Email is one of the cheapest ways for a practice to stay in touch with past patients and with people who asked about a treatment but never booked. Two sets of rules apply: the federal CAN-SPAM Act for commercial email, and, for HIPAA covered entities, the HIPAA rules on marketing. This guide is for practice owners and managers who send, or want to send, a newsletter or promotional email. It explains which rule applies when, and how to set up a list that respects both.
- SearchAn adult looks for care near them.
- Your pageWhat you treat, who sees them, one way to book.
- Call or formThey call or send a request.
- Front deskBooks the visit and never guesses a cause.
- Clinical teamThe clinician decides the plan.
1. Decide what kind of email you are sending
- Care and appointment messages: reminders, follow-up instructions, a recall notice for a patient’s own care.
- Messages about your own services: a newsletter describing treatments your practice offers, a new provider, new hours.
- Promotions paid for by someone else: an email about a product or brand where a manufacturer or other third party pays or supports the practice for sending it.
The rules treat these differently, so label each campaign before you write it.
2. CAN-SPAM: the rules for commercial email
The federal CAN-SPAM Act (15 U.S.C. 7704) applies to commercial email, which the Act defines as email whose primary purpose is the commercial advertisement or promotion of a product or service. For each commercial email, it requires:
- header information that is not false or misleading, and a subject line that is not likely to mislead a reasonable recipient about the content;
- a working return address or other online way to opt out, which keeps working for at least 30 days after sending;
- clear identification that the message is an advertisement, unless the recipient gave prior affirmative consent to receive it;
- clear notice of the opportunity to opt out, and a valid physical postal address of the sender.
Once someone opts out, the law gives you 10 business days to stop sending commercial email covered by the request. Whatever platform you use, test the unsubscribe link and check that your practice address is in the footer.
3. HIPAA: when an email counts as marketing
If your practice is a HIPAA covered entity, using patient information (including your patient list) to send email is a use of protected health information. HIPAA defines marketing as a communication about a product or service that encourages the recipient to purchase or use it, and then excludes some communications. Among the exclusions, as long as the practice receives no financial remuneration from a third party for sending them, are communications:
- for the treatment of the individual, including recommending alternative treatments, therapies or providers;
- describing a health-related product or service provided by the practice itself.
Under 45 CFR 164.508(a)(3), a covered entity must obtain the patient’s written authorization before using or disclosing protected health information for marketing, with narrow exceptions for face-to-face communications and promotional gifts of nominal value. If a third party pays the practice for the communication, the authorization must say so.
In practice, a newsletter about your own treatments to your own patients usually falls within the exclusions, while an email promoting a manufacturer’s product that the manufacturer pays you to send usually needs authorization. Where a campaign sits in between, ask counsel before you send it.
4. Build the list the right way
- Ask for email consent separately from booking or intake, with plain wording about what you will send and how often.
- Keep people who asked about a treatment online on a separate list from patients, with the consent they gave on your form; our request form checklist covers consent wording.
- Record where and when each person joined the list.
- Never buy or rent email lists.
5. Keep health details out of marketing email
Email can be forwarded, read on shared devices and seen in notification previews. Do not segment or personalize promotional email by diagnosis or treatment history (“since you had your implant last spring”), and do not put treatment details in subject lines. Send general topics to the whole list and let readers click through to your website.
If your email platform will hold patient information on your behalf, HIPAA generally requires a business associate contract with that vendor. Check whether your provider will sign one before you upload a patient list.
6. What to send
- A short monthly or quarterly note: a new service, a new provider, changed hours, a seasonal reminder about scheduling consultations.
- Plain, accurate information about treatments you offer, with no promised results; see our guide on getting more aesthetic patients for advertising claims.
- A clear way to request a consultation, tagged so you can count the requests; see tracking where new patients come from.
Text messages follow different rules from email; our guide on texting patients and the TCPA covers them.
Where MediLeadGen fits
Email works for people who already know your practice. MediLeadGen brings requests from new patients interested in cash-pay elective treatments, each sent to one practice with consent naming that practice, at a fixed price per delivered request. The email alert you receive carries no patient details; the request itself is in a login-protected inbox.
See how it works for practices
Questions practices ask
Does CAN-SPAM apply to a practice newsletter?
If its primary purpose is to advertise or promote, yes. Each email needs truthful headers and subject lines, a working opt-out, a valid postal address and, unless the recipient gave prior affirmative consent, identification as an advertisement. Opt-outs must be honored within 10 business days.
Does HIPAA allow a practice to email patients about its own services?
HIPAA’s definition of marketing excludes communications that describe a health-related product or service provided by the practice itself, as long as no third party pays the practice for sending them. Ask counsel about anything in between.
When does a practice need patient authorization for marketing email?
A HIPAA covered entity needs written authorization to use protected health information for marketing, for example an email promoting a third party’s product when that third party pays the practice. The authorization must say that payment is involved.
Can we personalize emails by treatment?
Avoid it in promotional email. Do not segment by diagnosis or treatment history or put treatment details in subject lines; send general topics and link to your website.
Do we need a business associate agreement with our email platform?
If the platform will hold patient information on your behalf, HIPAA generally requires a business associate contract. Check whether your provider will sign one before uploading a patient list.
General information for practice teams, not legal advice. Check federal and state rules with counsel. Last reviewed October 2026.