Buying mailing lists for a medical practice

A list seller offers names and addresses of people near your office, sorted by age, income or interest in a health topic. Another practice suggests swapping patient lists to promote a new service. A mail house says it can rent you a list for one mailing. Each of these is a list deal, and each one sits under a different set of rules.

This guide is for practice owners and managers who are thinking about buying or renting a mailing list, or who have been asked to share their own. It covers what HIPAA says about selling patient information, the state laws that make list sellers register, the Washington rule on selling health data, the email and phone rules that travel with a list, and the questions to ask before you pay. For mailing your own patients, see our direct mail guide.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: 45 CFR 164.501, 164.502 and 164.508 (eCFR), California Civil Code 1798.99.80 and 1798.99.82 (read from Internet Archive copies of the official leginfo pages dated October 2, 2026, because the state site does not load for automated checks), the California Privacy Protection Agency data broker pages, 9 V.S.A. 2430 and 2446, Texas Business and Commerce Code chapter 509 and Senate Bill 2121 (2025), ORS 646A.593, RCW 19.373.070 and 15 U.S.C. 7704. State rules on data brokers and health data differ, so check yours, and have a health care attorney review any deal that involves your patient list or a list sorted by health condition.

The short version

Selling your patient list needs each patient’s authorization. Under 45 CFR 164.502(a)(5)(ii), a covered entity may not sell protected health information except under 164.508(a)(4), which requires an authorization that states the disclosure will result in payment to the practice.
A sale includes indirect payment. The rule covers a disclosure where the practice directly or indirectly receives remuneration from or on behalf of the recipient in exchange for the information.
List sellers may have to register. California, Vermont, Texas and Oregon each run a data broker registry. Ask a seller which registries they are on, and check.
California consumers can now delete themselves from broker files in one step. The state privacy agency says that from August 1, 2026, registered data brokers must check its deletion platform at least once each 45 days and process the requests.
Health interest lists are the sensitive case. In Washington, RCW 19.373.070 makes it unlawful to sell or offer to sell consumer health data without a signed valid authorization from the consumer.
Opt-outs follow the address. Federal email law forbids selling or transferring an email address after the person asked not to receive commercial email, and your own suppression file has to be applied to each list you mail.

Three kinds of list deals

Start by naming the deal, because the rules follow what is happening to whose data.

Buying or renting a consumer list. You pay an outside company for names and addresses of people who are not your patients, for one mailing or for ongoing use. HIPAA does not govern the seller’s data, because the seller is not your covered entity and the people are not your patients. State data broker and privacy laws, and federal email and phone rules, can apply.
Selling, renting or swapping your patient list. Your patient list is protected health information. Our email marketing guide explains why the list itself counts. Giving it to anyone else in return for money or something of value is the HIPAA sale question covered below.
Using a mail house or list processor for your own patients. A vendor that prints, addresses or cleans your list for you, and that you pay, is acting for you. That is a business associate arrangement, not a sale, as long as the vendor uses the list only for your work.

Leads are a different product. If a company sells you names of people who filled in a form asking about a service, see our guide to buying patient leads, which covers per-lead fees, the Anti-Kickback Statute and consent to call or text.

Your patient list: HIPAA treats a paid handoff as a sale

The rule is in 45 CFR 164.502(a)(5)(ii). A covered entity or business associate may not sell protected health information except under and in line with 164.508(a)(4). A sale is a disclosure where the covered entity directly or indirectly receives remuneration from or on behalf of the recipient in exchange for the information.

Section 164.508(a)(4) says a covered entity must obtain an authorization for any disclosure that is a sale of protected health information, and that the authorization must state that the disclosure will result in remuneration to the covered entity. That is a signed authorization from each patient whose information is sold, not a line in the notice of privacy practices.

The definition of sale lists exceptions. The ones a practice is likely to meet are:

Disclosures for treatment and payment.
The sale, transfer, merger or consolidation of all or part of the practice, and related due diligence.
Disclosures to or by a business associate for work it does on the practice’s behalf, where the only payment is from the practice to the business associate for that work.
Disclosures to the patient under their access or accounting rights.
Disclosures required by law.
Other permitted disclosures where the only payment is a reasonable, cost-based fee to prepare and send the information, or a fee other law expressly permits.

A list rental to another business for its marketing fits none of these. A list swap is the harder case: no money changes hands, but each side gets the other’s list. The rule’s words are directly or indirectly receives remuneration, so ask your attorney before treating a swap as anything other than a sale.

A separate rule applies when the list is used to send someone else’s message. Under 164.508(a)(3), using or disclosing protected health information for marketing needs the patient’s authorization, with narrow exceptions for face-to-face talks and promotional gifts of nominal value, and if a third party pays the practice for the marketing, the authorization must say so. Our guide to HIPAA marketing rules walks through what counts as marketing.

