Medical practice direct mail and printed newsletters: HIPAA, offers and what to print

A practice can mail a letter announcing a new provider, a postcard to nearby households when it opens a second location, or a printed newsletter to patients a few times a year. Each of those pieces is an advertisement in the eyes of the FTC, and the ones sent to your own patients also sit under the HIPAA Privacy Rule, because the mailing list comes out of your records.

This guide covers what is different about mail: which mailings HIPAA treats as marketing, what can be printed on the outside of an envelope or postcard, what a mailing vendor is under HIPAA, how to word free offers in print, the extra limit on offers to Medicare and Medicaid patients, health claims in newsletters, fundraising letters and requests to stop mail. Email and recall reminders have their own guides, linked below, so this one does not repeat them. If a mailer carries a QR code, see our guide to QR codes on print ads for what must stay on the card and how to track it without patient data. Posters, screens and brochures inside the office are covered in our waiting room screens and in-office marketing guide. Flyers and door hangers delivered by hand, which must stay out of mailboxes, are covered in our guide to door hangers, flyers and neighborhood apps. How HIPAA sorts the parts of a patient newsletter, printed or emailed, is covered in the newsletter section of our guide to email marketing for practices.

Two kinds of mailing list

Start by asking where the addresses came from, because the answer decides which rules apply.

A list of your own patients is built from your records. Under 45 CFR 160.103, protected health information is individually identifiable health information held by a covered entity, and a patient list held by a practice generally qualifies, because it shows that each person on it is your patient. Our email marketing guide explains why the list itself counts. Every use of that list for mail is a use of protected health information, so the HIPAA marketing rules described in the next section apply.

A mailing to addresses that did not come from your records, such as every household on a set of nearby postal routes, does not use your patients’ information to choose recipients. The HIPAA marketing rules turn on the use or disclosure of protected health information, so they do not decide whether you may send that piece. The FTC Act still does: 15 U.S.C. 45 prohibits unfair or deceptive acts or practices in commerce, and that applies to a postcard as much as to a web page. If you plan to buy or rent that outside list, our guide to buying mailing lists for a medical practice covers data broker registries and the questions to ask the seller.

If patient addresses are added to a neighborhood mailing, treat the whole mailing as a use of patient information and run it through the HIPAA questions below.

When a mailing to patients is HIPAA marketing

HIPAA defines marketing in 45 CFR 164.501 as a communication about a product or service that encourages recipients to purchase or use it. The same definition excludes communications for the patient’s treatment and communications describing a health-related product or service that the practice itself provides, unless a third party pays the practice to make the communication. A letter telling patients that your practice now offers evening hours, a new provider or a service you perform generally falls inside those exclusions. Our guide to HIPAA marketing rules walks through the definition and its exceptions in detail.

When a mailing does meet the definition, 45 CFR 164.508(a)(3)(i) requires the patient’s written authorization before you use their information for it. The rule names two exceptions: a face-to-face communication made by the practice to the patient, and a promotional gift of nominal value provided by the practice. A letter or postcard is not face to face. The regulation text does not define nominal value for this purpose, so if you plan to mail a gift to patients and rely on that exception, ask your privacy officer or counsel first.

If a third party pays you to mail something to your patients, such as a company paying for an insert promoting its product, the treatment and own-services exclusions fall away. Under 164.508(a)(3)(ii), when marketing involves financial remuneration from a third party, the authorization must state that the remuneration is involved.

What shows on the outside of the envelope

A postcard is read by everyone who handles it, and an envelope can be read on the outside by anyone in the household. 45 CFR 164.530(c) requires a practice to have appropriate administrative, technical and physical safeguards to protect the privacy of protected health information, and to reasonably safeguard it to limit incidental uses or disclosures. For mail, that comes down to what you print where other people can see it.

