A reminder to a patient to refill a GLP-1 medication they are currently taking is not considered marketing under HIPAA. As long as a third party isn't paying for the communication above the cost of communication. It crosses into marketing territory if you suggest a different medication to the patient or if the drug manufacturer or another party covers costs beyond what it takes to send the communication.

As detailed in 45 CFR 164.501, the stipulation is that any funds received must be "reasonably related to the covered entity's cost of making the communication." HHS explains how it applies this language in its refill reminder guidance, and its marketing guidance covers the authorization requirement in 164.508(a)(3).

For a direct-to-patient telehealth company, email will likely be a primary method of reaching out to patients. Therefore, marketing status is just one piece of the puzzle when determining if your communication is permissible. The subsequent consideration is whether your telehealth company is permitted to use this information.

 

A reminder for a current prescription is not marketing

The exception covers reminders for prescription refills, tips on taking medication correctly, and details about generic options. Additionally, any device essential for self-administration of the drug would also fall under this category, such as a once-a-week injection. An email prompting a patient to refill their prescription or reminding them to switch injection sites would be considered a drug for which they already have a prescription.

 

Check whether a third party pays for the message

As defined by the regulation, financial remuneration is any compensation received from or on behalf of a third party for whose product you are communicating. It would not apply if the payment was received from a health plan. Manufacturer payments are allowed if they cover your direct and indirect costs for the service, such as labor, materials, supplies, and overhead.

Imagine a scenario where a partner pharmacy paid a telehealth company a fixed sum for every refill prompted by their reminders. As long as the compensation does not exceed what it costs to send those reminders, you will fall under this exception. If the amount is higher than what it costs to send the messages, you would need to obtain authorization from the patient.

 

Treat a win-back as a reminder only within 90 days

If a patient's prescription lapsed within the last 90 calendar days HHS will consider that to fall under this exception. Once more than 90 calendar days have passed, HHS will no longer consider that to be reasonable.

It's perfectly fine to reach out to a patient who discontinued their medication within the last two months and remind them to renew. For a patient who ceased their medication five months ago, another exception would be necessary. Perhaps the treatment exception, or your own services exception found in 164.501, could apply if no third party is compensating you for sending that message. Make sure to confirm these facts with your counsel and be aware that your state may have more requirements in place.

 

Handle switches and add-ons separately

Should a message detail a new formulation, certain adjunctive drugs, or encourage a switch from the patient's current prescription, it would be excluded from the excepted refill reminder category. An email that promotes the use of another GLP-1 or gives a medication name to help with nausea would fall under these.

If there is no third party involved to pay for the communication or if the patient has consented to the message it can be considered a treatment message. If its face to face it can also be considered a treatment message. It's important to note, as HHS points out, that email is not treated as a face-to-face interaction. General information can be sent out about adjunctive medications and new formulations if a product name isn't used.

 

Send the reminder through a service that signs a BAA

HHS notes that a covered entity may use a business associate to make an excepted communication, but it must obtain that business associate's agreement to use protected health information (PHI) only for the covered entity's communication activities. A general-purpose marketing platform that will not sign a business associate agreement (BAA) cannot serve that role for messages containing PHI.

Paubox's Email API includes a BAA with every plan, enforces TLS 1.2+ encryption by default, and supports reusable templates filled with per-recipient values, so a refill notice can reach a patient's inbox without a portal login. Paubox Marketing also supports personalization with PHI. These tools secure the communication, and they do not decide whether a given message is marketing.

Read also: The definition of marketing according to HIPAA

 

Limit what each message reveals

The HHS states that using an unencrypted email for treatment purposes with your patient is allowed under the privacy rule. They suggest that you may want to implement some controls, such as how much information you disclose. There is no mention of subject lines in these recommendations from HHS. Keeping your subject line "Your refill is ready" would be a safe practice but not a requirement.

In Paubox's 2026 Healthcare Email Security report, they looked at 170 healthcare-related email breaches in 2025. Of these breaches, 74% had inadequate DMARC controls in place. That is up from 65% in 2024. DMARC is used to authenticate whether an email is truly coming from a domain. Since patients expect refill notifications, it is a good practice to set up authentication on your domain if you’re a telehealth company.

 

Know what the legal answer does not settle

Having a refill reminder that meets HIPAA does not mean it will help your patients continue to take their medication. A study published in JAMA looked into sending out text message reminders for patients who were behind on taking cardiovascular drugs. They had over 9000 patients participate in this study. It showed that there was a 5% increase in patients refilling their medication within 3 months. No improvements were seen at 12 months.

 

FAQs

Can a refill reminder name the GLP-1 drug?

The refill exception covers communications about a currently prescribed drug, so naming it does not make the message marketing, although limiting drug names in subject lines remains a safeguard decision.

 

Do patients have to authorize refill reminders?

Authorization is not required for reminders about a currently prescribed drug when any third-party payment is reasonably related to the cost of sending them.

 

Does a BAA with my email platform settle the marketing question?

No, a BAA governs how the vendor handles PHI, while the marketing rules decide whether the message needs patient authorization.