Yes, if the platform sending it has signed a BAA. No, if it hasn’t.

In a direct-to-patient model, there is no front desk and no portal, so the shipment notification is the patient’s primary record of their care. It tells a named person, at a specific email address, that a prescription from your company is on its way. That is health information tied to an individual.

The Privacy Rule’s de-identification standard, 45 CFR 164.514(b)(2)(i), lists the identifiers that make health information identifiable: names, email addresses, phone numbers, geographic detail smaller than a state, dates tied to the individual, and more. A delivery exception email has several of them before it says anything about the drug. The list also ends by stating that, “Any other unique identifying number, characteristic, or code,”. A tracking number paired with a patient’s name and address fits that description, because it points to one person’s shipment from a covered entity.

Read also: Does a tracking number count as PHI?

 

Why a BAA is the deciding factor

When PHI moves through a vendor’s system, the Privacy Rule treats that vendor as your business associate. Under 164.502(e)(1)(i), a covered entity may disclose PHI to one only if it obtains “satisfactory assurance that the business associate will appropriately safeguard the information.” And 164.502(e)(2) requires those assurances to be documented in a written contract or other written agreement that meets the requirements of 164.504(e). In practice, that document is the BAA.

If your email platform will sign one, the delivery exception email can say what’s in the package, because the disclosure to the platform is permitted and the platform carries its own safeguard obligations. If the platform won’t sign, there is no compliant way to send that message through it. No subject-line wording changes that. This is why the first name, the email address and the fact that the recipient ordered from a prescription-only company are already enough.

 

This isn’t a marketing question

Shipment notifications sit in the same sending tool as promotions, so it’s easy to assume the marketing rules apply. The definition of marketing at 164.501 excludes communications about “a drug or biologic that is currently being prescribed for the individual.” HHS’s refill reminder guidance and read that exception as covering the patient’s current prescription and not products you’d like them to buy next. A delivery exception notice about the medication they’re on is about that prescription, and it is an operational message, not a promotion. No authorization is needed for it.

There is a financial side too. When a third party pays for a communication, the remuneration generally has to be reasonably related to your cost of making it, and OCR FAQ on What is permitted remuneration for purposes of the refill reminder exception to marketing, describes what counts as permitted remuneration under the exception. A shipment notice funded by your own operating budget doesn’t raise that issue.

If the same email adds a line pitching a higher dose, a new product or a bundle, it has left the exception. Under 164.508(a)(3), marketing communications generally require the patient’s written authorization, and that authorization has to disclose any financial remuneration involved.

 

What a compliant delivery exception email looks like

Assuming the sending platform has signed a BAA, here is what the message can contain, and where discipline still matters:

  • The medication and the problem. Patients need to know what’s affected, especially for something with a dosing schedule or cold-chain requirements.
  • The tracking number or link. Fine, within the BAA’d system.
  • Only what the patient needs. A BAA makes the disclosure permissible, but the minimum necessary standard under 164.502(b) still shapes what you include.
  • A next step. Tell them what you’re doing and how to reach you.
  • No upsell.

On the other side, with a platform that won’t sign, the safe design is to send nothing identifying through it. The email can’t name the drug and can’t carry a tracking number linked to the patient. At that point it stops doing its job, so most teams are better off changing the platform than rewording the template.

Read also: What you can tell patients about cold chain shipping emails

 

FAQs

What happens if a company sends PHI through a vendor without a BAA?

It can be treated as an impermissible disclosure, exposing the company to breach notification duties, regulatory investigation, and potential fines.

 

Does HIPAA apply to every company that sells or ships medications?

Not automatically, since HIPAA applies only if the company qualifies as a covered entity (or a business associate of one), so the answer depends on how the business is structured.

 

What is the “minimum necessary” standard?

It is the principle that you should use or disclose only the least amount of health information needed to accomplish a given purpose.

 

How can a company check whether an email or marketing platform will sign a BAA?

Review the vendor’s compliance or security documentation and ask their sales or legal team directly.