HIPAA-Compliant Email Marketing for Medical Practices

Most practices get into trouble not with the newsletter itself, but with where the patient list lives and what the email quietly reveals. Brand Lift 360 configures and manages KloudMD, a HIPAA-compliant patient follow-up platform with a signed BAA for covered services, so practices can run patient email and text from one system built for health data. This article is general information, not legal advice. Have your compliance lead or attorney review your specific setup.

When does an email to patients involve PHI?

Protected health information (PHI) is health information that identifies a person and relates to their health, their care, or payment for their care. The HHS summary of the Privacy Rule says this includes information about "the provision of health care to the individual" that identifies the person or could reasonably be used to identify them.

That definition is wider than most practice owners expect. A diagnosis or a lab result is obviously PHI. But a list of your patients' names and email addresses is also PHI, because being on that list tells anyone who sees it that each person received care from you. HHS lists email addresses, names, phone numbers, full-face photos and IP addresses among the 18 identifiers that must be removed before data counts as de-identified.

In practice, the moment you export patients from your EMR or booking system into an email tool, that tool is holding PHI. A general newsletter list of people who signed up on your website, and who may never have been patients, is a different situation. If the two are mixed, treat the whole list as patient data.

Can a practice email patients without encryption?

Yes, with limits. HHS says in its FAQ on emailing patients that "the Privacy Rule does not prohibit the use of unencrypted e-mail for treatment-related communications" between providers and patients. It also says other safeguards should be applied, such as limiting the amount or type of information in the message.

HHS goes further on patient choice. If a provider thinks a patient may not understand the risks of unencrypted email, the provider can warn the patient about those risks and then "let the patient decide whether to continue e-mail communications." If a patient finds unencrypted email unacceptable, the practice should offer another way to communicate, such as a more secure electronic method, mail or phone.

The Security Rule, the part of HIPAA that covers electronic health data, follows the same logic. HHS states that the Security Rule "does not expressly prohibit the use of email for sending e-PHI", and that e-PHI can travel over an open network "as long as it is adequately protected." Practices are expected to evaluate the risk, choose safeguards, and document that decision.

The takeaway: record each patient's email preference and risk acknowledgment at intake, and keep marketing emails free of anything clinical.

When does a practice email count as "marketing" under HIPAA?

This is where HIPAA's definition differs from everyday language. Under 45 CFR 164.501, marketing means a communication about a product or service "that encourages recipients of the communication to purchase or use the product or service." If a communication meets that definition, the practice generally needs the patient's written authorization before using their PHI to send it.

The rule then carves out several exceptions. A communication is not HIPAA "marketing" when it is made:

• To describe a health-related product or service that is provided by the practice itself.
• For the patient's treatment, including case management, care coordination, or recommending other treatments, providers or settings of care.
• As a refill reminder about a drug currently prescribed for the patient, as long as any payment the practice receives is reasonably related to the cost of sending it.

The catch is money from someone else. The treatment and own-services exceptions do not apply when the practice receives financial remuneration for making the communication. The rule defines financial remuneration as "direct or indirect payment from or on behalf of a third party whose product or service is being described." HHS marketing guidance adds that disclosing PHI so another company can promote its own product counts as marketing, and that a covered entity may not sell PHI to a third party for that party's own purposes.

For a wider view of where these lines fall across ads, reviews and websites, see our guide to HIPAA-compliant marketing for medical practices.

Do you need a BAA with your email platform?

Yes, if the platform holds your patient list. A Business Associate Agreement (BAA) is a contract in which a vendor that handles PHI on your behalf agrees to protect it and limit how it is used. HHS explains that covered entities generally need a written contract with each business associate.

HHS cloud computing guidance is direct about software vendors: when a practice uses a cloud service provider to handle electronic PHI, "the CSP is a business associate." HHS adds that this is true "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." An email platform that stores patient names and emails falls into this category.

Not every email marketing tool will sign a BAA. Check the vendor's terms before you upload a single patient record, and keep the signed BAA on file. Our explainer on what a Business Associate Agreement is covers what the contract should include, and our HIPAA-compliant CRM checklist covers the questions to ask any vendor that holds patient data.

What does CAN-SPAM require for practice emails?

CAN-SPAM is the federal law, enforced by the Federal Trade Commission (FTC), that sets rules for commercial email. It applies alongside HIPAA. The FTC compliance guide lists these core requirements:

• Accurate header information. The From, To and Reply-To fields must identify who sent the message.
• Honest subject lines. The subject must not be deceptive about what is inside.
• Identify the message as an ad. Promotional emails must clearly disclose that they are advertising.
• A valid physical postal address. A street address, registered P.O. box or registered private mailbox.
• A clear opt-out. An easy way to stop future marketing email, which must keep working for at least 30 days after sending.
• Honor opt-outs within 10 business days. No fee, and no request for information beyond an email address.
• Responsibility for vendors. If an agency or platform sends on your behalf, your practice can still be held responsible.

The FTC states that each separate email in violation of CAN-SPAM is subject to penalties of up to $53,088 (the inflation-adjusted figure as of January 2024). Messages whose primary purpose is transactional or relationship-based, such as confirming a booked appointment, are largely exempt from these requirements but must still have accurate routing information. The FTC reads that exemption narrowly, so a reminder that also pushes a promotion should be treated as commercial.