• Keep diagnoses, conditions, procedures and test names off postcards and envelope exteriors.
• Use the practice’s general name in the return address, not the name of a condition-specific program or clinic.
• Put anything specific to the patient inside a sealed envelope.
• Check window envelopes so only the name and address show through the window.

Patients can also ask you to send mail differently. Under 45 CFR 164.522(b), a covered health care provider must permit patients to request, and must accommodate reasonable requests, to receive communications by alternative means or at alternative locations. Flag those requests in your records so a mailing list pulled for a newsletter does not send mail to an address the patient asked you not to use. Our patient recall guide covers recall postcards and letters specifically.

Mailing vendors and the patient list

A print shop or mail house that receives your patient names and addresses to print and mail on your behalf fits the definition of a business associate in 45 CFR 160.103: a person who, on behalf of a covered entity and other than as a member of its workforce, creates, receives, maintains or transmits protected health information for a function or activity the rules regulate. That means a business associate agreement before the file leaves your office.

Send only the fields the job needs. A newsletter needs a name and a mailing address. It does not need dates of birth, visit dates or anything about why the person is a patient. If a vendor asks for more, ask what for.

Printing a neighborhood postcard from a list you did not build from patient records is a different job. The vendor does not receive your patients’ information, so the business associate question does not arise for that mailing.

Free offers and discounts in print

A coupon or a free offer on a mailer is an advertising claim, and the FTC Guide Concerning Use of the Word “Free” at 16 CFR 251.1 applies to it. Under 251.1(c), all the terms, conditions and obligations of a free offer should be set out clearly and conspicuously at the outset of the offer, in close conjunction with it. The guide says that disclosing the terms in a footnote reached by an asterisk next to the offer is not disclosure at the outset. On a postcard, that means the conditions go next to the word free, in readable type, not in the fine print along the bottom edge.

Under 251.1(b), a free offer is understood to mean the customer pays nothing for the free item and no more than the regular price for the item they must buy. Do not raise the price of the paid service to cover the free one.

Offers to Medicare and Medicaid patients have an extra limit. 42 U.S.C. 1320a-7a(a)(5) provides for civil monetary penalties against a person who offers or transfers remuneration to a Medicare or Medicaid beneficiary that the person knows or should know is likely to influence the beneficiary’s choice of a provider for items or services those programs pay for. The OIG’s policy statement of December 7, 2016 interprets nominal value as a retail value of no more than $15 per item or $75 in the aggregate per patient per year, and says the items may not be cash or cash equivalents. A mailer offering a free service or a waived copay to people who may be on Medicare needs review before it goes out. Our guide to marketing to Medicare patients covers the statute and its exceptions.

Health claims in printed newsletters

A practice newsletter usually mixes practice news with health information: seasonal reminders, explanations of a treatment, answers to questions patients ask at visits. The health content is part of an advertisement for the practice, so it falls under 15 U.S.C. 45. The FTC’s Health Products Compliance Guidance is written for health products, but the same caution makes sense for services: the FTC approach generally requires that health-related claims be backed by competent and reliable scientific evidence.

• Describe what a treatment is and who it may suit, without promising results.
• Have a clinician at the practice review every health article before it prints. Our guide to medically reviewed health content covers how to do that review and show it.
• Date each issue, since printed health information stays on refrigerators long after it is current.
• Tell readers to call the practice or their own clinician with questions about their own care.

Patient stories and quotes in a newsletter raise two separate questions: HIPAA authorization to use the patient’s information, and the FTC rules on endorsements. Both are covered in our guide to patient testimonials and before and after photos.

Fundraising letters are a separate rule

If your practice is part of a nonprofit or has a related foundation, a fundraising appeal mailed to patients follows 45 CFR 164.514(f), not the marketing rule. It permits limited information, including name, address, dates of service, department of service, treating physician, outcome information and health insurance status, to be used for the practice’s own fundraising without an authorization, but only if the notice of privacy practices includes the required fundraising statement. Each fundraising communication must give the patient a clear and conspicuous opportunity to opt out of further fundraising communications, and the opt-out method may not cause an undue burden or more than a nominal cost. A printed letter therefore needs an opt-out that is easy to use, such as a phone number or a simple reply. Our HIPAA marketing rules guide explains where fundraising ends and marketing begins. For hospital foundations and health nonprofits that write to former patients, our guide to fundraising appeals and HIPAA covers the permitted data, opt-out design and donor lists in detail.

