What you can put in a GLP-1 shipment notification email depends on where the email is sent from. With a platform that signs a BAA, you can include the drug name, dose, tracking number, and delivery details. Through a platform that doesn't offer a BAA for this use, you shouldn't include any of that information.

 

Why a shipment notice is PHI

A shipment notification from a telehealth company is PHI under HIPAA. An email that says "Your semaglutide has shipped" links a named individual to a prescription drug. That identifies the person as a patient of the practice and discloses treatment for a specific condition. The name, email address, drug, and treatment are individually identifiable health information.

The same applies to the other parts of the message:

  • Drug name. Semaglutide or tirzepatide anywhere in the message, including the subject line, ties the patient to a prescription.
  • Dose. "Your 0.5 mg pen" is a clinical detail about treatment.
  • Tracking number. A tracking number alone is not clinical. In an email from your company to a patient about a shipment, it is part of a record showing the patient received a prescription from you. Treat it as PHI. Anyone with the number can often see the destination address.
  • Delivery address. It is identifying information associated with a treatment relationship.
  • Company name. If your company is known for weight loss care, the email can disclose the relationship.

Since all of this is considered PHI, the platform that transmits and stores the email is your business associate. HIPAA requires a signed BAA with that platform. Without a BAA, PHI cannot go through it.

 

What you can include when the sender signs a BAA

A BAA-covered email platform encrypts email so the message and its contents are protected in transit and handled in a compliant way. With that in place, the email can include what the patient needs:

  • The patient's name
  • The medication name and dose
  • Quantity and how to store it
  • The carrier, tracking number, and tracking link
  • Expected delivery date and whether a signature is required
  • Injection and refill instructions, or a link to them
  • What to do if the package arrives warm, damaged, or late
  • A reply-to address

Under the Privacy Rule, communications about a prescribed drug are not treated as marketing in the way promotional messages are. HHS's refill reminder guidance explains that the exceptions exist so "essential healthcare communications are not impeded." Its marketing guidance gives a provider that "mails prescription refill reminders to patients" as an example of a communication that is not marketing. Where a patient is prescribed a self-administered drug, OCR FAQ “What types of communications fall within the “refill reminder” exception to marketing?” says communications about "all aspects of a drug delivery system" fall within the refill reminder exception.

 

Shipment notice vs. marketing email

The regulation defines marketing in 45 CFR 164.501 as, “(1) Except as provided in paragraph (2) of this definition, marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. (2) Marketing does not include a communication made: (i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication. (3) Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described.”

When a communication does count as marketing, 45 CFR 164.508(a)(3) requires patient authorization, “(i) ...a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of: (A) A face-to-face communication made by a covered entity to an individual; or (B) A promotional gift of nominal value provided by the covered entity. (ii) If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.”

HHS's refill reminder guidance explains that face-to-face communications do not include communications by telephone, mail, or email. The face-to-face exception therefore won't cover a shipment email that carries promotional content.

 

What counts as inside the refill reminder exception, and what doesn't

HHS's refill reminder guidance draws the line this way.

Within the exception:

  • Refill reminders
  • Communications about generic equivalents of the prescribed drug
  • Communications about a recently lapsed prescription, meaning one that lapsed within the last 90 calendar days
  • Adherence communications encouraging patients to take the medicine as directed
  • For self-administered drugs, communications about all aspects of the drug delivery system

Not within the exception:

  • Communications about specific new formulations of the currently prescribed medicine
  • Communications about specific adjunctive drugs related to the currently prescribed medicine
  • Communications encouraging a patient to switch to an alternative medicine

A shipment email that says "Store your pen in the refrigerator" or "Your next refill window opens on the 14th" is on the safe side. One that pitches an add-on supplement, a different GLP-1, or a new formulation is a different kind of message, and sending it through a secure channel doesn't change that. HHS notes that these communications can sometimes be made in other ways, such as under the treatment exception when the covered entity receives no financial remuneration, or with the patient's authorization. Whether a given promotional message counts as marketing under HIPAA depends on whether a third party is paying for it.

 

What happens if the platform won't sign a BAA

If your shipment emails go through a general-purpose email or marketing platform, or an e-commerce platform's default notifications, check whether that platform will sign a BAA for the data in your messages. Where a BAA is not offered, careful wording cannot fix that, because the email address plus the fact that someone is your patient is already identifying.

There are two options:

  1. Move the shipment notice to a BAA-covered email platform. Patient data, drug names, and tracking numbers then pass through a system that is contractually accountable for them.
  2. Remove the PHI if a non-BAA platform must be used. Remove the drug, dose, tracking number, and any company name that reveals the service.

 

Common mistakes

  • Putting the drug in the subject line because the body is encrypted. Subject lines are often handled differently from message bodies in transit, and they display on lock screens and in previews. Use a platform that protects the whole message, and keep subject lines minimal.
  • Relying on the carrier's email. A shipping carrier's tracking emails are the carrier's communication. They do not replace your own notification, and their content should not be forwarded through a tool that has no BAA.
  • Syncing shipping data into a marketing platform. If your order system sends shipment events to a marketing platform, PHI has been sent to a platform without a BAA. The integration is the violation, in addition to the email.
  • Adding promotions to the shipment email. Upsells, add-on products, referral offers, and "switch to our new formulation" messages fall outside the refill reminder exception described above. Keep them out of the shipment notice and review them separately.

 

A practical standard

Ask three questions before you send any shipment via email.

  1. Does this platform sign a BAA for the data in this message?
  2. Is the content limited to what the patient needs to receive and use the medication?
  3. Is anything in it promotional, meaning does it encourage the patient to buy or use something besides the drug they are currently prescribed?

Paubox signs a BAA and encrypts email, so shipment notices with the drug name, dose, and tracking details can be sent through it.

For a direct-to-patient company with no portal, the shipment notification is one of the most-read messages you send. It should include what the patient needs and be sent through a platform covered by a BAA.

Read also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQs

Can a shipment notification email mention the medication name?

Yes, but only if the email is sent through a platform that has signed a BAA, since the drug name connects a named patient to a prescription.

 

Does a general-purpose email platform ever work for health-related shipment notices?

Only if the vendor will sign a BAA for that data, otherwise the message must not contain anything that reveals treatment.

 

Who counts as a business associate in an email workflow?

Any vendor that transmits or stores protected health information on your behalf, including your email platform.

 

Is PHI limited to medical records and lab results?

No, even a name and email address combined with the fact that someone is your patient can qualify as PHI.