Most covered entities and business associates will find that the Iowa Consumer Data Protection Act (ICDPA) has little impact on HIPAA, but some organizations will need to keep it in mind. The ICDPA exempts any persons who are subject to and comply with HIPAA and also excludes protected health information (PHI) as a type of data.

Organizations should always keep email in mind. You could be emailing your patients, a referral partner, or someone who wants to become your patient, and they are all coming from the same inbox.

Iowa Code 715D went into effect on January 1, 2025. The exemptions to the legislation can be found in Iowa Code 715D. 2. For your organization, the key is determining which emails bypass HIPAA and which vendors handle those specific messages.

 

Who the ICDPA covers

Businesses operating in Iowa or targeting its residents fall under this legislation's purview. The law applies to businesses that control or process the personal data of at least 100,000 consumers, or 25,000 consumers while deriving more than half of their gross revenue from selling personal data in a calendar year. For the purposes of this act, a consumer is an Iowa resident not operating in a commercial or employment context.

The Iowa attorney general has exclusive enforcement authority. Fines can be up to $7,500 after a cure period of 90 days. There is no private right of action.

How the entity exemption works

Iowa Code 715D.2 excludes anyone that is subject to and complies with HIPAA and the HITECH Act. A 2023 article from a law firm indicated nine state laws that would exempt your entire organization if it qualifies as a covered entity or business associate. Iowa is one of those states.

 

Given the stipulation of being "subject to and comply with," it's crucial to ensure your organization is indeed adhering to HIPAA's mandates. Any deficiencies in your HIPAA expertise could be impacted by the Iowa ICDPA.

 

Which data does the exemption cover?

If information is intermingled with any of the above and cannot be distinguished from it or is considered to be treated the same, it is also excluded when maintained by a covered entity or business associate. An article in npj Digital Medicine from 2021 discusses this as well. "HIPAA's domain is not based on the "what'; it is the 'who.'"

 

How the ICDPA affects emails containing PHI

Under HHS guidelines, you as a provider are allowed to send emails to patients if they implement proper precautions. They do not require you to encrypt the email, but you can limit what information you put in the email. Organizations must also honor a patient's request if they would like a different method of communication.

Your Iowa practice sending lab results to a patient would follow the precautions HIPAA lays out and not the ICDPA request for information from consumers. "Patients want and expect their health information to remain protected and confidential" is a statement made in a Nature Portfolio article about HIPAA and texting in maternity care.

 

Where non-PHI email can fall outside HIPAA

Let's say your healthcare organization is sending out a newsletter to people that live in Iowa that are not patients of your facility. Those are not considered PHI. If your organization is a covered entity or business associate, the entity exemption will most likely cover you. But if you have another company that sends these emails that is not a covered entity or business associate, you will need to review if the ICDPA affects you.

You would have to notify your consumers if you were sending a list of information that was separated by a diagnosis. This would be considered sensitive data. Consumers have the right to access their information, delete their information, get a copy, and opt out of selling their data. You would have 90 days to respond to these requests.

 

Which contracts govern each vendor

You need to have a business associate agreement (BAA) with any vendor that handles or stores PHI. There is also a requirement to have a contract between the controller and processor when using the ICDPA. These contracts should state which instructions the processor will follow, how the information will be kept confidential, and how they will delete or return the information at the end of the contract. If you are using a marketing program that does not have PHI, you will need this contract.

Paubox Email Suite is compatible with Google Workspace and Microsoft 365. It will automatically encrypt your outgoing emails. If your recipient's email server does not support TLS 1.2 or higher, they will receive a link to view the message securely. A BAA is also provided with Paubox.

 

Why you need safeguards

In Paubox's Healthcare Email Security Report for 2026, we found that 170 healthcare-related breaches occurred from email in 2025. 53% of those were using Microsoft 365, and 74% of domains had an ineffective DMARC record.

These are only domains that were breached and do not represent all healthcare email. Encryption is still considered an addressable specification under the Security Rule, and the updated Security Rule has not taken effect yet.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Can the ICDPA apply to a business outside Indiana?

It can apply to an out-of-state business targeting Indiana residents when the statutory thresholds are met, and no exemption applies.

 

Does the ICDPA cover employee records?

Data collected and used within an employment or job-application context is generally exempt from the ICDPA.

 

Who enforces the ICDPA?

Indiana’s attorney general has exclusive authority to enforce the ICDPA.