Email marketing for practices: CAN-SPAM and HIPAA

Email is one of the few marketing channels a practice fully owns. The list is yours, there is no ad auction, and the people on it already know you. It is also a channel where two separate federal rule sets meet: CAN-SPAM, which governs commercial email from any business, and HIPAA, which governs how a covered practice uses information about its patients. A practice that plans for only one of them can miss what the other requires.

This guide explains how each law sorts the emails a practice sends, what a promotional email has to contain, when HIPAA treats an email as marketing, what to check about your email platform and patient list, the safeguards HHS describes for email with patients, and the sender rules Gmail now applies. It then sorts the parts of a typical patient newsletter, and ends with ideas for what to send and a checklist. When a birthday or holiday email with a coupon counts as commercial is covered in our guide to birthday and holiday messages to patients. Which patient data belongs in the CRM or automation tool that sends these emails is covered in our guide to patient data in a practice CRM. The DNS records that get those emails delivered, SPF, DKIM and DMARC, are covered in our guide to email authentication for practices. Running unsubscribes, text stops and do-not-call requests from one list is covered in our guide to patient opt-outs for email, text and calls. Buying or renting contact lists raises separate questions; see buying mailing lists for a medical practice.

This is general information, not legal advice. It covers US federal rules only. State laws can add requirements, and your own facts matter, so check with your privacy officer or a health care attorney before a campaign that uses patient information. The section on patient newsletters was added on November 1, 2026, from 45 CFR 164.501 and 164.508(a)(3) and 16 CFR 316.1 and 316.3, in the eCFR version up to date as of October 29, 2026. We do not quote open rates or results, because we have no reliable public source for them for practices.

Two laws, two different questions

CAN-SPAM and HIPAA look at the same email from different angles, and an email can be fine under one and a problem under the other.

CAN-SPAM asks: is this email commercial? It applies to any business sending email whose primary purpose is to advertise or promote a commercial product or service. The FTC enforces it, and it applies whether you send one email or ten thousand.
HIPAA asks: does this email use patient information, and is it marketing? The Privacy Rule controls how a covered practice uses protected health information, including a list of its patients, to send communications that encourage people to buy or use a product or service.

An email announcing that your dental office now offers clear aligners, sent to your patient list, is a good example. Under HIPAA it generally falls outside the definition of marketing, because it describes a health-related service the practice itself provides. Under CAN-SPAM it is still a commercial email, because its purpose is to promote a service, so it needs an opt-out link, a postal address and the other requirements below.

Which practice emails count as commercial under CAN-SPAM

The test is the primary purpose of the message. The FTC’s rule at 16 CFR 316.3 sorts email content into three kinds: commercial content that advertises or promotes a product or service, transactional or relationship content, and other content.

Transactional or relationship content is a short, specific list. For a practice, the relevant categories are content that facilitates, completes or confirms a transaction the recipient already agreed to, and notices about a change in the terms of an ongoing relationship or account. An appointment confirmation, a reminder for an appointment the patient booked, or a notice that your billing address has changed fits these categories. The FTC says these categories are read narrowly, so you should not assume that each email you send to existing patients is transactional.

When one email mixes commercial content with transactional content, the rule treats it as commercial if a recipient reasonably reading the subject line would conclude it promotes a product or service, or if the transactional part does not appear, in whole or in substantial part, at the beginning of the body. In practice:

An appointment reminder with a short line about your new evening hours at the end is likely transactional.
An email with the subject “Your appointment next week” that opens with a whitening special and mentions the appointment at the bottom is likely commercial, even though the subject sounds transactional. The FTC’s own guide uses a nearly identical example.
A monthly newsletter with health tips and a featured service is judged on how a reader would see its main purpose, including placement, how much of it promotes services, and how color, graphics and type size highlight the promotion.

The simplest way to avoid gray areas is to keep reminders and billing notices purely operational, and send anything promotional as a separate email that meets all of CAN-SPAM’s requirements.

