertising calls and messages, under paragraph 3 of article 5.
Once a day, and through a single channel per week. Article 3 says that, once direct contact has been established, the consumer cannot be contacted through several channels within the same week or more than once on the same day. For the Superintendencia Financiera, in Concepto 2023111476-001, that contact exists from the moment the message is sent or the call is made to an authorized channel, with no need for any interaction with the person.
Yes, with conditions. Article 5 applies the law on the same terms to advertising messages by SMS, messaging apps, email and calls: only during the article 3 hours, through authorized channels and with a quick mechanism to stop receiving them. In its External Circular 001 of 2024, the Superintendencia de Industria y Comercio also stated that suppliers must check the CRC Registro de Números Excluidos before sending advertising or commercial content.
The Superintendencia Financiera and the Superintendencia de Industria y Comercio. Article 9 says that noncompliance is penalized according to the framework of powers in Statutory Law 1266 of 2008. Under the SIC's External Circular 001 of 2024, its Delegatura para la Protección de Datos Personales handles complaints about contacts through unauthorized channels or through more than one channel, in collections and in advertising, when the right of habeas data is also affected.
Omcall is billed as a license per agent per month plus AI and channel usage, such as voice minutes and messages. The price depends on how many people handle contacts, how many sites and channels you connect and which AI agents you turn on, so it is sized in the demo with your actual operation, and that yields a specific figure, not a range. IPS that join as design partners get a 30-day pilot at no cost. You can book the demo.
Official source
Ley 2300 de 2023, Congress of ColombiaInformational content, not legal advice. The regulation in force is the Spanish text published by the competent authority.