With a platform that will sign a business associate agreement (BAA), you can tell the patient nearly everything they need such as the medication, the dose, the tracking number, the delivery window and the refrigeration instructions. Without a BAA, you can tell them nothing that identifies them as your patient.

 

Is a shipping notification PHI?

Yes. A shipment email from a weight loss or hormone therapy company combines a name, an email address and a relationship with a provider. Add a drug name, order number or tracking number and you have information relating to the provision of care. That is PHI even if the email seems logistical.

Under 45 CFR 160.103, individually identifiable health information is information that, “(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.”

A shipment notice from a telehealth provider to its patient meets each element, it is created by a provider, it relates to the provision of health care, and it identifies the recipient.

Furthermore, the tracking number is a unique identifier tied to one person’s order, and the HIPAA de-identification rule lists, among the identifiers that must be removed, 45 CFR 164.514(b)(2)(i)(R) states that, “Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section.” Once a tracking number sits in a message from a covered entity to that person, it is part of a record about their care. The subject-line question follows the same logic, since a subject line is part of the message.

Learn more: Is a shipment notification PHI?

 

If you have a BAA

A cold chain email is a treatment-related communication. It exists to get a temperature-sensitive medication safely from the box into the refrigerator, and that is within what a covered entity does. A platform that handles PHI on your behalf is a business associate, and HIPAA requires a written agreement with it. With that agreement in place, the body can include:

  • The medication name and dose, so the patient knows what to expect and can spot a wrong shipment
  • The carrier, tracking number and delivery window
  • Storage instructions: refrigerate on arrival, the acceptable temperature range, how long the package can safely sit outside
  • What to do if the package arrives warm, late or damaged, and how to reach your clinical team
  • Instructions for self-administration, if the product is an injectable

Subject lines are the exception. HIPAA doesn’t prohibit a drug name in a subject line sent through a compliant channel. However, the subject lines show up on lock screens, smartwatch banners and shared inboxes, and the Privacy Rule requires covered entities to reasonably safeguard PHI against unintentional disclosure (45 CFR 164.530(c)).

 

If your platform won’t sign a BAA

You might assume you can remove the drug name, send a “your order shipped” message and be compliant. Look at what the platform still holds, the patient’s name, their email address, and the fact that they are a customer of a telehealth company that treats weight loss or hormone conditions. That relationship is itself health information under the definition above, and the platform is receiving it on your behalf without any agreement governing how it is protected.

If you are stuck with such a platform for marketing or general ecommerce, the rule is to keep patient communications off it entirely. Organizations should follow these guidelines:

  • Don’t pass drug names, doses or clinical notes through order metadata, product titles or tags that sync to the platform or the carrier.
  • Don’t build a cold chain, refill or visit-related flows inside it, even “sanitized” ones.
  • Send shipment and storage emails from a channel that will sign a BAA, and keep your patient list there.
  • Carrier-generated tracking notifications are a separate channel. They can help as a backstop, but make sure the shipment description you give the carrier doesn’t name the product.

 

Where marketing comes in

The Privacy Rule defines marketing this way, ‘Except as provided in paragraph (2) of this definition, marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.”

Treatment communications from the covered entity are outside that definition, as long as no third party is paying you to send them. The definition of financial remuneration is what changes that, “Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described.”

Once that kind of payment is involved, the authorization rule applies, “Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of: [...]” and the authorization itself has to be candid about the payment, “If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.”

Applied to your shipping emails:

  • Storage instructions, delivery windows and dosing guidance: treatment communications, no authorization needed.
  • A reminder that a refill is due: the rule has a specific exception, quoted below.
  • A banner for a partner product or a manufacturer-funded offer: if a third party is paying you for it, you need the patient’s authorization before sending, and a BAA doesn’t change that.
  • Your own products and services: the marketing definition also excludes communications describing a health-related product or service provided by the covered entity itself, but that exclusion does not apply where the covered entity receives financial remuneration for making the communication. Confirm the exact wording of paragraph (2)(ii) of the definition for your situation. The test is who is paying, not whether the message contains a promotion.

The refill exception reads, “Marketing does not include a communication made: (i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication.”

 

A practical checklist for cold chain emails

  1. Send from a BAA signed channel only. If the platform won’t sign, it doesn’t carry shipment emails.
  2. Keep subject lines generic. Put the specifics in the body.
  3. Include the safety essentials: medication, storage temperature, time limit, and who to call.
  4. Keep it clinical. Leave out cross-sells, partner offers and anything a third party funds.
  5. Treat the tracking number as PHI, in the email and in any system it syncs to.
  6. Audit your integrations. The drug name often leaks through order tags and product titles long before anyone writes an email.

Read also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQs

What is a business associate agreement (BAA)?

A BAA is a written contract required by HIPAA in which a vendor handling protected health information on your behalf agrees to safeguard it according to the law.

 

Does HIPAA require emails to be encrypted?

HIPAA treats encryption as an “addressable” safeguard, meaning you must implement it or document an equivalent measure, and in practice it is widely expected for email containing PHI.

 

What is a data breach notification, and when is it required?

It is a mandatory notice to affected individuals, and in many cases to regulators, when unsecured PHI has been improperly accessed or disclosed.