What each commercial email has to include

The FTC’s CAN-SPAM compliance guide lists the main requirements. Each applies to each commercial email your practice sends, and to emails a vendor sends on your behalf:

Accurate header information. The From, To, Reply-To and routing information must be accurate and identify who sent the message. Send from your practice name, not a personal name a patient would not recognize.
A subject line that matches the content. A promotional email cannot be dressed up as a lab result notice or a billing alert.
A clear statement that the message is an advertisement. The law gives leeway in how you do this, but the disclosure has to be clear and conspicuous.
Your valid physical postal address. A street address, a registered post office box or a registered private mailbox.
A clear way to opt out. Explain how to stop marketing email, in a way an ordinary person can recognize and understand, with a reply address or another easy online method. You may offer a menu of message types, but it has to include an option to stop all marketing email.
Prompt opt-out handling. The opt-out has to keep working for at least 30 days after you send, and you must honor a request within 10 business days. You cannot charge a fee, ask for more than an email address, or make the person do more than reply or visit one web page.
Watch your vendors. Hiring an agency or platform does not move responsibility. The FTC says both the business being promoted and the company that sends the email can be held liable.

After someone opts out, you cannot sell or transfer their address, except to a company helping you comply with the law. The FTC’s guide lists civil penalties of up to 53,088 dollars for each email that violates the law (the amount in 16 CFR 1.98, adjusted for inflation), and the FTC Act’s ban on deceptive advertising still applies to what the email says.

Opting out of marketing does not stop operational email. A patient who unsubscribes from your newsletter can still receive appointment reminders and billing notices, as long as those messages stay transactional.

When HIPAA treats an email as marketing

HIPAA defines marketing in 45 CFR 164.501 as a communication about a product or service that encourages recipients to purchase or use it. The same definition then excludes certain kinds of communication, and these exclusions cover a large share of what a practice emails its own patients:

Communications for the patient’s treatment, including care coordination and recommending alternative treatments or providers.
Communications describing a health-related product or service the practice itself provides, such as a new provider, new hours or a service you now offer.
Refill reminders or communications about a drug the patient is currently prescribed, as long as any payment for sending them is reasonably related to the cost of sending.

Those exclusions disappear if a third party pays the practice to send the communication. Under 164.508(a)(3), using patient information for marketing requires the patient’s written authorization, and the only exceptions are face-to-face communication and promotional gifts of nominal value. An email is never face to face.

Hypothetical examples, to show how the definition works rather than to give legal conclusions: an email to patients announcing that your med spa now offers a laser treatment you provide generally falls outside marketing. An email to patients promoting a supplement brand that pays you a fee for each sale is marketing that needs authorization stating the payment. Sharing your patient list with a gym or another business so it can email them needs authorization, and if you are paid for the list, the rules on sale of protected health information apply as well. Our guide to HIPAA marketing rules walks through the definition, the authorization and the exceptions in detail.

HHS also treats appointment reminders as part of treatment, which a practice may send without a patient’s authorization. That is the HIPAA side. Whether a reminder email is commercial is a separate CAN-SPAM question, answered in the section above.

Email platforms, BAAs and the patient list

A patient list held by a practice is generally protected health information under 45 CFR 160.103, because names and email addresses held by a covered provider identify people as its patients. When you upload that list to an email platform, the platform creates, receives or maintains that information on your behalf. HHS says vendors that do this for a covered entity are business associates, which means you need a business associate agreement with them before the list goes in.

Certain email marketing tools are built for retail and state in their terms that they do not sign BAAs or that customers should not upload health information. Read the vendor’s terms and ask in writing before you upload anything. A practice management or patient communication system you already use may offer email features under an existing agreement.

Watch what the platform does with the data, too:

Segments can reveal health information. A list built from diagnoses or procedures, such as “patients with diabetes” or “implant patients”, uses clinical information to target email. Sending a promotion to that segment is a use of patient information that needs careful review under the marketing rules above.
Open and click tracking. Email platforms can track opens and clicks with tracking pixels and redirected links. If those links lead to your website and your site runs advertising pixels, read our guide to tracking pixels on a practice website before you add ad-platform tags to pages patients reach from email.
Ad platform audience uploads. Uploading patient emails to an ad platform to target or exclude them is a disclosure of patient information for marketing. Google also restricts personalized advertising based on health, as our guide to landing pages for healthcare ads explains.

People who sign up for a newsletter on your website without being patients are a different list. Keep it separate from the patient list, collect only an email address and maybe a first name, and do not ask for health details on the sign-up form. Our guide to website contact forms under HIPAA covers what happens when a form collects health information.

Safeguards HHS describes for email with patients

HHS answers the email question in an FAQ. The Privacy Rule allows providers to communicate with patients by email if they apply reasonable safeguards. HHS gives examples: check the email address before sending, send an alert to confirm the address first, and limit the amount or type of information in unencrypted email. HHS adds that electronic protected health information sent this way must also meet the Security Rule.

