HIPAA does not have a marketing exception for email. 45 CFR 164.508(a)(3) allows a covered entity to market without authorization if the communication is in person or includes a promotional gift of nominal value. Many emails aimed at winning patients back or promoting offers won't require authorization, as they aren't considered marketing.

For telehealth companies that engage patients directly, this will be a common occurrence. Patients can intake, refill, and be re-engaged through email. A 2025 JAMA Network study found that patients can be obtained quickly, depending on the space. Weightloss-related healthcare programs, for instance, have both steady increases and decreases in patient numbers.

Marketing must always be HIPAA compliant, but many rules depend on what you are marketing to patients, who is paying for it, and how long they have been lapsed. Organizations should also evaluate every email they send based on the type of service sending it. Paubox reported 170 healthcare breaches through email in 2025 that were reported to the government.

 

What makes an email marketing under HIPAA

45 CFR 164.501 states that marketing is any communication that encourages the recipient to purchase or use a product or service. There are exclusions for refill reminders, treatment and care coordination, as well as a description of health-related services the covered entity offers.

If a third party pays you, only the refill reminder exclusion survives, and only when the payment is reasonably related to the cost of the message. Identical content might fall outside marketing in one email yet count as marketing in the next.

Patients also care about why their data is being used. Researchers in a JAMA Network survey of 3,539 Americans found that "the purpose of data use mattered most to consumers" when considering if they would share their health information. Given that these scenarios were hypothetical, it stands to reason that consumers might have responded differently had the purpose been different.

 

Why the face-to-face exception never reaches the inbox

One of the marketing exceptions allows a covered entity to communicate with a person in person. The HHS's marketing guidance gives the example of an agent who sells you a health insurance policy and then advertises another product during that same encounter.

Email does not qualify for this exception. Even if you speak with the patient live and then email them about an offer that is considered marketing, you will need an authorization. Many telehealth companies will not have that encounter with their patients. These companies advertise to patients that they can receive their care from the comfort of their home and email will be how organizations advertise offers to them.

 

What a promotional gift of nominal value covers

A covered entity can send a promotional gift of nominal value without authorization. An example from HHS is giving new mothers baby formula and a free gift pack of baby supplies. There is no amount defined that qualifies as nominal value.

The exception is meant to cover the gift. Sending a branded medication organizer with a refill is an example of a gift you can send. A credit isn't a gift, so the nominal-value exception doesn't cover it. Assess it under the marketing definition.

Studies have shown that incentives can motivate people toward certain behaviors. In 2014, there was a PLoS One meta-analysis of 16 studies conducted in high-income countries that found "financial incentive interventions are more effective than usual care or no intervention." People who received an incentive were 1.9 times more likely to get vaccinated or screened for disease. Most of these studies looked at helping people quit smoking, so it may not be applicable to other scenarios.

 

When a win-back email counts as a refill reminder

If your patient has been lapsed for less than 90 days, you can treat your email as a refill reminder. The HHS states that a patient is considered lapsed if their prescription has run out within the past 90 calendar days and any payment is reasonably related to the cost of the message.

If your patient has been lapsed for longer than 90 days, your email is not a refill reminder. You may be able to market your offer to the patient without an authorization, but we will cover that later.

Sending a reminder that your medication has run out has been shown to help increase adherence in the short term, but "long-term effects remain unclear." If you are going to include what medication the patient should restart in your email, that is protected health information (PHI), and you need to use a HIPAA compliant email service with a business associate agreement (BAA) in place.

 

When a win-back email describes your own services

As stated earlier, patients that have been lapsed for over 90 days can still receive emails from you about a service you provide without authorization. As long as no one else is paying you to send that message, it will not be considered marketing under HIPAA.

You can send an email to a patient telling them to come back to your clinicians to continue their weight journey. Creating segments of patients that have stopped taking a specific medication will create a list of PHI. Paubox Marketing can be used to send these emails to your dormant patients and they will be protected by our BAA. This includes information such as what medications they are taking and what treatments they have received.

 

How a third party's payment can impact compliance

If someone is paying you to market their offer to your patients, you will need an authorization. If you have a compounding pharmacy that wants to advertise their offer to your patients, you will need to get authorization from each patient before you send that email. Your authorization should also disclose that someone is paying you for this communication per 164.508(a)(3)(ii).

If you are including an offer from a partner in your standard newsletter, you are sending a marketing email to your patients. The only exception to this is refill reminders, and the payment must be reasonably related to the cost of the message.

Consumers did not like this usage of their data in the survey. They were less willing to share their health information if it was used to increase the amount of a diabetes medication a patient took by 0.40 points on a scale of five.

 

Your email platform needs to support PHI

If you are creating a list of lapsed patients, that is PHI. You need to make sure your vendor is going to sign a BAA and protect that information.

We found that Klaviyo does not sign a BAA and Amazon SES delivered email over TLS 1.0 and 1.1 in 14 of our tests. These are outdated forms of encryption that were retired in 2021.

Make sure to check if you are using tracking on your campaign emails as well. In a 2023 study of US hospitals, 98.6% had some form of third-party tracking on their website. This means that "hospitals are facilitating the profiling of their patients by third parties."

Read also: Is Klaviyo HIPAA compliant? (2026 update)

 

How to collect authorization by email when it applies

Certain elements need to be included in your marketing authorization per 164.508(c). What information do you plan to share, who you will share it with, and for what purpose? You should also include when the authorization will expire and have the patient sign and date the document. Make sure to write your authorization in plain language and let the patient know that they can revoke the authorization at any time by notifying you in writing. You will need to give the patient a copy of the signed authorization as well.

You cannot include the authorization with other documentation such as terms of service and cannot condition treatment on the patient authorizing you. You should have the patient give you this authorization after they check out on their own.

 

Problems HIPAA compliant email can't solve

Having a HIPAA compliant email service will help you keep your patients' information safe. But it will not tell you if your offer is exempt from marketing or if you have a valid authorization from your patient.

There are other laws you need to follow when sending emails to your patients. You need to abide by the CAN-SPAM Act and provide patients a way to opt out of your marketing emails. In a 2025 PNAS NEXUS study of US hospital websites, they found that 66% of sites used pixel tracking between 2012 and 2023. There is "a critical regulatory gap in healthcare privacy" when it comes to technologies that HIPAA isn't intended to protect.

 

FAQs

Are fundraising emails treated the same as marketing emails under HIPAA?

No, under 45 CFR 164.514(f), a covered entity may use limited PHI, such as demographics, dates of service, and treating physician, for its own fundraising without authorization, provided its notice of privacy practices says so and each fundraising email offers a clear and conspicuous opt-out.

 

Can a telehealth company share its patient email list with a partner brand?

Only with each patient's authorization, and when the company is paid for the list, the authorization must also state the disclosure will result in remuneration under 164.508(a)(4).

 

Does a marketing authorization last indefinitely once a patient signs it?

No, the authorization must name an expiration date or event, and the patient can revoke it in writing at any time, except to the extent the covered entity has already acted on it.