Buying a list: who is a data broker

State registry laws define a data broker as a business that sells or licenses data about people it does not have a direct relationship with. The wording differs by state:

California. Civil Code 1798.99.80(c) defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. It excludes an entity, or a business associate of a covered entity, to the extent its processing is exempt under Civil Code 1798.146, the California section on health information.
Vermont. 9 V.S.A. 2430 uses a similar test: a business that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom it does not have a direct relationship. It gives a past or present customer or client as an example of a direct relationship.
Texas. Business and Commerce Code 509.001(4), as amended by Senate Bill 2121 effective September 1, 2025, defines a data broker as a business entity that collects, processes or transfers personal data it did not collect directly from the individual. Under 509.003(a) as amended, the chapter applies to a data broker that, in a 12-month period, gets more than 50 percent of its revenue from that data, or revenue from processing or transferring the data of more than 50,000 individuals.
Oregon. ORS 646A.593 defines a data broker as a business entity that collects and sells or licenses brokered personal data, such as a name, address or date of birth organized for sale, to another person.

Two things follow for a practice. Your relationship with your own patients is direct, so these laws are aimed at the seller of an outside list, not at you for keeping a patient file. And a registered seller is not an approved seller: registration is a filing, and the state is not vouching for how the data was gathered.

California: the Delete Act and the deletion platform

California’s Senate Bill 362 of 2023, the Delete Act, amended the data broker title of the Civil Code. Civil Code 1798.99.82 requires a business to register with the California Privacy Protection Agency on or before January 31 following each year in which it meets the definition of a data broker.

The Delete Act also required the agency to build an accessible deletion mechanism. The agency calls it the Delete Request and Opt-out Platform, or DROP. Its regulations on the mechanism took effect January 1, 2026. The agency’s data broker page says that beginning August 1, 2026, data brokers must access the mechanism at least once each 45 days and process consumer deletion requests, subject to limited exceptions, citing Civil Code 1798.99.86(c). It also says a broker that fails to register by January 31 may face administrative fines.

For a buyer, this means a California consumer list should be shrinking as people use the platform. A list delivered before a seller processed the latest batch may hold people who asked to be deleted. Ask the seller when they last processed platform requests and how they handle names you already received.

Vermont, Texas and Oregon registries

Vermont. Under 9 V.S.A. 2446 as in effect now, a data broker registers with the Secretary of State on or before January 31 following each year it meets the definition, pays a 100 dollar fee and states whether and how consumers can opt out. A version effective January 1, 2027, under Act 138 of the 2025 adjourned session, moves registration to within 30 days of becoming a data broker and then each year by July 1, raises the fee to 900 dollars, adds a 20,000 dollar bond, and asks the broker to say whether it collects data such as reproductive health care data and biometric data.
Texas. Business and Commerce Code 509.005 requires a data broker covered by the chapter to register with the Secretary of State, pay a 300 dollar fee, and describe the categories of data it processes and transfers.
Oregon. ORS 646A.593 says a data broker may not collect, sell or license brokered personal data in the state unless it first registers with the Department of Consumer and Business Services, with a declaration on whether residents can opt out. The department may impose a civil penalty of up to 500 dollars per violation, capped at 10,000 dollars a year.

These registries are public. Before you sign, search the seller’s legal name on the registry of each state your list covers, and keep a copy of what you found with the contract.

Lists sorted by health interest

A list of people tagged as interested in weight loss, fertility, joint pain or a condition is a list of health data, even though it did not come from a provider. That is the case where state health data laws apply.

In Washington, RCW 19.373.070 says that, beginning March 31, 2024, it is unlawful for any person to sell or offer to sell consumer health data concerning a consumer without first obtaining valid authorization from the consumer. The authorization must be separate from the consent to collect or share, and it must name the specific data, the seller, the buyer and the purpose of the sale. If a seller offers you a Washington list labeled by health interest, ask for proof of those authorizations. Our Washington My Health My Data Act guide covers the law in full, and our overview of consumer health data privacy laws covers other states with similar rules.

A health interest list also raises a content question. A postcard that tells a stranger you know they have a condition can feel like an intrusion even when the list was bought lawfully. Mail about your services to an area or an age group, and let people raise their own health needs when they answer.

Email and phone lists carry their own rules

Federal email law, 15 U.S.C. 7704(a)(4), says that once a recipient asks not to receive commercial email from a sender, the sender has 10 business days to stop, and that it is unlawful for the sender, or any other person who knows of the request, to sell, lease, exchange or otherwise transfer the address, including through a mailing list. A rented email list that includes people who opted out of the seller’s mail is a problem for the seller, and mailing it can be a problem for you. Our healthcare email marketing guide covers the rest of the law.

Phone and text lists are stricter. Consent to call or text does not pass to you because you bought the number. Our guide to business texting rules explains the consent rules, and our lead buying guide covers what happened to the FCC one-to-one consent rule.

