Yes, as a covered entity, you can email a patient regarding their treatment under HIPAA. There are some caveats, but when they are followed, a provider can email a patient about a GLP-1. It just opens up the question of whether it's considered a marketing message. You can use the refill-reminder provision to determine if certain drug-related messages are exempt from HIPAA's marketing classification.

The HIPAA Privacy Rule and Refill Reminders first ask if it is about "a currently prescribed drug or biologic." As we will look at, how you are securely delivering that and determining whether patient authorization is required are two separate matters.

 

Keep routine subject lines discreet

HIPAA does not expressly prohibit a medication name in a subject line. However, a subject line may appear in a notification preview or shared inbox, so a discreet subject such as “An update from your care team” is a prudent privacy practice. Place detailed prescription information in the protected message body.

You can say "Update from your telehealth provider" in most cases and have the drug information in your encrypted message. Make sure to follow this best practice for your preview text too. Allow the patient to communicate with you how they please if they ask.

 

Send prescription details as part of care

HIPAA allows for communications related to treatment to occur without authorization. It allows you to send an email that states what medication the patient is on, helping the patient continue to stay well through secure means. Make sure to keep in mind any automated messages you send will need to align with the patient's current orders.

A 2025 retrospective study in JAMA Network Open used electronic health-record data from US healthcare systems to examine 125,474 adults with overweight or obesity who started liraglutide, semaglutide, or tirzepatide. Estimated one-year discontinuation was 64.8% among participants without type 2 diabetes and 46.5% among those with type 2 diabetes.

 

Protect delivery and respect patient preferences

According to the HHS guidance, when sending emails, you should have controls for who can access the information. You need to have safeguards against alteration and ensure secure transmission.

Encryption is an addressable security rule specification. After a risk assessment, an organization must implement it when it is reasonable and appropriate for protecting electronic protected health information (ePHI). If it determines that encryption is not reasonable and appropriate, it must document that decision and consider an equivalent alternative safeguard. Encryption helps protect email in transit, but it does not by itself prevent every unauthorized disclosure.

Paubox’s 2026 healthcare email security report analyzed 170 email-related healthcare breaches reported in 2025 and found that 74% of the breached domains lacked effective DMARC enforcement. DMARC helps receiving mail systems authenticate a sending domain and handle messages that fail authentication; it is not an encryption control.

 

Keep refill reminders tied to the prescribed drug

An HHS FAQ on the topic includes refill reminders, medication-adherence messages, and communications about delivery systems for self-administered drugs within the refill-reminder exception to HIPAA’s marketing definition. A reminder about an existing GLP-1 prescription can therefore qualify without marketing authorization.

Under HHS refill-reminder guidance, payments from a manufacturer or another third party whose product is described must be reasonably related to the covered entity’s communication costs. The restriction concerns payment for making the communication; ordinary payment for treatment is excluded from HIPAA’s definition of financial remuneration.

An offer to switch from semaglutide to tirzepatide falls outside this exception, as does a message promoting a specific additional drug for side effects. Assess those messages under another permitted basis, even when they appear alongside a refill reminder.

 

Secure delivery cannot authorize a campaign

Paubox states that its Email API supports automated messages from healthcare applications and that every plan includes a signed BAA and TLS 1.2+ encryption by default. These features support secure delivery; they do not determine whether a message is treatment or marketing, and they do not replace clinical review.

These are the key takeaways to consider when applying it. It remains your responsibility to ensure a permitted use is established, the prescription status supports the applicable exception, and HIPAA authorization, when required, is obtained for marketing. While encryption offers robust security, it won't legitimize marketing efforts directed at your patients, nor will it permit you to advise them on restarting medications or validate any sales pitches.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Can I send out a refill reminder with a weight loss offer?

It is best to keep them separated, as there can be a promotion for another product/service that may not fall under the refill reminder exception.

 

If a patient's prescription is open but they have not placed an order, what should we do?

Make sure you are using their prescription information, not just order history, and focus on their current therapy/clinical evaluation.

 

Can I email the patient to their personal email rather than the business email?

Patients can ask to communicate via alternate ways or locations, so yes, allow this if asked.

 

Would an urgent issue about medication be ok to send over email?

Email may supplement an urgent response, but it should not be the sole channel when immediate clinical action may be needed.