Email marketing for healthcare: what HIPAA counts as marketing, what CAN-SPAM requires, and the emails hospitals and practices should send
A working guide for hospitals, medical practices and medical device companies: the patient emails that are not marketing under HIPAA, the ones that need authorization, the CAN-SPAM basics, and example emails that patients actually open.
Published by AI Knows Us · Updated 21 October 2026
Email marketing for healthcare works best when it is mostly service, not promotion: appointment reminders, screening and recall prompts, a clear monthly newsletter, and announcements about your own services. Under HIPAA, many of these emails are not "marketing" at all, because the rule excludes communications about a patient's treatment and about the provider's own health services. Emails that promote a third party's product in exchange for payment, or that fall outside those exceptions, need the patient's written authorization. Separately, any email whose primary purpose is commercial must follow CAN-SPAM. Sort every email you plan into one of those boxes before you write a word.
What HIPAA treats as marketing
The HIPAA Privacy Rule defines marketing in 45 CFR 164.501, read in the eCFR on 21 October 2026. Marketing means "to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service". The definition then lists communications that are not marketing, unless the covered entity is paid by a third party to make them:
- Communications for the treatment of an individual, including care coordination or recommending "alternative treatments, therapies, health care providers, or settings of care".
- Communications that "describe a health-related product or service" that is "provided by" the covered entity making the communication.
- Refill reminders about a drug currently prescribed for the individual, where any payment received is "reasonably related" to the cost of sending it.
Where an email is marketing, 45 CFR 164.508(a)(3) says a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing", with narrow exceptions for face to face communications and promotional gifts of nominal value. If a third party pays for the communication, the authorization must say so.
In practice, for a hospital or practice:
| Usual box | |
|---|---|
| Appointment reminder, recall for a check up, post visit instructions | Treatment communication |
| "Our new sleep clinic is now open" to existing patients | Describes the provider's own health service |
| Newsletter with health tips and your own services | Mostly your own services; review any third party content in it |
| Promotion of a drug maker's or device maker's product, paid for by them | Marketing that needs authorization stating the payment |
| Sharing your patient list with another company for its emails | Needs authorization; treat as off limits without legal sign-off |
This is general information, not legal advice. Your privacy officer should approve the category of each recurring email.
What CAN-SPAM adds
The CAN-SPAM Act covers commercial email from any sender, not only healthcare. The FTC rule at 16 CFR 316.3 decides whether a message is commercial by its "primary purpose". A message that is only transactional or relationship content, such as an appointment confirmation, is not treated as commercial. A promotional email is. Mixed messages are judged on the subject line and on what comes first in the body.
For commercial emails, the Act at 15 U.S.C. 7704 requires:
- No subject line that would mislead a recipient about the contents.
- A working unsubscribe mechanism that keeps working for at least 30 days after sending.
- Honouring an opt-out within 10 business days.
- Clear identification that the message is an advertisement, unless the person gave prior affirmative consent.
- A valid physical postal address.
The FTC rule at 16 CFR 316.5 also says you cannot charge a fee or ask for more than an email address and preferences to process an unsubscribe.
The email platform question
Choose the platform with privacy in mind. If it will hold patient names and email addresses taken from your records, ask your privacy officer whether a business associate agreement is needed, and confirm the vendor will sign one before you upload anything. Keep clinical detail out of subject lines, link text and URLs, because those are stored and logged in many places. A subject line like "Your diabetes check is due" tells anyone who sees the inbox something private. "Time to book your next check up" does not.
For the deliverability side, domain authentication, list hygiene and the flows worth building, our guide to email marketing deliverability and list health applies to healthcare senders too.
Healthcare email marketing examples that work
The recall email. Subject: "Time to book your annual check up". One sentence on why it matters, the clinician's name, and a single booking button. No other content.
The new service announcement. Subject: "Same day physiotherapy now at our Main Street clinic". What it is, who it is for, the clinician, insurance accepted, and how to book.
The monthly newsletter. One seasonal health topic written or reviewed by a named clinician, one practice update such as new hours, and one link to book. Short enough to read on a phone.
The referring physician update for hospitals. Sent to doctors, not patients: new specialists, referral process changes, outcomes data you are allowed to publish. It should carry no patient information at all, and CAN-SPAM applies to the promotional parts.
Email marketing for medical device companies
Device makers mostly email clinicians, purchasing teams and distributors, so the main rules are CAN-SPAM and, in other countries, local consent law. Every product claim in an email is advertising and should go through the same regulatory and medical review as your printed material. If a hospital or practice sends a patient email that promotes your device and you pay for it, that hospital needs patient authorization that discloses the payment under 164.508(a)(3), so do not propose those programmes without its privacy team involved.
Healthcare email marketing best practices
- Separate lists: patients, referring clinicians, donors and job candidates never share one list.
- Name the clinician in every clinical email. People trust a person more than a logo.
- Write at a plain reading level, and offer the main languages your patients speak.
- Measure booked appointments from each email in your own scheduling system, not only opens.
- Review every template once a year with the privacy officer.
Questions about email marketing for healthcare
Is email marketing HIPAA compliant?
It can be. Many patient emails, such as reminders and announcements of your own services, are not marketing under 45 CFR 164.501. Use a platform with a business associate agreement where needed, and keep clinical detail out of subjects and links.
Do patients have to opt in to healthcare emails?
For HIPAA marketing, authorization is required under 164.508(a)(3). For treatment and own service communications it is not, though offering an easy unsubscribe is good practice and CAN-SPAM requires one on commercial emails.
Can doctors send newsletters to patients?
Yes. A newsletter about your own services and general health information usually falls within the exceptions. Get your privacy officer to confirm the content mix, especially if it mentions any third party product.
What should a healthcare email subject line avoid?
Any condition, test or treatment specific to the reader, and anything misleading about the contents, which CAN-SPAM prohibits on commercial email.
How often should a medical practice email patients?
Reminders when care is due, plus a newsletter no more than monthly works for most practices. Watch unsubscribe rates and cut frequency if they rise.
When the patient asks an assistant instead of opening the email
A patient who gets your new service email may still check with ChatGPT before booking: "is the sleep clinic at this hospital any good" or "who does same day physio near me". The answer names providers from listings, reviews and service pages, not from your email. It is worth asking those questions for each service you promote by email and seeing whether you come back. AI Knows Us puts patient questions like these to the main assistants and shows which providers are named, so the services you announce to your list are also the ones a patient finds when they ask.