HIPAA allows for certain exceptions to its marketing rules. When a communication falls under one of these exceptions, a covered entity can use PHI to contact patients without first collecting their authorization. These exceptions cover refill reminders, messages about treatment and care coordination, and informing patients about health-related products or services you offer. So long as no third party is compensating you, such messages fall outside the definition of marketing (refill reminders may be paid for according to cost). Face-to-face communications and gifts of nominal value are exempt from the authorization requirement for marketing.

An exception to marketing doesn't automatically ensure secure delivery of the email to the patient. The Paubox 2026 Healthcare Email Security Report analyzed 170 email breaches disclosed to the HHS in 2025 and found 74% of the breached organizations had no DMARC policy or were only monitoring their domain. Whenever you email patients about medication refills or share news that your clinic is open, make certain your marketing and the email's delivery path stay compliant.

 

What HIPAA counts as marketing

HIPAA defines marketing under 45 CFR 164.501 as any communication about a product or service that encourages the recipient to purchase or use such product or service. This will require patient authorization unless the communication falls under an exception. One example the HHS provides is if a hospital markets to patients who no longer go to their facility about a cardiology facility that is not affiliated with them. Telling these patients they can receive an EKG for $39 at this facility is considered marketing. Disclosing PHI to another company in exchange for payment, so the company can promote its own products, also requires patient authorization. According to HHS, there are no exceptions to this section of the definition.

Patients also understand the difference between marketing and research. Grande et al. surveyed 3,336 US adults about how they felt when given examples of healthcare marketing and research. The respondents were less likely to share their health information if it was used for marketing purposes. They "cared most about the specific purpose for using their health information." So it should be the first thing your organization reviews when developing your marketing campaign.

Refill reminders about a current prescription

It is permissible to market to patients about a drug they are presently taking or a biologic. Any payment from a pharmaceutical company for refill reminders has to bear a reasonable relationship to the expense of the reminder itself. Under the HHS refill reminder guidelines, you may notify patients about generic alternatives, support their adherence to the medication, share information on how to administer the medication if they self-administer, and reach patients whose prescription lapsed within the last 90 calendar days. The guidelines will not allow you to tell patients about new formulations or specific drugs that could help their condition or another drug they should take instead.

In a Dovepress study by Taitel et al., researchers examined 735,218 Medicare Part D patients who were late refilling their maintenance medications. Conducted by the pharmacy chain, the study showed a 6.09 percentage point increase in refill rates within 14 days due to reminder calls. They determined that reminder calls "increased adherence for Medicare Part D patients who are late in refilling," but email may give different results. A reminder email naming the patient's medication contains PHI. When researching how PHI is at risk through Amazon SES, we found that in 14 different tests, Paubox was able to send an email with PHI in it over an unencrypted connection. Paubox Email API ensures TLS 1.2 or higher is used, and we have a BAA in place for all plans.

Read also: What is the HIPAA refill reminder exception?

 

Treatment and care coordination messages

The second exception to the marketing rule permits you to communicate with a patient about their treatment when no payment is involved. Information about case management and care coordination can be sent to patients. You can also recommend an alternative treatment, provider, or setting of care. If a patient's PCP refers them to a specialist, that can be communicated to the patient as well.

The exception will save you time on having to collect authorizations, but the email still has to be effective. Szilagyi et al. studied 164,205 primary care patients who were contacted through their patient portal about the flu shot. They were able to increase the percentage of patients receiving the flu shot by 37.5% to 38.2%. They deemed the portal to be effective at "minimally increasing influenza vaccination rates."

 

Announcements about your own services

A covered entity may promote health-related products and services to the patients it serves. It also extends to network providers and supplementary services from their health plan. The HHS states that if a hospital markets to its patient list about a new orthopedic facility or MRI machine that it has added to its hospital, they can do this without authorization.

If a dermatology practice lets their patients know they are opening a skin cancer surgery suite, this would fall under the exception. If that same practice emailed their patients that there is a medical spa they can go to after their procedure, that would not fall under this exception. Any of these emails if a third party was paying for the service to be marketed, it would no longer be an exception.

A JMIR study surveyed 624 primary care patients in Ontario, Canada about receiving emails from their doctor. 73.2% said they would be okay receiving health-related information from their doctor through email. They determined that "email may be emerging as a viable avenue for patient communication." More testing will need to be done in the US to see if we get similar results.

 

When third-party payment removes the exception

Financial remuneration refers to payment you receive, directly or indirectly, from a third party for the product or service you're advertising to your patients. If a cardiology practice is being paid to send out an email to their patients about a product that allows them to remotely monitor their heart rate they would need to collect an authorization from each patient. According to the HHS, your authorization must also let the patient know you are being paid for this communication. In-kind benefits from a third party don't count as financial remuneration, so they don't remove the exception.

A JAMA Internal Medicine study analyzed 279,669 US physicians to see if being given free meals affected their prescribing habits. Receiving a single meal was associated with, "prescribing the brand-name medication at an increased rate." Although this study was about physicians and not patients, it is something to be aware of when creating your marketing campaign. Always know if you are being paid to advertise to your patients and document it.

 

Face-to-face conversations and nominal gifts

There are two types of marketing that you can do without collecting an authorization from your patient. 45 CFR 164.508(a)(3) states that face-to-face communications and promotional gifts of nominal value given by the covered entity are exempt from the authorization requirement." An example the HHS provides is a hospital can giving new mothers free formula and other baby products when they leave the hospital after birth.

Face-to-face communications can be sponsored by a third party and still not be considered marketing. Your pharmacist can speak to a patient about a different drug that may work better for them without collecting an authorization. This exception does not apply to calling or mailing your patients or sending them an email. If you send them the brochure you gave them during their visit, that would need an authorization or one of the exceptions mentioned above.

 

What an exception does not settle

Being allowed to market to your patients under an exception doesn't put you above all marketing laws. You will still need to follow CAN-SPAM rules if your primary purpose is to advertise to your patients. You may have to allow your patients to opt out of receiving your emails. There may be state laws that you have to follow as well when marketing to your patients.

The Grande et al. study also found that when patients were asked about their health information being used for research purposes without their consent, they felt it was more appropriate than if it was used to market to them with their consent. This was a study using scenarios, so more research will need to be done to see if this is true in the real world.

Learn more: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Are emails about Medicare or Medicaid eligibility considered marketing?

No, HHS states communications about government and government-sponsored programs fall outside the definition of marketing because they have no commercial component.

 

Does a refill reminder for a prescription lapsed four months ago fall under the exception?

No, HHS limits the exception to prescriptions lapsed within the last 90 calendar days, so the message would need another basis or the patient's authorization.

 

Does a marketing platform need a BAA to send excepted communications?

A BAA is required whenever the platform handles PHI on the organization's behalf, which includes the patient lists behind refill reminders and service announcements.