Abandoned-cart emails can mention a medication in some circumstances, but the message must qualify as a permitted healthcare communication under HIPAA. If the email encourages a patient to purchase a prescription or resume treatment, the provider needs to determine whether the message falls within an exception to HIPAA's marketing rules or requires the patient's authorization. Sending the email securely does not resolve that question.

For direct-to-patient telehealth companies, the distinction matters because a patient might complete an online consultation for weight loss, hormone therapy, or menopause care, receive a prescription, and then leave a medication order unfinished. An automated email reminding the patient to return to checkout may look like an ordinary e-commerce message, but it can involve protected health information (PHI).

The decision on whether or not the medication should be included in the email depends on what the email says, why it is being sent, and whether the communication falls within HIPAA's treatment or refill-reminder exceptions.

 

What if the abandoned-cart email is marketing?

If the email qualifies as marketing under HIPAA and uses or discloses PHI for that purpose, the provider generally needs the patient's prior authorization unless a specific exception applies. For example, a message encouraging a prospective patient to purchase a weight-loss medication or inviting a former patient to restart a hormone-therapy program may be promotional rather than a refill reminder. The fact that the provider offers the treatment itself does not automatically exempt every promotional communication from HIPAA's marketing requirements.

Providers should assess whether the email promotes a product or service, whether it uses PHI, and whether an applicable exception permits the communication. If authorization is required, it must meet HIPAA's requirements.

A general marketing consent or an email subscription alone should not automatically be treated as a valid HIPAA marketing authorization. The safest approach is to have the intended campaign reviewed before it is activated. This is particularly important when automated workflows use prescription status, treatment category, consultation history, or abandoned checkout data to determine who receives a message.

 

When can an abandoned-cart email mention a medication?

Under 45 CFR 164.501, marketing generally includes a “communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” The Department of Health and Human Services (HHS) defines marketing as a communication that encourages recipients to “purchase or use the product or service.” Under 45 CFR 164.508(a)(3), covered entities generally need an individual's prior authorization to use or disclose PHI for marketing, subject to limited exceptions.

One important exception covers prescription refill reminders. HHS explains that the exception applies to “refill reminders and other communications about a drug or biologic that is currently being prescribed for the individual.” It can also cover medication-adherence communications, generic equivalents, and certain recently lapsed prescriptions. These communications can be sent without a separate marketing authorization when the applicable requirements are met. However, an abandoned-cart email does not automatically qualify for this exception. A patient who completes a telehealth consultation but leaves before purchasing a prescribed medication may be in a different position from someone who needs to refill an existing prescription. If the email is intended to encourage a new purchase rather than support ongoing treatment, the provider must assess whether it constitutes marketing and whether authorization is required.

HHS also makes a distinction between current and recently lapsed prescriptions. Its guidance states that communications about prescriptions that lapsed within the previous 90 calendar days may qualify for the refill-reminder exception, subject to the applicable conditions. That does not give telehealth companies blanket permission to send promotional win-back emails to former patients.

For direct-to-patient telehealth companies, the practical takeaway is to assess the purpose of the email, the patient's prescription status, and the content of the message before including a medication name. Making an email secure does not make an otherwise impermissible marketing communication permissible under HIPAA.

 

How should telehealth companies handle abandoned-cart emails?

Telehealth companies can reduce unnecessary PHI exposure by separating transactional, treatment-related, and promotional communications in their email workflows.

Before launching an abandoned-cart sequence, providers should:

  • Identify the purpose of the message: Establish whether it is intended to support an existing treatment, complete a transaction, or promote a product or service.
  • Check the prescription status: Do not apply the refill-reminder exception to every patient who has an unfinished order.
  • Review the 90-day limit: For recently lapsed prescriptions, document when the prescription lapsed and confirm that the communication meets the other requirements of the exception.
  • Obtain authorization when required: Do not rely on a general subscription or marketing preference as a substitute for a HIPAA compliant authorization.
  • Limit unnecessary information: Avoid including medication names, diagnoses, or treatment details in subject lines and message previews when they are not needed.
  • Review the email platform: Confirm whether the provider is disclosing PHI to the platform and whether the vendor can support the required HIPAA safeguards and business associate agreement (BAA).

These checks should form part of the campaign design, rather than being left to individual marketing staff when an email is written.

 

Can a secure email platform make the campaign HIPAA compliant?

Secure email addresses the protection of communications; it does not determine whether the communication itself is permitted under HIPAA. A provider might use encryption and other safeguards to protect an abandoned-cart email, but those controls do not replace a required marketing authorization. Similarly, a campaign that qualifies as a permitted treatment communication still needs appropriate safeguards when PHI is sent electronically.

The email platform also matters. If a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, it may be a business associate and generally needs an appropriate BAA. Providers should not assume that a standard account with an ecommerce or marketing platform is suitable for PHI simply because the service supports email automation.

Paubox helps healthcare organizations protect email communications. Providers must separately determine whether an abandoned-cart campaign is permitted under HIPAA and whether the systems involved are appropriately configured and contracted.

See also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQS

Can I send an abandoned-cart email without naming the medication?

Yes, where the underlying communication is otherwise permitted. Using neutral wording can reduce the amount of sensitive information exposed in an inbox or notification, but it does not remove HIPAA's requirements for the use or disclosure of PHI.

 

Can I include a medication name in an abandoned-cart email subject line?

It is best to consider using a neutral subject line to limit the health information visible in inbox previews.

 

Does removing the medication name make an abandoned-cart email HIPAA compliant?

No. Removing the medication name may reduce the PHI exposed in the subject line or message preview, but it does not determine whether the underlying communication is permitted under HIPAA.