You cannot send order confirmations using Shopify if the confirmation contains PHI, and for most telehealth companies, it does. Shopify won’t sign a BAA, and its Acceptable Use Policy states that merchants are responsible for following the law and the platform’s rules, and it names “uploading Protected Health Information subject to HIPAA” as a business activity the platform doesn’t support. So anything that qualifies as PHI shouldn’t pass through Shopify’s notification system, or sit in its order records.

 

Why an order confirmation is PHI

A standard Shopify confirmation includes the patient’s name, email, shipping address, and line items. For a store selling sneakers, that’s retail data. For a direct-to-patient telehealth company, it’s different. The line item might read “Semaglutide 2.4mg, 4-week supply” or “Testosterone cypionate, 10ml.” Even a generic SKU name, sent from a brand that only does weight loss or men’s sexual health, tells the reader that this person is receiving treatment.

HIPAA’s definition of individually identifiable health information, covers information that “relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual,” and that identifies the individual or could reasonably be used to identify them. An email address is an identifier: the de-identification standard at 45 CFR 164.514(b)(2)(i) lists “electronic mail addresses” among the identifiers that must be removed. A prescription drug name relates to treatment.

 

The order record

Even if you rewrite the email, Shopify still stores the order. Customer name, address, product, and any line item properties or notes you’ve added live in Shopify’s database, and Shopify does not sign a BAA.

That matters because of 45 CFR 164.502(e)(1)(i), which allows a covered entity to let a business associate “create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information.” That assurance must be documented in a written contract, as required by 45 CFR 164.504(e) and 164.308(b).

 

Three ways to handle it

Option 1: Keep Shopify, remove the clinical detail

Rename products and SKUs to something non-clinical, like “Monthly Plan A” or “Care Plan, Month 1.” Edit the notification templates to drop line items, and replace the body with something generic. Keep the clinical specifics (drug, dose, directions) in your EHR or pharmacy system, which is covered by a BAA.

 

Option 2: Turn off Shopify’s native emails and send from a compliant platform

Disable Shopify’s order confirmation and trigger your own message through a secure sending service. When the order is placed, your system builds the message, and a HIPAA compliant email platform delivers it. This is where a tool like Paubox’s email API works, it handles encryption and delivery so the email itself is secure, and the patient receives it in their normal inbox without a portal login.

This addresses the Security Rule’s transmission standard, 45 CFR 164.312(e)(1), which requires covered entities to “implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.”

This lets you include more useful details, like shipment timing or what to expect when the package arrives. You still have to manage the order record because sending securely doesn’t change what Shopify stores.

 

Option 3: Move order processing out of Shopify

If your catalog and checkout are tied to prescriptions, consider a platform that will sign a BAA.

 

What the confirmation can safely say

A compliant confirmation tells the patient the order was received, an order reference, and where to find more. It leaves out the drug name, dose, quantity, diagnosis, and anything about why they’re being treated.

This follows the minimum necessary standard. Under 45 CFR 164.502(b)(1), a covered entity “must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.” If you’re sending from a secure channel, you have more room, but apply the minimum necessary standard either way.

 

Where marketing enters the picture

Under 45 CFR 164.501, marketing generally means “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” There are exceptions for treatment and healthcare operations, unless you receive financial remuneration from a third party whose product you’re promoting. If a manufacturer is paying you to promote its product, 45 CFR 164.508(a)(3) requires patient authorization before you use or disclose PHI for that marketing.

The refill reminder exception follows a similar logic. It’s written into the 164.501 definition itself, which excludes communications made “to provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication.”

 

A decision checklist

Before you rely on Shopify for any patient-facing email, consider these:

  • Does the email contain a drug name, dose, condition, or anything implying treatment?
  • Does the sender name or domain reveal the type of care?
  • What’s in the Shopify order record, including notes, tags, and line item properties?
  • Is anyone paying you to promote a product in this message?
  • Is there a secure channel for anything beyond “your order was received”?

Read also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQs

Does HIPAA apply to every telehealth company?

HIPAA applies to covered entities (such as providers and health plans) and their business associates, so a telehealth company is covered if it provides care and handles health data electronically in connection with standard transactions like billing.

 

Do I need patient consent to send order or shipping emails?

HIPAA generally permits communications for treatment, payment, and healthcare operations without a separate authorization.

 

Is standard encryption enough to make an email HIPAA compliant?

Encryption is an important safeguard, but compliance also depends on access controls, a BAA with the sender, and policies around how the message is used.