You can personalize a healthcare email as long as the email relates to treatment, payment, or operations and the entity uses reasonable safeguards. It can include a patient's name, provider, and appointment information. You need to be aware of what your merge fields disclose, such as whether it promotes a product, and which service you use to send it.

The HHS has given us some guidelines. They note that it is allowed for covered entities to send emails to patients as long as reasonable safeguards are used. They don't say email cannot be sent unencrypted when discussing treatment. However, they do suggest not including too much information. This leads us to look at each merge field.

 

Use merge fields for treatment and operation messages

Appointment reminders can include the patient's name, provider, and time of appointment because it is considered treatment or operation. If you have an orthopedic doctor, you can include their name in the patient's postoperative instructions and even when they should come for physical therapy. As stated above, there are many things that you can include in your email. But as we know, the HHS suggests not including too much information. You should consider what information the patient will need to receive the reminder.

 

Expect modest gains from personalization

A Journal of General Internal Medicine letter looked at sending personalized text messages to patients who were due for an HbA1c test at an urban academic primary care clinic in Boston. Patients were randomized to receive a generic text or one that included the name of their primary care physician. The author concluded that it "could be more effective" and had an increase of one additional patient getting their test for every nine personalized texts that were sent. In a randomized trial with members of Clalit Health Services, they found that using different types of reminders can lead to "a marked decrease in no-show rates." So again, personalizing your messages can help decrease no-shows.

 

Treat promotional personalization as marketing

According to HIPAA any communication that promotes a product or service and encourages the recipient to purchase or use the product or service is marketing. Reminders regarding refills or products that are already being taken by the individual are not considered marketing if the payment received is reasonably related to the cost of the communication. This also applies to your facility's services if no third party is paying for the communication.

If a third party is paying for the communication then yes, you will need the patient's authorization. According to HHS face to face communication does not include email. If you want to personalize a message to your patient that promotes another company's product, you will need their authorization.

 

Honor channel and content preferences

Your patients can request that you send information to them through alternate means. If a patient asks you to send them email instead of a postcard for their appointments. You should accommodate this request. If they want to receive their information through something that is encrypted, you should provide them with other options. You can assume that if they initiated communication with you through email that it's okay to send them information through that channel. Unless they inform you otherwise. You don't have to get the patients' permission to email them. You can just make sure that they have their preference listed in their chart.

Read also: The HIPAA Privacy Rule and email communication with patients

 

Confirm the sending service has a business associate agreement (BAA)

If you're using a service that will be creating, receiving, maintaining, or transmitting protected health information (PHI) on behalf of your entity, they are considered a business associate. You will need to make sure that you have satisfactory assurances through written consent with that service. If you're using a merge field that will pull a diagnosis or medication status, that will be considered PHI. Another thing to note is from the Paubox 2026 Healthcare Email Security Report, they found that if your organization has encryption that is done manually, they can choose to send it through their portal. They are more likely to have accidental disclosures. Since you will be sending out personalized emails, it's best to have your email encrypted every time.

 

FAQs

Do providers need patient consent before sending personalized emails?

HHS does not require patient consent for treatment-related email sent with reasonable safeguards, but providers must accommodate reasonable requests for other communication methods.

 

Does adding a medication name to a reminder make it marketing?

A reminder about a drug currently prescribed to the patient falls outside the marketing definition when any third-party payment is reasonably related to the cost of sending it.

 

Does encryption make any personalized content acceptable?

No, encryption protects the message in transit, but the content still needs a permitted purpose, and third-party-paid promotion still requires authorization.