Questions to ask a list seller

Where did each record come from, and on what date? Ask for the categories of sources in writing.
Which state data broker registries are you on, under what legal name?
For California records, when did you last process requests from the state deletion platform?
Does the list include any health condition, health interest, prescription, pregnancy or insurance data, or any field inferred from purchases? If so, what consent or authorization covers selling it?
Is this a one-time rental or a purchase? If it is a rental, who keeps the file, and what happens to names that respond to us?
For email, how do you handle opt-outs, and does the list exclude people who asked you not to mail them?
Will you take our suppression file and remove those names before delivery?
Will you put these answers in the contract, along with a promise to tell us if any of them change?

A seller who will not answer these in writing is giving you an answer.

Suppression and opt-outs

Keep one suppression file for your practice and apply it to each list before each mailing, whether the list is yours, bought or rented. It should hold:

Patients who asked not to receive marketing or who revoked a marketing authorization. Under 45 CFR 164.508(b)(5), a patient may revoke an authorization in writing at any time, except to the extent the practice has already acted on it.
People who opted out of your commercial email, honored within the 10 business days 15 U.S.C. 7704(a)(4) allows.
People who asked by phone, mail or in person to stop hearing from you.
Addresses that came back undeliverable.

Record the date and the channel of each request. If a vendor mails for you, send them the suppression file for each job and ask for confirmation that it was applied.

Wording to use and avoid in list mail

Use: “[Practice name] is now open on Main Street and taking new patients.” Avoid: “As someone living with arthritis, you may qualify for our new treatment.”
Use: “You are receiving this because you live near our office.” Avoid: “Our records show you may be interested in weight loss.”
Use: “To stop receiving mail from us, call the office or write to [address].” Avoid: mail with no way to opt out.
Use: “[Practice name] provides these services. Talk with your own clinician about what fits you.” Avoid: any promise of an outcome.

An illustration

This example is invented. A chiropractic office, [Practice name], gets two offers in the same week. A list seller offers 5,000 names within five miles, tagged “back pain interest”. A nearby physical therapy office offers to swap patient lists so each can announce a new service.

On the first offer, the office manager asks the questions above. The seller says the tags come from online browsing and cannot say what consent covers the health tag. The office declines the tagged list and instead buys an untagged list of households in nearby postal routes from a seller that shows its state registrations and its last deletion platform date in writing. The postcard announces Saturday hours and gives an address for opting out.

On the second offer, Dr. [Name] asks the practice’s attorney, who points to the sale of protected health information rule. The swap would need a signed authorization from each patient that says the practice is getting something in return. The two offices instead agree to put each other’s flyers in their waiting rooms, with no patient information exchanged.

Checklist before you buy, rent or share a list

Name the deal: outside list, your patient list, or a vendor working for you.
If your patient list leaves the practice for anything of value, stop and get legal advice on 45 CFR 164.502(a)(5)(ii) and 164.508(a)(4).
If a vendor handles your patient list for you, have a business associate agreement in place first.
Check the seller on the registries of the states the list covers.
Ask for sources, dates and deletion platform processing in writing.
Decline health-tagged lists unless the seller can show the consent or authorization the state requires.
Apply your suppression file to the list before each mailing.
Write the piece about your services, not about the reader’s health.
Give a clear way to opt out, and log each request.

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. On the outreach side, that means campaigns aimed at an area or an audience rather than at bought health data, landing pages that explain your services in plain words, and opt-out handling built into each channel. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules hub.

Can a medical practice buy a mailing list?

Yes, a practice can buy or rent a consumer list of people who are not its patients. HIPAA does not govern the seller’s data, but state data broker laws, state health data laws such as Washington’s, and federal email and phone rules can apply. Ask where the data came from, whether the seller is registered, and whether the list includes health data.

Can we sell or rent our patient list to another business?

Only with each patient’s signed authorization. 45 CFR 164.502(a)(5)(ii) bars a covered entity from selling protected health information except under 164.508(a)(4), and that authorization must state that the disclosure will result in remuneration to the practice. Narrow exceptions exist, such as the sale of the practice itself.

Is a list swap with another practice a sale?

It may be. The rule defines a sale as a disclosure where the practice directly or indirectly receives remuneration in exchange for the information, and getting another list in return is something of value. Ask a health care attorney before agreeing to a swap.

What is the California Delete Act?

Senate Bill 362 of 2023 amended California’s data broker law. It requires annual registration with the California Privacy Protection Agency and created a single platform where consumers ask registered data brokers to delete their data. The agency says brokers must check the platform at least once each 45 days, starting August 1, 2026.

Do we need to register as a data broker?

A practice that keeps information about its own patients has a direct relationship with them, and the California and Vermont definitions are aimed at businesses without one. A practice that bought data and resold it would be a different case. State rules on data brokers differ, so check yours with counsel.

Buying or renting mailing lists for a medical practice: HIPAA and data broker laws