The journal article Direct marketing in health and medicine: using direct mail, email marketing, and related communicative methods to engage patients explains, "Direct marketing is characterized by its conveyance of information directly to individuals.”

Email allows healthcare organizations to update their patients on available services, deliver helpful resources, and facilitate event sign-ups. When analyzing email results, organizations can look at how many times the email was opened. How many clicks on a link the email received and whether they completed the desired action.

Healthcare articles published have given us some insight into these types of results. The results will naturally vary because they are based on patient or screening participant data. The following statistics can be used as a general idea when creating HIPAA compliant email campaigns.

 

A primary care campaign recorded a 73.4% open rate

Emails that were sent to patients at the beginning of a campaign in a 2026 JMIR study had an open rate of 73.4% and varied by clinic. With ranges of 57%-88% at the 12 clinics in Quebec. These emails were being sent from June 2023 to January 2024 to recruit patients who were 45 years and older to fill out a survey.

These open rates should be compared to similar messages healthcare organizations have sent in the past. They can be used as a benchmark for the next campaign.

When emails are securely delivered to patients, they are more likely to respond. A 2026 Paubox report noted that 73% of health IT leaders believe that patients prefer receiving secure email communication from their provider. Make sure campaigns meet the standard of safe and easy access for patients.

 

The matter of DMARC and reputation

In our 2026 Healthcare Email Security Report, Paubox looked at 170 healthcare breaches that involved email in 2025. Out of those breaches, 53% took place on Microsoft 365. 41% of healthcare organizations were classified as high risk. And 74% of breached domains had poor DMARC implementation (up from 65% in 2024).

While this is not a metric for campaign performance, it can help drive home the need for giving recipients a next step and using secure delivery methods. Perhaps an educational campaign could send an audience to a page where they can check if they are eligible for a screening or allow them to securely request an appointment.

 

A 3.6% registration rate represented thousands of people

Results from 2015-2016 in a JMIR study noted that they were able to reach at least 193,606 patients and 7,012 registered. That is a registration rate of 3.6% of the people we were able to reach. These are historical results for research recruitment, not what your practice will get from your current marketing campaign.

Presenting percentages with the raw numbers is a good practice. Even a seemingly modest response rate can be useful when it is applied to a large group of people the organization has managed to contact.

Decide on the metric most beneficial to track before launching a campaign. With events, the necessary metric is to see how many individuals completed their registration. For a service promotion, it is beneficial to distinguish between those who booked an appointment and those who actually followed through.

 

A newsletter’s results need context

The 2024 study Engagement with health research summaries via digital communication to All of Us participants concluded, “Personalization of communication requires testing to determine whether efforts are having the expected effect.”

When looking at their data for their My Medical Minutes newsletter, they found an average open rate of 29.5% and a click rate on content of 2%, from March 2020 to October 2021. Some of their personalization efforts decreased these metrics. The study also discovered that when Apple made an update to their system, it could cause messages to show as opened. They then chose to look at click rates to help further test their personalization.

Patients want to know that their email is secure. According to the Paubox report on IT leaders, 73% of healthcare IT leaders believe that patients want to receive secure emails from their providers. 86% of IT leaders feel that their email security is creating friction in their day-to-day. When testing for personalization, organizations should also test if patients can easily gain access to messages.

 

Secure communication belongs in campaign planning

Discussing protected health information (PHI), the journal article The HIPAA Omnibus Rule: Implications for Public Health Policy and Practice explains, "The Privacy Rule generally prohibited the use or disclosure of PHI for marketing purposes without an individual’s authorization, but traditionally allowed a number of exceptions.”

The Department of Health and Human Services’ marketing guidance describes the authorization requirement and exclusions for certain treatment and healthcare operations communications. Before sending, confirm how the campaign is classified and whether the intended use of patient information is permitted.

Paubox’s report describes automatic outbound encryption as a way to reduce reliance on staff deciding when to protect a message. Combine secure delivery with appropriate permissions and a checked recipient list. This gives healthcare teams a practical foundation for outreach while keeping privacy part of campaign planning.

 

FAQs

How often should a practice send marketing emails?

Start with a schedule subscribers expect, then adjust it using their feedback and requests for fewer messages.

 

What should we include when deciding whether a campaign was worth its cost?

Include staff time, content preparation, platform charges, and follow-up work, then compare those costs with the campaign’s documented results.

 

How can we account for patients who read an email and book by phone?

Ask how they heard about the service during booking, while treating their answers as helpful context rather than proof that the email caused the appointment.