Yes. A shipment notification from a direct-to-patient telehealth company is PHI. It should be sent through an email platform that will sign a BAA. If a platform won't sign one, it shouldn't be used to send the message.

 

Why ‘your order shipped’ is PHI

PHI is individually identifiable health information that a covered entity creates, receives, or sends. It relates to a person's health condition, their care, or payment for that care. A shipment notification from a company has both elements, even when it names no drug.

The name and email address identify the recipient. The sender relationship, a prescription telehealth company writing to a customer, tells the reader that this person is receiving treatment. Then add what these emails usually contain:

  • The patient's name and shipping address
  • A tracking number tied to a package of prescription medication
  • An order summary, often with a drug name
  • Treatment-plan timing, such as "your month 2 refill has shipped"

A tracking number alone may look harmless to send, but it links a named person to a delivery of prescription drugs, so it should be treated as part of the record of care.

Telling a patient their medication is shipped is part of delivering their treatment. HHS's marketing guidance says a communication made for treatment of the individual isn't "marketing," and its example is that a provider mailing refill reminders to patients is not marketing. That means no authorization is needed for a plain shipment notice.

 

Where the risk is

If a shipment notification is PHI, any platform that sends, processes, or stores it is handling PHI for you. That makes it a business associate, and HIPAA requires a signed BAA first.

Many email and e-commerce platforms are built for retail and marketing, and they generally won't sign a BAA for this use. If your shipment emails go through one of them with patient names, order details, and treatment-related content, you're disclosing PHI to a vendor with no BAA. The wording of the message doesn't change that.

So the answer depends on the platform:

  • A platform that will sign a BAA and is built for secure email: yes, it's PHI, and you can send it.
  • A platform that won't sign a BAA: no, it shouldn't send the message. The notification is PHI whether or not the platform agrees.

 

Can you add a promotion to a shipment email?

A plain shipment notice needs no authorization. The problem starts when you add a promotion to it. The regulation at 45 CFR 164.501 defines it this way, "Except as provided in paragraph (2) of this definition, marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service."

Marketing requires patient authorization. Under 45 CFR 164.508(a)(3), "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing," with narrow exceptions. The ones the regulation lists are face-to-face communications and promotional gifts of nominal value, and neither applies to an email-only business.

 

Refill reminders are not marketing

The regulation states that, "Marketing does not include a communication made: (i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication."

The HHS's FAQ on the types of communications that fall within the “refill reminder” exception says the exception also covers "adherence communications encouraging individuals to take prescribed medicines as directed." So "your next dose ships Friday, here's how to stay on schedule" counts as an exception.

 

Remuneration is the trigger

The refill reminder exception only holds if you aren't being paid by a third party to send the message. The regulation defines that payment as "direct or indirect payment from or on behalf of a third party whose product or service is being described."

Some telehealth companies don't have this arrangement. If you do, for example a drug manufacturer pays you to send reminders about its product, HHS explains in "What is permitted remuneration for purposes of the 'refill reminder' exception to marketing?" that the payment can cover only your costs of sending the message, including "labor, materials, and supplies, as well as capital and overhead costs."

Non-cash benefits, such as supplies or equipment, don't count as financial remuneration, according to HHS's refill reminder guidance.

 

Lapsed patients have a clock

The exception covers prescriptions that lapsed recently, not indefinitely. In the FAQ titled, “Do communications about recently-lapsed prescriptions for a medicine fall within the “refill reminder” exception to marketing?”, HHS says that "once a prescription has lapsed for more than 90 calendar days," a message is no longer reasonably treated as a refill reminder. A reminder to someone who stopped two months ago is within the time period, however, one sent four months later is outside it. That doesn't automatically make it marketing, because a message about your own services can fall under a different exception but the refill reminder exception no longer covers it.

 

What to do in practice

  • Treat every patient email as PHI by default. Without a portal or a front desk, every patient interaction happens over email.
  • Move shipment emails off your marketing platform. Keep it for audiences and content with no PHI. Shipment, refill, lab result, and visit summary emails belong in a secure, HIPAA compliant channel.
  • Check what your shipping tool sends automatically. E-commerce and fulfillment integrations often send order and tracking emails from their own systems.
  • Keep shipment emails plain. State that the order shipped, when, and how to track it. Leave out diagnosis and condition.
  • Get the BAA in writing. Confirm it covers the messages you actually send.

Learn more: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQs

Do patients need to give permission before receiving a shipment notification?

No, because a plain shipment notice is part of delivering treatment, it doesn't require patient authorization.

 

Is a patient's email address considered PHI?

Yes, when it is linked to a person's health care, an email address is an identifier that makes the information individually identifiable.

 

Does using the word "confidential" or leaving out the drug name make an email HIPAA compliant?

No, compliance depends on how the information is handled and who handles it, not on the wording of the message.

 

Does HIPAA require emails containing PHI to be encrypted?

HIPAA doesn't mandate a specific technology, but it requires reasonable safeguards.