HIPAA-compliant email marketing: rules, consent and platforms

When a practice email is 'marketing' under HIPAA

The Privacy Rule defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service" (45 CFR 164.501 (opens in a new tab)). Using patient information to send marketing requires each patient's written authorization (45 CFR 164.508(a)(3) (opens in a new tab)).

The definition then excludes several kinds of communication, including describing "a health-related product or service … that is provided by … the covered entity making the communication," and communications about the patient's own treatment. Those exclusions vanish when the practice "receives financial remuneration in exchange for making the communication" from a third party whose product is described.

All products and practices in the table are fictional.

Emails that don't need authorization: your own services, reminders, care updates

Most of what a practice wants to send fits an exclusion:

• Your own services. New providers, extended hours, a new location, a service you now offer, insurance plans you accept.
• Reminders and care updates. Appointment reminders, recall notices ("you're due for a cleaning"), post-visit instructions and refill reminders, which relate to the patient's own treatment.
• General health information. HHS explained in the 2013 Omnibus Final Rule (opens in a new tab) that communications "promoting health in general and that do not promote a product or service from a particular provider," such as encouraging routine screenings, are not marketing.

Two cautions. First, "no authorization needed" doesn't mean "no HIPAA." The list you send to is still PHI, so the platform still needs a BAA. Second, care updates often carry clinical details. Keep reminders minimal ("You have an appointment on Tuesday at 10:00") and leave diagnoses out of subject lines.

Patients can also ask to be contacted differently. A covered provider "must accommodate reasonable requests by individuals to receive communications of protected health information … by alternative means or at alternative locations," and may not require an explanation (45 CFR 164.522(b) (opens in a new tab)).

Why a patient email list is PHI

HIPAA protects information that relates to "the provision of health care to an individual" and identifies them (45 CFR 160.103 (opens in a new tab)). A list of your patients' names and emails tells anyone who sees it that each person was treated at your practice. That's PHI before you add a single tag.

Segments raise the stakes. A list titled "Botox patients," "diabetes recall" or "post-op knee" pairs identity with a procedure or condition. If the platform is breached, or a staff member exports the wrong segment, the exposure is much more serious than a general newsletter list.

That's why the vendor matters. A company that stores your patient list and sends email on your behalf is maintaining and transmitting PHI, which makes it a business associate. Read what a BAA covers before you sign one.

Do Mailchimp, Constant Contact and Klaviyo sign a BAA?

These are the questions practices search: "hipaa compliant email marketing platforms" (90 a month), "is mailchimp hipaa compliant" (70), "is constant contact hipaa compliant" (40) and "is klaviyo hipaa compliant" (20) (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). Here is what each vendor's own pages said when we checked.

The practical answer: none of these three is a safe home for a patient list on the terms we could read. For any vendor, ask sales for a signed BAA before uploading anything, and treat silence as a no. For day-to-day messages to individual patients, see HIPAA-compliant email for everyday use.

CAN-SPAM and consent: the non-HIPAA rules

The federal CAN-SPAM Act applies to commercial email whether or not HIPAA does. The FTC's compliance guide (opens in a new tab) lists the core requirements:

1. Don't use false or misleading header information.
2. Don't use deceptive subject lines.
3. Identify the message as an ad.
4. Tell recipients where you're located.
5. Tell recipients how to opt out of future marketing email.
6. Honor opt-outs promptly: within 10 business days, with an opt-out mechanism that works for at least 30 days after you send.
7. Monitor what others do on your behalf.

Each violating email can cost up to $53,088, per the FTC guide. Transactional or relationship messages, such as those that facilitate "an already agreed-upon transaction," are exempt from most requirements; when a message mixes content, "the primary purpose of the message is the deciding factor." A reminder with a promotion stacked on top may be judged commercial.

States can add their own rules on email and on health data, so check yours. Clinics in Canada follow a different, consent-based regime; see CASL for Canadian clinics.

A safe newsletter workflow for a practice

1. Pick a platform that signs a BAA for email marketing, and get the BAA countersigned before importing anyone.
2. Import only what you need: first name and email. No dates of birth, diagnoses or insurance details.
3. Avoid condition-based segments unless your privacy officer approves each one; use location or "all patients" instead.
4. Write about your own services and general health, never a third party's product, unless you have authorizations (see when you need authorization).
5. Accept no sponsor money for newsletter content.
6. Include the CAN-SPAM basics: your address, a clear ad identification where the email is promotional, and a working unsubscribe link.
7. Process opt-outs within 10 business days and keep a suppression list.
8. Check subject lines and previews for anything clinical before sending.
9. Limit and log access: only named staff can export or send.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Where Medfy fits. Medfy does not send email or SMS marketing. What it provides is the intake side: HIPAA-compliant website forms whose submissions land in an access-controlled patient CRM and inbox, with patient information stored in separate, encrypted HIPAA databases in the US or Canada. Compare patient CRM options, read how Medfy handles patient data, see the wider HIPAA marketing rules, or get a free marketing audit of your website, SEO, local listing, AI visibility, social and ads.

Frequently asked questions

Is Mailchimp HIPAA compliant?

Mailchimp's terms don't support PHI. Its Standard Terms of Use, updated October 10, 2025, leave HIPAA suitability to the customer and say Mailchimp won't be liable if the service doesn't meet those requirements, and its Acceptable Use Policy bars importing sensitive personal information regulated by law. Neither page offers a BAA. Keep patient lists out of Mailchimp unless Intuit signs a BAA in writing, and confirm with your compliance officer or attorney.

Can a practice send a newsletter to patients without authorization?

Usually, if it only describes your own services, shares general health tips or covers practice news, and no third party pays you to send it. Those fall outside HIPAA's marketing definition. You still need a platform that will sign a BAA, because the mailing list itself is PHI, and CAN-SPAM requires an opt-out in promotional email. Have your compliance officer or attorney review the first issue.

Do appointment reminder emails need patient consent?

HIPAA doesn't require a signed authorization: a reminder about the patient's own appointment relates to their treatment, which the marketing definition excludes. Patients can ask you to contact them another way, and you must accommodate reasonable requests. Keep reminders free of diagnosis details, send them through a system covered by a BAA, and confirm your state's rules with your compliance officer or attorney.

Is an email list of patients considered PHI?

Yes. A list of names and emails held by your practice shows that each person received care from you, which is information about the provision of health care to an identifiable individual. Segmenting it by condition, procedure or medication makes it more sensitive. Any vendor that stores or sends to that list on your behalf is a business associate and needs a BAA. Confirm specifics with your compliance officer or attorney.