For marketing email, that points to a few habits:

Keep clinical details out of subject lines and preview text. Anyone who glances at a shared inbox or a phone lock screen sees those first.
Send to individual recipients, never to a visible list of patients in the To or Cc field. A visible list discloses who your patients are to each other.
Link to your website for details rather than putting health information in the email body.
Keep your email address list accurate and remove addresses that bounce or that the patient says are no longer theirs.

Patients also have a right under 45 CFR 164.522(b) to ask you to communicate with them by alternative means or at alternative locations, and HHS says providers should accommodate reasonable requests. If a patient asks not to be emailed at a particular address, or prefers mail or phone, record that in the place your staff and your email platform will both see it. If a patient starts the email exchange, HHS says you can generally assume email is acceptable to them, unless they say otherwise. For patients who prefer paper, our guide to medical practice direct mail covers letters, postcards and printed newsletters.

Getting delivered: Gmail’s sender requirements

An email that meets CAN-SPAM and HIPAA still has to reach the inbox. Google’s email sender guidelines apply to each sender emailing Gmail accounts, and a stricter set applies once you send more than 5,000 messages a day to Gmail addresses:

All senders: set up SPF or DKIM authentication for your sending domain, use a TLS connection, and keep the spam rate reported in Google Postmaster Tools below 0.3 percent.
5,000 or more a day: SPF and DKIM, a DMARC record (the policy can be set to none), alignment between the From domain and the SPF or DKIM domain, and one-click unsubscribe for marketing and subscribed messages, with a clearly visible unsubscribe link in the body.

A practice that sends fewer than 5,000 emails a day still has to meet the rules for all senders, and we recommend setting up SPF, DKIM and DMARC for the domain anyway. Google recommends all three for your domains, and messages that fail authentication may be marked as spam or rejected. If a platform sends on your behalf, ask it to authenticate your domain rather than sending from its own. Google also says to send only to people who want your email, because spam reports lower your domain’s reputation over time.

Patient newsletters: which parts are marketing

A monthly newsletter rarely has one purpose. A typical issue mixes a seasonal health article, practice news, a feature on a service the practice offers, and sometimes a partner’s offer or a sponsor’s ad. HIPAA and CAN-SPAM each judge that mix differently, so it helps to sort the parts before the issue goes out. The rules below were read on November 1, 2026, in the eCFR version up to date as of October 29, 2026.

General health information. HIPAA’s marketing definition starts with a communication about a product or service that encourages recipients to purchase or use it (45 CFR 164.501). An article on sun protection or flu season that does not promote a product or service does not meet that first part.
Your own services and practice news. A communication describing a health-related product or service provided by the covered entity making the communication is excluded from marketing (164.501, paragraph (2)(ii)(B) of the definition), and so are treatment communications such as recommending alternative treatments (paragraph (2)(ii)(A)). A new provider, a new service you offer or new hours fit here.
Someone else’s product or service. The exclusion covers products and services the practice itself provides. A feature encouraging patients to buy a third party’s product, such as a skincare line you do not sell or a gym membership, is not within that exclusion, and using patient information to send it needs the patient’s authorization under 164.508(a)(3).
Anything a third party pays for. The treatment and own-service exclusions do not apply where the practice receives financial remuneration for making the communication (164.501, paragraph (2)(ii)). Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described (paragraph (3)). If a device maker sponsors the issue or pays for an ad in it, the authorization must state that remuneration is involved (164.508(a)(3)(ii)).

Two practical consequences follow. First, a sponsored newsletter sent to a list drawn from your patient records needs authorization from each recipient, so the usual answer is not to take sponsors for a patient newsletter at all. Second, watch for indirect payment: a free newsletter service that fills the issue with paid placements from brands may involve remuneration described in paragraph (3); read the arrangement with counsel before using it with patient records.

CAN-SPAM asks a different question: is the email commercial? For a message that mixes promotion with content that is neither promotional nor transactional, the FTC’s rule treats it as commercial if a recipient reasonably reading the subject line would likely conclude it promotes a product or service, or if a recipient reading the body would likely conclude its primary purpose is promotion, judged by factors such as placement of promotional content at the top, the share of the message it takes up, and how color, graphics, type size and style highlight it (16 CFR 316.3(a)(3)). A subject line such as “20% off fillers this month” makes the issue commercial. Because the body test is a judgment call, we put the opt-out link and the practice’s postal address in every issue; the requirements are listed in the section on what each commercial email has to include, above.