Stopping mail when a patient asks

Of the rules covered here, the fundraising rule is the one that spells out an opt-out on each communication. Two others matter for any mailing list. A patient who signed a marketing authorization may revoke it at any time in writing under 45 CFR 164.508(b)(5), except to the extent the practice has already acted in reliance on it. And a request under 164.522(b) to use a different address or a different way of contacting them has to be accommodated if it is reasonable.

Keep one suppression list for mail, apply it to every list you pull, and record the date and source of each request. A patient who asks to stop receiving the newsletter and gets the next issue anyway has a reason to complain, whatever the regulation says.

Illustration: a printed newsletter to patients

Illustration, not a real practice: a family dental practice plans a two-page printed newsletter to its active patients. The front page announces a new hygienist and Saturday hours, which describe the practice’s own services. The back page explains what a sealant is and who may be a candidate, reviewed and signed off by one of the dentists, with a line telling readers to ask at their next visit. There is no coupon. The mailing file sent to the print shop contains names and addresses only, under a business associate agreement, and patients who asked for mail at another address or asked to stop receiving the newsletter are removed first. Nothing on the outside of the envelope says more than the practice name and return address. A sponsor offers to pay for printing in exchange for an ad for its product, and the practice declines, because that would turn the mailing into marketing paid for by a third party and require each patient’s authorization.

Checklist before a mailing goes out

• Where did the addresses come from: patient records, a neighborhood list, or both?
• If patients are on the list, is each message about treatment or the practice’s own services, with no third-party payment?
• If it is marketing, do you have each patient’s written authorization, stating any third-party payment?
• Does anything on the outside of the piece reveal a condition, a procedure or a condition-specific program?
• Have alternative address and stop-mail requests been applied to the list?
• Does the print or mail vendor have a business associate agreement, and does the file contain only names and addresses?
• Are the conditions of any free offer next to the offer, not in a footnote?
• Could the offer reach Medicare or Medicaid patients, and has it been checked against 42 U.S.C. 1320a-7a(a)(5)?
• Has a clinician reviewed every health statement, and is the issue dated?
• If it is a fundraising letter, does it include an easy opt-out?

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices, and printed pieces work best when they send people somewhere useful. Our medical website design work can give a mailer a simple landing page that matches the offer, and our patient lead generation work makes sure the calls and forms that follow a mailing are answered and tracked. We do not print, mail or sell mailing lists, and we do not give legal advice; we write and build for you and your counsel to review. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

Frequently asked questions

Sources

• 45 CFR 160.103: Definitions (business associate, protected health information)
• 45 CFR 164.501: Definitions (marketing, financial remuneration)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required (including (a)(3) marketing and (b)(5) revocation)
• 45 CFR 164.514: Other requirements relating to uses and disclosures (including (f) fundraising)
• 45 CFR 164.522: Rights to request privacy protection (including (b) confidential communications)
• 45 CFR 164.530: Administrative requirements (including (c) safeguards)
• 16 CFR 251.1: Guide concerning use of the word “Free” and similar representations
• 15 U.S.C. 45: Unfair methods of competition and unfair or deceptive acts or practices
• 42 U.S.C. 1320a-7a: Civil monetary penalties (beneficiary inducement, subsection (a)(5))
• OIG Policy Statement Regarding Gifts of Nominal Value to Medicare and Medicaid Beneficiaries (December 7, 2016)
• FTC: Health Products Compliance Guidance (December 2022)

More in Healthcare advertising guides