Most medical practices have been quietly running email marketing programs on platforms that were never designed for healthcare data. The programs work. The compliance is not what most practice owners assume.
Email is one of the most quietly important channels in healthcare marketing. It is cheap to operate, drives meaningful conversion, and supports patient retention in ways no other channel matches. Most medical practices have been running email marketing programs for years. Many of those programs are operating on infrastructure that was never appropriate for healthcare data.
The gap is not visible day to day. Emails go out. Patients receive them. The campaigns produce results. The compliance exposure sits in the background, accumulating, until something — a breach, a complaint, an audit, a lawsuit — surfaces it. By that point, the volume of accumulated exposure is far larger than it would have been if the practice had built the program on appropriate infrastructure from the start.
Email marketing for medical practices is achievable and effective. It just has rules that most general-purpose marketing agencies do not engage with carefully, and most general-purpose email platforms are not built to handle.
The Three Distinct Categories of Email
The first useful step is to distinguish between three categories of email that medical practices typically send. Each has different rules and different infrastructure requirements.
Marketing emails are communications designed to drive interest in the practice’s services among prospects or to encourage repeat engagement among past patients. They are commercial in nature and governed primarily by general marketing rules — the CAN-SPAM Act federally, plus state-level rules where applicable.
Operational emails are communications that support the practice’s relationship with existing patients — appointment confirmations, billing notices, follow-up instructions, patient portal notifications. These are not marketing in the regulatory sense, but they often contain PHI and therefore require BAA-covered infrastructure regardless of how they are characterized.
Mixed-purpose emails contain elements of both. A newsletter that includes a clinical health tip alongside a marketing offer for a service is a mixed-purpose communication, and the strictest applicable rules apply to the whole email.
The first failure mode in healthcare email marketing is treating all three categories the same. The second is sending the wrong category through the wrong infrastructure.
Where Most Practices Are Currently
A common pattern across medical practices today looks something like this. A general-purpose email marketing platform — one of the well-known consumer or B2B email platforms — is in use for sending marketing emails to a list that includes both past patients and prospective patients. The platform may or may not have a BAA in place. Operational emails go through a different system, perhaps the EHR’s built-in messaging or a patient portal.
The exposure usually shows up in two places. The marketing platform’s list itself is a list of patients of the practice — which is PHI — sitting in an environment that may not have appropriate BAA coverage. And the marketing emails themselves sometimes drift into mixed-purpose territory, addressing clinical topics or referencing services in ways that, combined with the recipient’s status as a patient of the practice, create disclosures the infrastructure was not designed to handle.
This pattern is so widespread that most practice owners do not realize there is anything unusual about it. It is the default state of healthcare email marketing across thousands of practices.
What CAN-SPAM Requires and Does Not Require
CAN-SPAM, the federal commercial email law, applies to marketing emails. Its requirements are well-defined but often misunderstood.
Senders must identify themselves accurately, both in the from-line and in the body. The email must include a valid physical postal address for the sender. Commercial emails must be identified as advertisements, although this can be done implicitly through the obvious nature of the content. Recipients must have a clear way to opt out, and opt-out requests must be honored within ten business days.
CAN-SPAM does not require explicit opt-in consent before sending commercial email. A practice can lawfully email past patients with marketing content, provided the email meets the other requirements and the practice honors opt-out requests when they come in.
What CAN-SPAM does not address is HIPAA. The two regulatory frameworks operate independently. A communication can be CAN-SPAM compliant and still constitute an impermissible disclosure under HIPAA, because the email’s existence reveals that the recipient is a patient of the practice and the platform processing the email does not have a BAA in place.
What HIPAA Adds
HIPAA imposes a separate set of considerations on top of CAN-SPAM.
The list of email addresses being marketed to is, in most practice contexts, a list of patients. That list, on its own, is PHI — the combination of an identifier and the implicit health context of “this person is a patient of this practice.” The infrastructure storing and processing that list needs to be BAA-covered, or the list needs to be configured in a way that removes the patient-status implication.
Email content that addresses the recipient’s specific clinical history, prior treatments, or health status increases the sensitivity considerably. A generic newsletter to a general audience is one thing. A targeted message to patients who had a specific procedure last year is another, and the targeting itself is PHI even before the message is sent.
Marketing emails to current patients that include any clinical recommendations, treatment offers, or health-related content require, in many configurations, prior authorization separate from the patient’s general treatment consent. HIPAA’s marketing provisions distinguish between communications about the practice’s own services to existing patients — which are generally permissible without separate authorization — and communications that promote third-party products or services, which require authorization.
The lines here are not intuitive, and they are exactly the kind of question that benefits from counsel review. The practice’s own counsel can tell you, for your specific patient communications, where authorization is required and where it is not.
Building the Email Program Properly
A defensible healthcare email marketing setup has several characteristics.
The email platform operates under a BAA covering the patient list it processes. This usually means the platform is healthcare-specific, on an enterprise tier of a general platform that signs BAAs, or integrated with the practice’s CRM in a way that keeps the list inside BAA-covered infrastructure and uses the email platform only for sending.
Lists are segmented carefully. A general marketing list for prospects who have not yet become patients can be operated on more flexible infrastructure than a patient list. The two should not be combined, because combining them imports the patient list’s sensitivity into the prospect list’s infrastructure.
Email content is designed to fit clearly within either the marketing category or the operational category. Mixed-purpose emails are minimized, and where they are necessary, the entire email is treated as the stricter category.
Opt-out is hanled cleanly and quickly. CAN-SPAM gives ten business days; the more careful practice is to process opt-outs immediately, and to make sure opt-outs from marketing do not inadvertently disable operational communications the patient still needs to receive.
Personalization features that would expose more information than necessary in the email itself are used with restraint. “Hi [Patient Name], we noticed you recently came in for [Specific Procedure]” is a personalization pattern that creates exposure if the email is intercepted, displayed on a shared device, or forwarded by the recipient. The same message can usually be conveyed effectively with less specific framing.
Lists and Acquisition
Where the email list came from matters as much as how it is managed.
Lists built from the practice’s own patient base have one set of considerations. Lists obtained from external sources — rented, purchased, or acquired through partnerships — have another set of considerations, and most of them are unfavorable. Bought email lists are rarely appropriate for healthcare use, both because the list’s recipients have not opted into receiving communication from the practice and because the data provenance is rarely traceable to a basis the practice could defend.
Building the list organically, through patient relationships and consent at intake, is slower and produces a smaller list. It produces a list the practice can use confidently across years of marketing, which the bought list cannot match.
The Question Worth Asking
If a practice owner takes one action after thinking about email marketing, the highest-leverage question to ask is simple. Where does our email marketing list live, who has access to it, and does the platform that stores it have a BAA with us?
Most practices have never explicitly asked this question. The answer is often informative. When the answer is good, the practice has confirmed something valuable and can move on. When the answer is concerning, the practice now has visibility into a gap that was previously invisible, and can address it before it becomes a problem.
