No. Under HIPAA, an email reminding a patient to refill their current semaglutide prescription is not marketing, as long as no third-party payment exceeds the cost to send the message. It crosses into marketing if the email concerns a different form or product, if a manufacturer or third party pays more than the cost, or if the prescription lapsed more than 90 days ago.

The HHS outlines these criteria in its FAQ section on refill reminders. Reminders about filling prescriptions, generics, and adherence all fall under this exception, as do prescriptions lapsed within 90 calendar days and messages about the delivery system for a self-administered drug, such as an injection pen. Each condition turns on what the email says, who pays for it, and how long ago the prescription lapsed.

 

Which semaglutide emails fall inside the exception

A reminder to your patient about refilling their existing semaglutide prescription would qualify for this exception. Reminding them to take their dose each week would also fall under this exception. HHS also allows for communication about "all aspects of a drug delivery system" for a self-administered drug. Things like using the pen, changing the needle, and storing your injectable would all qualify under this exception.

Emails about step dosing also concern the medication the patient is already prescribed. You might send your patient an email letting them know their next shipment is on the way to move them up from 0.5mg to 1mg, along with a reminder to take their injection that week.

It is important to keep your patients taking their doses. A 2026 claims study of US adults beginning injectable semaglutide found that patients who started at higher doses faced a greater risk of discontinuing early. They described it as "a modifiable risk factor for early medication discontinuation." The data were collected from 2018 to 2021 through MarketScan and only showed association and not causality. But we know that you want your patients on their medication.

 

When a different form or product turns the email into marketing

When your email addresses the medication your patient is currently prescribed, HIPAA doesn't treat it as marketing. When you email a patient about a new formulation, the HHS says the refill reminder exception doesn't apply. The same applies when you tell a patient they should move to a different therapy.

Switching may be less common than stopping. An American Diabetes Association study of adults with obesity at one academic medical center found 36.7% of patients starting semaglutide or tirzepatide received a first prescription covering less than 32 days, and few went on to restart or switch. Because the study covered a single health system, the pattern may differ elsewhere. Still, it suggests stopping is the event your emails will handle most often.

 

Check who pays before the reminder goes out

Financial remuneration means any payment from, or on behalf of, a third party whose product or service the email describes. A manufacturer funding a semaglutide adherence program can cover costs reasonably related to making the communication. Any payment above cost makes the message marketing and brings in the authorization requirement.

The same test reaches vendors. The HHS states a business associate paid by a pharmaceutical manufacturer may send refill reminders as long as the payment does not exceed the fair market value of its services. A per-refill bonus paid to an outreach vendor deserves close review for this reason.

According to Paubox's 2026 Healthcare Email Security Report, 28% of the 170 email-related healthcare breaches reported in 2025 involved a vendor or business associate's email. Paubox’s analysis of HHS breach data found this was the most common pattern. When a sponsor pays for your refill reminders, you're bringing in one more party with access to your list of semaglutide patients.

Cost helps explain why sponsored programs appeal to patients and manufacturers alike. A 2026 article on real-world obesity medication use lists cost and insurance among the reasons patients fare worse than trial participants, alongside GI side effects and not moving up to higher doses. The appeal of sponsorship makes the payment check worth running before any program launches.

 

Treat win-back emails by the 90-day line

If a patient's semaglutide prescription lapsed 60 days ago, you can email them about it under this exception, since the lapse falls within 90 calendar days. Past 90 days, the email needs another route, such as the treatment exception with no third-party payment, or the patient's authorization.

Many of your patients are going to fall off their medication at some point. A JAMA Network study found that 64.8% of US adults with overweight or obesity and without type 2 diabetes stopped taking their GLP-1 receptor agonist within a year. 36.3% of those who stopped restarted within a year. Among those who regained weight, restarting the medication was more common. This study looked at liraglutide, semaglutide, and tirzepatide from 2018 to 2023.

You need a reliable way to track when each prescription lapsed. With the lapse date on file, you can send win-back emails inside the 90-day window and route patients who lapsed 150 days ago to a separate process.

Related: Are GLP-1 refill reminders marketing under HIPAA?

 

FAQs

Does an authorization for sponsored refill reminders need to mention the payment?

Yes, when a third party pays for marketing communications, 45 CFR 164.508(a)(3)(ii) requires the authorization to state that financial remuneration is involved.

 

Does a patient need to sign a new authorization each time their semaglutide prescription renews?

No, a HIPAA authorization stays valid until it expires or the patient revokes it, so a renewed prescription does not require a fresh one.

 

Do the same marketing rules apply to refill reminders sent by text message?

Yes, the definition of marketing in 45 CFR 164.501 covers any communication about a product or service, so the refill reminder exception and its payment limits apply to texts the same way they apply to email.