There's quite a bit you can include in an email to a patient about their GLP-1 prescription. You can let them know what drug they're taking and at what dose. You can include information about titration and how to take it, as well as information about side effects. You can tell them if their prescription was authorized and even include A1C values. You can remind them to refill their medication. You can share all of this as long as you use reasonable safeguards.

The HHS states that providers may email patients “provided they apply reasonable safeguards when doing so.” Paubox's 2026 Healthcare Email Security Report looked at the 170 email-related breaches disclosed to the HHS in 2025 and found that 74% of breached domains had ineffective DMARC protection. A GLP-1 email can reveal diabetes or obesity treatment, so deciding what goes in the message and securing how it travels need to happen together.

 

What can go in a treatment email to the patient?

According to 45 CFR 164.506, you are allowed to disclose protected health information (PHI) to an individual for treatment purposes. You don't need the patient's authorization. For example, you can let your patient know that their Wegovy was approved and that they should start 0.5 mg next week, or that their prior authorization is still under review.

The HHS states that the minimum necessary rule does not apply to "disclosures to the individual who is the subject of the protected health information." The minimum necessary standard does not limit how much detail you can share with the patient. You still need reasonable safeguards when sending it.

Let's say you have a telehealth weight loss practice. You're allowed to send an email to your patient that covers titration, pen storage, and the side effects that may come up as they start their medication. You can include all of that information in one email to the patient. Make sure the address is correct and that you're sending it through a secure email service.

 

Should the drug name appear in the subject line?

HIPAA does not stand in the way of naming the medication in the subject line of an email to your patient. However, the subject line and preview text are visible to anyone who has access to your patient's phone or email account. They may also be visible to an employer if the patient uses a work email address.

People living with obesity often report stigma in healthcare settings. Researchers in a 2024 Health Expectations study surveyed 590 Dutch people living with obesity and found that 41%, 59%, and 80% of those with class 1, 2, and 3 obesity, respectively, had experienced weight stigma. The study also showed that "greater perceived weight stigma was associated with lower" levels of person-centered care. They didn't measure how these patients felt about receiving an email that contained information about their obesity, but it's something to consider.

Read also: What can I put in a GLP-1 shipment notification email?

 

When the patient asks for a different address or channel

Should your patient ask to be reached at another address or through a different channel, you must accommodate reasonable requests. You cannot require the patient to explain why. If a patient asks to receive their information by unencrypted email, you must generally honor that request after warning them of the risk. You should warn them that there is some level of risk and then let them decide. Make a note that the patient asked to be contacted through an insecure email channel and that you informed them of the risks.

 

Refill and adherence emails do not need authorization

There's no need to obtain authorization for sharing information with patients about their current prescription. The HHS FAQs guidance notes that refill reminders don't fall under the category of marketing. According to the HHS, the exception covers refill reminders, adherence messages, prescriptions that lapsed within the last 90 calendar days, and ‘all aspects of a drug delivery system’ for self-administered drugs. Bear in mind that if someone is paying you to send the patient an email, any payment must be reasonably related to your cost of sending the message. If a manufacturer pays you more than it costs to send a refill reminder, the email becomes marketing.

A study from the Journal of Medical Internet Research shows patients want to receive information about their medication through secure email. When surveying a random sample of 819 US veterans who opted into secure messaging through My HealtheVet, 66.7% said that it was helpful for medication refills and 38.2% said it was helpful for medication questions. These were veterans who already opted into secure messaging, so maybe not everyone would benefit from secure messaging.

Related: Are GLP-1 refill reminders marketing under HIPAA?

 

When a GLP-1 email becomes marketing

Sending an email about a drug meant to boost the effects of a patient's current medication counts as marketing, and so does sending information about switching medications. To send them that information, you would need authorization from the patient. Sending an email about a compounded medication or other products your practice sells would also count as marketing. Sending the email securely does not change this, because encryption decides how the message travels, not whether you may send it.

 

Encryption is addressable today but rarely optional in practice

HIPAA lists encryption as an addressable specification. If you do not encrypt your email, you must show that it wasn't reasonable to do so and use an equivalent alternative measure. In all likelihood, your risk assessment will demonstrate that it makes sense to encrypt your email.

The HHS proposed a rule, the NPRM, to make encryption of electronic PHI (ePHI) a required specification in both transit and at rest, with some exceptions. There is not a final rule at this time, but the 2026 Unified Agenda moved the target date for a final rule from May 2026 to July 2027, according to the HIPAA Journal.

None of the breached organizations, Paubox, looked at enforced MTA-STS policies. Meaning they were relying on opportunistic TLS to encrypt their email. Paubox Email Suite encrypts all outbound emails by default and delivers to the recipient's inbox without the need for a portal or password. It will verify the recipient's encryption certificate and is designed to block delivery to domains with expired or self-signed certificates.

 

Vendors, automation, and tracking links

If you're sending your patients' emails about their medication, make sure the vendor you're using to do so is HIPAA compliant and you have a BAA in place. Paubox Email API allows you to send emails with PHI and comes with a BAA included with all plans. It uses TLS 1.2+ by default and has a template feature that can be used for all patients. You should also make sure your tracking does not disclose PHI to third parties without a BAA or authorization. In 2024, the FTC announced that telehealth company Cerebral was sharing its patients' information with third parties through tracking tools on its websites and apps. They agreed to pay over $7 million to settle the FTC's claims. If you are emailing your patients a link that takes them to your website, make sure you're not tracking that information.

 

What a compliant email cannot fix

There are many reasons patients may not stay on their GLP-1 medication. One JAMA Network study found that 64.8% of patients without type 2 diabetes and 46.5% of patients with type 2 diabetes stopped using their GLP-1 within one year. According to a study of 440 US adults who stopped taking their GLP-1, 50.1% of patients with diabetes stopped their medication due to side effects compared to 28.1% of patients without diabetes. When deciding what to include in your patient emails, your practice can draw on this information.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Can we email GLP-1 updates to a patient’s spouse or caregiver?

A provider may share relevant prescription details with a family member involved in the patient’s care when the patient agrees or does not object, so confirming that preference before adding a second recipient keeps the email within HIPAA.

 

What happens if a GLP-1 email goes to the wrong recipient?

A misdirected email containing PHI is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised, and that assessment decides whether the patient and the HHS must be notified.

 

Can an employer ask us to confirm a patient’s GLP-1 prescription by email?

A provider generally needs the patient’s written authorization before confirming prescription details to an employer, even when the employer funds the patient’s health plan or covers the cost of the medication.