A printed newsletter mailed to patients is outside CAN-SPAM, which covers electronic mail (16 CFR 316.1), but HIPAA’s marketing rule applies to communications in any form, so the sorting above is the same. Our guide to direct mail for practices covers printed pieces. A newsletter delivered inside a patient portal is covered in our guide to portal messages and HIPAA marketing, recall notices that go out alongside it in our guide to building a patient recall system, and newsletter sign-ups from website visitors who are not yet patients in our guide to lead magnets and gated content.

What a practice can usefully send

We recommend keeping email to patients short and about the practice itself. Ideas that fit well within the exclusions in HIPAA’s marketing definition, while still following CAN-SPAM when they are promotional:

A new provider joining the practice, with their background and the services they offer.
New hours, a new location, parking changes or holiday closures.
A service you now offer, explained in plain language with a link to its page on your site.
Recall and checkup reminders sent from your patient system, kept operational.
Seasonal or preventive health information that links to a reputable public source such as the CDC.
How to book online, how to reach the office after hours, and what to bring to a first visit.

The FTC’s advertising rules still apply to what you say. Patient testimonials and before and after photos in an email are endorsements under 16 CFR Part 255, and using a patient’s story or photo in marketing needs that patient’s written authorization under HIPAA. Claims about results need support. Our healthcare marketing rules hub links to guides on each of these. For texting, a different law applies: see our guide to text message appointment reminders for the FCC’s rules.

A checklist before you send

Decide what kind of email it is. Transactional (appointment, billing) or commercial (promotion, newsletter with offers). Do not mix the two.
Check the HIPAA question. Does it describe your own services or treatment, or does it promote a third party, or is anyone paying you to send it?
Check the platform. Is there a business associate agreement in place for any patient list you upload?
Check the segment. Is it built from clinical data? If so, review it before sending.
Check the content. Accurate From name, honest subject line, no clinical details in the subject or preview, claims you can support.
Check the footer. Advertisement disclosure, postal address and a working opt-out link.
Check opt-outs and preferences. Unsubscribes honored within 10 business days, and confidential communication requests respected.
Check delivery. SPF, DKIM and DMARC set up for your sending domain.

We set up practice websites, sign-up forms and the pages that email links point to as part of our practice website work, and our AI front desk handles calls and booking requests.

Frequently asked questions

Do appointment reminder emails need an unsubscribe link?

Under CAN-SPAM, an email whose primary purpose is transactional, such as a reminder for an appointment the patient booked, is exempt from the commercial email requirements, including the opt-out. It must still have accurate routing information. If you add promotional content at the top or in the subject line, it can become commercial and need the full set of requirements.

Do we need patient authorization to send a newsletter to our patients?

Not if it only describes health-related services the practice itself provides or is part of treatment, and nobody pays you to send it. Those communications fall outside HIPAA’s definition of marketing. Promoting a third party’s products or being paid to send the message changes that, and then authorization is required. A sponsor or paid ad in the issue counts as financial remuneration under 45 CFR 164.501, and the authorization must then say so (164.508(a)(3)(ii)).

Can we use Mailchimp or a similar tool for patient emails?

Only if the vendor signs a business associate agreement covering the patient list, because the list is protected health information. Check each vendor’s current terms; a vendor’s terms may say it does not sign BAAs.

Does CAN-SPAM require consent before we email someone?

The FTC’s guide does not list prior consent among CAN-SPAM’s main requirements; the law centers on a working opt-out and honoring it. Sending only to people who want your email is still Google’s guidance for good delivery, and state laws may add rules.

Can we send encrypted email only?

HHS does not require encryption for each email with patients, but it does expect reasonable safeguards and compliance with the Security Rule for electronic protected health information. No federal rule we found requires a portal. We recommend a secure portal for clinical details and plain email only for general updates.

What if a patient replies to a marketing email with health questions?

HHS says a patient who starts an email exchange can generally be assumed to accept email. Route the reply to clinical staff, apply your normal safeguards, and consider moving the conversation to your portal or a phone call.

Texts follow different rules from email. Our guide to marketing texts from your practice covers the FCC consent and opt-out rules and state telemarketing laws.

Email marketing for medical and dental practices: CAN-SPAM, HIPAA and what to send