A covered entity can email a patient whose GLP-1 prescription has lapsed without written authorization, as long as the email relates to the patient’s treatment and no third party whose product the email describes pays for it. If the email goes out within 90 calendar days of the prescription lapsing, the HHS treats it as a refill reminder, and a third party can cover the cost as long as the payment is reasonably related to what the covered entity spends sending it. After 90 days, the email has to fit a different exception, such as a treatment communication. For win-back emails, timing matters. A Cleveland Clinic study of patients who stopped taking semaglutide or tirzepatide found a 19.6% chance they would restart within a year. The average time to restart the discontinued drug was roughly 177 days.

 

How the 90-day window applies to a lapsed GLP-1

The HHS notes that covered entities are permitted to email a patient regarding a prescription that has lapsed. Adherence is part of this too, and so is how the drug is administered. Once 90 calendar days have passed, it's no longer reasonable to consider these messages refill reminders or medication adherence communications.

Ensure that you know when the prescription lapsed and that you have a documented way to verify it. You stay within the 90-day timeframe if you email them 30 days after they ran out to let them know they can order their next fill. If you send that same email 120 days later, you will need authorization or qualify under a different exception.

 

What permits the email after 90 days

According to the HHS marketing guidance, these are also not considered marketing:

  • A communication that is made for treatment purposes
  • A communication that recommends other treatments or treatment settings
  • A communication that describes your health-related services

As long as there's no financial remuneration tied to these emails, sending them is permitted. Contacting a lapsed patient can be justified on medical grounds. In another Diabetes, Obesity and Metabolism study, participants in the STEP 1 trial regained two-thirds of their weight a year after discontinuing semaglutide and a lifestyle program. The authors wrote that their findings “suggest ongoing treatment is required to maintain improvements in weight and health.”

An email inviting them to schedule an appointment to discuss restarting their medication or finding an alternative that works for them would fall under the treatment exception.

 

Who pays for the message decides whether you need authorization

A patient's authorization is required if a third party is paying you to send a communication about their product. Should the drug company compensate you for sending that email, it would be treated as marketing. The same goes for a pharmacy partnership in which you get paid a specific amount for every patient you can send the email to. If you are within the 90-day window, the only thing the third party can pay for is the reasonable cost to send the communication.

If a drug manufacturer or pharmacy partner funds a discount on the medication, or pays you to send it, you need the patient’s authorization once the 90-day window has passed. During the authorization process, be upfront that you'll receive payment for sending the email. The authorization must identify that remuneration is being received according to 45 CFR 164.508(a)(3).

Another factor is that patients fall off track because of the expense involved. A 2026 Frontiers article stated that "Discontinuation is dominated by cost rather than therapeutic failure." If you decide to market to these patients, make certain you know who is funding the cost discount you're providing.

 

Limit what the email reveals

Patients stop taking their GLP-1s for a wide range of reasons. A 2026 review in Nature Reviews Endocrinology lists GI side effects, not losing enough weight, cost, and fear of side effects that have low occurrence rates. Be careful not to put this information in the subject line, preheader, or sender name of the email. If someone's phone is locked, the subject line will still show up when your email comes in. Patients are far more likely to open your email when the subject reads "Here is a message from your care team." Additional details should go in the body of the email.

 

Send it through a platform covered by a business associate agreement (BAA)

A win-back list will likely include a lot of patients. Research indicates that when a patient is prescribed a GLP-1 for weight loss, there is a 36.7% chance their fill will last fewer than 32 days. Among those patients, there was an 82.7% chance they would not get another fill during the year they were first prescribed the medication. A list of patients who stopped their GLP-1 is protected health information (PHI), since it identifies each person by a prescription they no longer fill, so the platform sending it to it needs to sign a BAA.

Encryption of the email is one issue that deserves attention. A Paubox survey of 170 Healthcare IT leaders revealed that just 54% encrypt all outgoing emails by default. Meanwhile, just 26% refuse to let email depart without TLS established first. With automated emails, there's no person checking that each one is encrypted before it's sent from your organization.

Paubox Marketing ensures a BAA covers every campaign you send. Emails are only sent out using TLS 1.2 and TLS 1.3. You have the ability to email your patients in a HIPAA compliant way and include marketing in those messages. It leaves it up to you to determine if your email counts as marketing.

See also: HIPAA compliant email marketing: What you need to know

 

What a compliant win-back cannot settle

You have now determined that you are allowed to send a win-back email to your patients that have lapsed on their GLP-1. Writing about patients who stop semaglutide or tirzepatide, the Cleveland Clinic authors noted “no evidence-based guidelines exist for this commonly occurring situation in clinical practice.”

Some patients may have had adverse side effects from their GLP-1. A systematic review of 12 case reports of patients who developed gastroparesis while on a GLP-1. Most had escalated doses or restarted too soon after stopping. These are only case studies, but you may want to send them to your doctors instead of having them order more right away.

 

FAQs

Can I include a discount code in a win-back email?

A discount on your own services generally fits the exception for communications about your own health-related services, as long as no third party whose product the email describes pays you to send it.

 

When does the 90-day clock start?

The HHS measures from the date the prescription lapsed, so set and document a consistent rule for when a prescription counts as lapsed, such as the date the last supply would have run out.

 

Can a patient stop receiving win-back emails?

A patient can revoke a marketing authorization in writing at any time and can ask you to use a different communication channel, which you should accommodate when the request is reasonable.