With a platform that signs a business associate agreement (BAA), the subject line can carry order status, an order number and the medication name. A disclosure to the patient of their own information is permitted. Organizations can limit the subject line to status wording and a brand name, and keep the medication, dose, tracking number and delivery details in the body, because subject lines appear on lock screens and in shared inboxes. With a platform that won’t sign a BAA, nothing can go in the subject line, because the notification cannot be sent through that platform.

Read also: Can a shipment notification include the medication name?

 

A subject line is part of the message

HIPAA has no exemption for subject lines. Protected health information (PHI) is individually identifiable health information relating to the provision of healthcare, created or transmitted by a covered entity or its business associates. A subject line sent to a specific patient’s email address by a prescribing telehealth company meets the definition of PHI.

These subject lines are all PHI when sent to an identified patient:

  • “Your semaglutide has shipped”
  • “Your testosterone refill is on the way”
  • “Order #4471 has shipped”
  • “Your estradiol prescription was delivered”

The third contains no drug name, yet it still discloses that the recipient is a patient with an open order.

Learn more: Writing a HIPAA compliant subject line

 

What can go in the subject line, by exposure

Once a BAA is in place, the choice is about exposure, not legality.

Lowest exposure

Safest default “Your order has shipped”

“An update on your [Brand] order”

Higher exposure

Still permitted “Order #4471 has shipped”

“Your [medication name] has shipped”

 

Avoid

Don’t use Condition names, such as “Your menopause treatment is on the way”

Dose, quantity or diagnosis

A brand or sender name that itself reveals the condition, where the patient would not want it visible

 

Early clinical guidance on subject lines

In “Guidelines for the Clinical Use of Electronic Mail with Patients”, clinicians were already being advised on how to handle patient email.

  • Subject line discretion. The authors say providers should be careful with outgoing subject lines, because patients’ own devices and desktops may have fewer privacy safeguards than the patients need. This is the same reasoning behind keeping detail off lock screens and out of shared inboxes.
  • Sender identity is sensitive. The authors note that even the fact that a person sees a particular health care provider is confidential information. That supports the point that “Order #4471 has shipped” still discloses patient status, and that the sender name and subject line should be reviewed together.
  • No marketing use of patient emails. The authors advise never using a patient’s email address in marketing schemes or supplying it to third parties.

 

Is a tracking number PHI?

Yes. The HIPAA identifier list in 45 CFR 164.514(b)(2)(i) includes email addresses and “any other unique identifying number, characteristic, or code.” A tracking number tied to a prescription fulfilled for a named patient identifies a transaction relating to the provision of care. Carrier tracking pages can also show the recipient’s city, the delivery date and sometimes the sender.

These parts of a shipment notification are PHI when sent to the patient:

  • Patient name and shipping address
  • Medication name, strength and quantity
  • Order number and tracking number
  • Ship date and estimated delivery date
  • Prescriber name
  • The identity of the sending organization, where it reveals that the recipient receives care

Read also: Is a shipment notification PHI?

 

Why a platform that won’t sign a BAA fails

45 CFR 164.502(e)(1)(i) states that, “A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information.” Those assurances must be documented in a written contract that meets 45 CFR 164.504(e), and the Security Rule imposes another requirement at 45 CFR 164.308(b). A platform that declines to sign cannot lawfully hold this data, no matter how the message is worded.

Changing the subject line to “An update on your order” removes one data point. The platform still receives and stores:

  • The patient’s name and email address
  • The merge fields that populate the message body
  • The order and tracking details
  • The fact that the patient purchased from a prescription-only provider
  • Engagement records such as opens, clicks and list membership

 

What a signed BAA does and does not cover

A signed BAA binds the vendor to safeguard the PHI it handles. Under 45 CFR 164.504(e), the contract must establish the permitted and required uses and disclosures of PHI by the business associate. It must also require the business associate to ensure that any subcontractors agree to the same restrictions and conditions. That is why every downstream tool in the chain needs coverage too.

The BAA does not settle whether the message content is appropriate, and it does not replace the other safeguards the organization must maintain. HIPAA permits disclosure of PHI to the individual, and disclosures to the individual are excluded from the minimum necessary standard, so naming the medication in a message to that patient is permitted.

 

Shipment notifications and the marketing rule

A notification about an order for a medication the patient is currently prescribed is an operational and treatment communication. It does not require patient authorization.

The Privacy Rule defines marketing as a communication about a product or service that encourages recipients to purchase or use it. The same definition excludes communications that provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual. This applies only if any financial remuneration the covered entity receives is “reasonably related to the covered entity’s cost of making the communication.”

In the preamble to the 2013 Omnibus Rule, HHS clarified that communications about the generic equivalent of a prescribed drug, and adherence communications encouraging patients to take their medication as directed, fall within it. HHS refill reminder guidance, together with OCR FAQ 1514 and FAQ 1520, addresses this category as well. Communications about a drug the individual is currently being prescribed are not treated as marketing, even when a third party pays for the communication, provided the remuneration is limited to the reasonable cost of making it.

That position depends on the notification staying within order status. These additions may bring the message within the marketing rule, which can require written authorization:

  • A cross-sell for a different treatment
  • A discount code for a new product
  • A referral offer
  • Promotional content from a third party

 

Operational checklist

  • Confirm a BAA with every system in the chain. This includes the email sender, the e-commerce platform, the shipping label tool, the CRM and any carrier integration that receives patient data. Subcontractors must be bound to the same restrictions.
  • Disable default notification templates on any platform without a BAA, including shipping confirmations generated automatically at fulfillment.
  • Send notifications only through BAA covered email.
  • Document the subject line policy. State what may appear in the subject line and sender name, and record the reasoning in the risk analysis.
  • Limit the notification to order status.
  • Review carrier tracking pages for what they show about the recipient and the sender.

Paubox signs a BAA and secures the email itself. This enables telehealth companies without a patient portal, to do intake, visit summaries, lab results and shipment notifications which go through the patient’s regular inbox without a portal login or password.

Read also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQs

What happens if a notification goes to the wrong email address?

It may count as an impermissible disclosure, so you would need to assess whether it is a reportable breach under the Breach Notification Rule.

 

Does the shipping carrier need a BAA?

Carriers that only transport sealed packages are generally treated as conduits, but any tool that receives patient data on your behalf needs coverage.

 

Does the physical package need to be discreet too?

HIPAA doesn’t set packaging rules, but many organizations use plain outer packaging so the sender and contents aren’t visible to others.

 

Should I train staff on what can go in patient notifications?

Yes, workforce training is a HIPAA requirement.

Learn more: Security awareness training