An email service provider (ESP) is the platform that sends your email for you. It stores your recipient list, holds your templates, merges patient details into each message, sends at scale and logs what happens to every send. Most of the well-known ones are built for marketing newsletters, and most won’t sign a business associate agreement (BAA) for PHI. You can only send pharmacy shipping emails with an ESP that signs a BAA. If the platform won’t sign one, you cannot use it.

 

A shipping notification is PHI

PHI is health information that identifies a person and relates to their care, and a shipping email has both. The recipient’s name and email address are identifiers. The message tells the inbox that this person is receiving a prescription from your pharmacy.

The tracking number is a unique number tied to one patient’s shipment, and the carrier’s tracking page may show the sender, the destination and the delivery timeline. The HIPAA Privacy Rule’s list of identifiers includes “any other unique identifying number, characteristic, or code” (45 CFR 164.514(b)(2)(i)(R)), so a tracking number paired with a patient’s name is PHI.

Regulators treat that list as sensitive as well. In its case against BetterHelp, the FTC alleged the company used consumer email addresses combined with therapy history to build Facebook ad audiences. The company had disclosed email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising. The FTC brought that case under the FTC Act, not HIPAA, but it shows that an email address attached to a health relationship is enough to trigger enforcement.

Learn more: Is a shipment notification PHI?

 

Why your ESP is a business associate

HIPAA’s definition of a business associate covers a person who, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter”. An ESP does all of that. It stores your list, merges patient data into messages, logs delivery events and queues messages on its servers.

When a vendor is a business associate, the covered entity must have written satisfactory assurances in place before the vendor handles PHI, and the regulations at 45 CFR 164.502(e), 164.504(e) and 164.308(b), provide what the contract must contain. That contract is the BAA.

The “conduit” exception doesn’t count in this regard. It covers transient transmission, like the postal service or a pure internet carrier. HHS addressed the line in the preamble to the 2013 Omnibus Rule and has stated that a service that stores PHI isn’t a conduit, even if the data is encrypted and the vendor holds no key.

 

A BAA is necessary

If your ESP will sign a BAA, these four things must be checked:

  • Scope. Does the BAA cover the specific product and plan you use? Some vendors sign only for certain tiers or services.
  • Transport security. The Security Rule’s transmission security standard requires you to “implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network”.
  • Tracking. Open and click tracking records IP addresses, devices and timestamps against an individual patient. Know what the vendor collects, and turn off what you don’t need.
  • Data handling. Ask where lists, templates and logs are stored, who can access them and how long they’re retained.

Paubox signs a BAA and delivers encrypted messages straight to the patient’s inbox, so patients don’t have to log into a portal to read a shipping notice. That matters for telehealth companies with no portal and no front desk.

Read also: How to know if you’re a business associate

 

Where marketing comes in

A shipment notice isn’t marketing. It’s part of fulfilling the order, so it needs no patient authorization. That changes if you load the email with promotion. The Privacy Rule defines marketing as “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service”. Under 45 CFR 164.508(a)(3), a covered entity “must obtain an authorization for any use or disclosure of protected health information for marketing” unless the communication is a face-to-face communication or a promotional gift of nominal value. An email is neither. The rule also removes several communications out of the definition of marketing:

  • Refill reminders. The definition excludes a communication “to provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual,” but only if any financial remuneration you receive for sending it “is reasonably related to the covered entity’s cost of making the communication.”
  • Your own products. The definition also excludes a communication “to describe a health-related product or service” that you provide, but not where you receive financial remuneration in exchange for making the communication.
  • Third-party money. The regulation defines financial remuneration as “direct or indirect payment from or on behalf of a third party whose product or service is being described.” If another company is paying you to promote its product, you’ll need authorization, and the authorization must state that such remuneration is involved.

Read also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQs

Does my staff need HIPAA training?

Yes, covered entities must train all workforce members on their privacy and security policies.

Read also: Paubox Security Awareness Training

 

Does encrypting an email make it HIPAA compliant?

No, encryption is one important safeguard, but you still need a BAA with your vendor and the other required administrative, physical, and technical protections.

 

Do my vendor’s own subcontractors need a BAA too?

Yes, a business associate that passes PHI to a subcontractor must have a BAA with that subcontractor as well.