What should never go in a subject line or preview text?

Subject lines and preview text show up on lock screens, shared family tablets and work inboxes before the patient opens anything. Following the HHS advice to limit the type of information sent in unencrypted email, keep these out of subject lines and previews:

• Any diagnosis, condition or procedure name tied to the reader ("Your Botox follow-up," "Post-op check for your rhinoplasty").
• Test results, medication names, or references to a past visit's reason.
• Weight, age-related or body-specific language that implies the reader's health status.
• The patient's name combined with any of the above.

Safer subject lines talk about the practice, not the patient: "New hours at our Roseville office," "Spring treatment menu is here," "A note from your care team." Those still pass the CAN-SPAM honesty test because they describe what is in the email.

Is segmenting your list by treatment a use of PHI?

Yes. Sorting patients into a list called "filler patients" or "bariatric post-op" uses information about the care each person received, which is exactly what the HHS definition of PHI covers. That does not make segmentation forbidden. Telling filler patients about a new filler option your practice offers generally falls under the own-services exception described above.

It does change where and how the segmentation happens. Treatment-based segments should be built inside a platform covered by a BAA, never in a spreadsheet emailed to an outside designer or uploaded to a non-HIPAA tool. Segment names and tags should be internal only, and the email itself should not reveal why the reader received it. A segment called "rhinoplasty 2025" is fine inside your system; a subject line that says "Because you had rhinoplasty" is not.

Paid ad audiences are a separate risk. Uploading a treatment segment to an ad platform to build a matching audience discloses PHI to that platform, which is why it belongs in a conversation with your compliance lead first.

HIPAA-Compliant Email Marketing at a Glance

Common Questions About HIPAA-Compliant Email Marketing

Is a regular email marketing tool HIPAA compliant?

An email tool is only usable for patient data if the vendor will sign a Business Associate Agreement with your practice. Check the vendor's current terms in writing; if it will not sign one, patient lists should not be uploaded there.

Do I need patient consent to send a practice newsletter?

HIPAA generally does not require written authorization for emails describing your own practice's services. CAN-SPAM still requires an opt-out in every promotional email, and HHS guidance supports confirming each patient's email preference and their acceptance of unencrypted email risk.

Are appointment reminder emails covered by CAN-SPAM?

The FTC treats messages that confirm or facilitate a transaction the recipient already agreed to as transactional, which are largely exempt. If the reminder also promotes a service, the FTC may treat it as commercial, so add an opt-out and your address.

Can I send before-and-after photos in a marketing email?

Full-face photos are one of the 18 HIPAA identifiers, so a recognizable before-and-after photo is PHI. Get the patient's written authorization before it appears in any marketing, and confirm the form with your compliance lead.

What is the penalty for breaking CAN-SPAM?

The FTC states that each separate email in violation can bring penalties of up to $53,088, a figure updated for inflation in January 2024.

What to Do This Week

Open the email platform your practice uses today and find out, in writing, whether the vendor has signed a BAA with you. If the answer is no and patient names are in it, stop sending to that list until you move it to a platform that will sign one. Then pull your last three campaigns and check each one for an honest subject line, a working unsubscribe link, your physical address, and a subject line and preview that would not embarrass a patient if a coworker saw it. If you want patient email and text follow-up running in one HIPAA-ready system, KloudMD is included in both Brand Lift 360 managed marketing plans: Growth from $1,499 a month and Authority from $2,999 a month.

Sources

• U.S. Department of Health and Human Services, Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients?, content last reviewed July 26, 2013, accessed November 3, 2026. Supports unencrypted email being permitted with safeguards, warning patients of risk, and offering alternatives.
• U.S. Department of Health and Human Services, Does the Security Rule allow for sending electronic PHI (e-PHI) in an email or over the Internet?, content last reviewed July 26, 2013, accessed November 3, 2026. Supports the Security Rule position on email and adequate protection.
• U.S. Department of Health and Human Services, Marketing, content last reviewed July 26, 2013, accessed November 3, 2026. Supports the marketing definition, exceptions, authorization requirement and the restriction on selling PHI.
• Electronic Code of Federal Regulations, 45 CFR 164.501 Definitions, accessed November 3, 2026. Supports the regulatory text of "marketing" and "financial remuneration."
• U.S. Department of Health and Human Services, Summary of the HIPAA Privacy Rule, accessed November 3, 2026. Supports the definition of protected health information.
• U.S. Department of Health and Human Services, Guidance Regarding Methods for De-identification of Protected Health Information, accessed November 3, 2026. Supports the 18 identifiers, including names, email addresses, IP addresses and full-face photos.
• U.S. Department of Health and Human Services, Business Associate Contracts, published January 25, 2013, accessed November 3, 2026. Supports the definition of a business associate and the written contract requirement.
• U.S. Department of Health and Human Services, Guidance on HIPAA and Cloud Computing, content last reviewed December 23, 2022, accessed November 3, 2026. Supports cloud and software vendors handling ePHI being business associates, even with encrypted data.
• Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business, accessed November 3, 2026. Supports the CAN-SPAM requirements, the 10 business day opt-out rule, the $53,088 per-email penalty and the transactional message exemption.