📣 Heads up: Compliance is a shared responsibility. Jane provides the platform, features, and documentation to support your clinic's compliance, but your clinic is responsible for how you collect, use, and manage patient data in your day-to-day operations.
This guide is a general summary and is not intended as legal advice. For guidance specific to your practice, consult a legal professional or your regulatory body.
Question
Does HIPAA allow US health providers to email patients about their care or send them marketing emails?
Answer
Generally, yes, but HIPAA and CAN-SPAM have different requirements depending on whether your email is about patient care or marketing. Here's what you need to know.
📣 Heads up: This guide is a general summary and is not intended as legal advice. For guidance specific to your practice, consult a legal professional or your regulatory body.
Transactional vs. marketing emails
Under CAN-SPAM, America's anti-spam legislation, emails fall into two categories:
- Transactional messages facilitate or provide updates about an already agreed-upon transaction or relationship. These can generally be sent without express consent.
- Marketing messages advertise or promote a product or service, think newsletters, sale announcements, or discount codes. These don't generally require upfront consent, but they must include an unsubscribe mechanism, and you must honour withdrawal of consent.
You can learn more in the FTC's CAN-SPAM Compliance Guide for Businesses.
HIPAA and consent to market to patients
HIPAA has stricter rules around marketing than CAN-SPAM because it involves patients and protected health information (PHI).
While CAN-SPAM operates on an opt-out model, HIPAA requires a patient's express consent before you can market to them. You still need to include an unsubscribe mechanism and honour withdrawal of consent, but the starting point is upfront consent.
This is why Jane doesn't opt patients into marketing emails by default.
What counts as "marketing" under HIPAA?
HIPAA defines marketing as any communication encouraging recipients to purchase or use a product or service. There are exceptions, though. The following are generally not considered marketing and don't require upfront consent:
- Information about the health plan you're providing or recommending
- Treatment information
- Care coordination recommendations (such as recommending additional treatments or providers)
- Appointment reminders
The HHS has a guidance resource on marketing exceptions where you can learn more.
Can I email patients about their care?
Generally, yes, with three things to keep in mind:
- Limit the disclosure of PHI to the minimum necessary, unless the patient consents to more detail. This is why Jane's transactional emails (like appointment reminders) contain just enough information to accomplish their purpose.
- Patients have the right to request communication through a different channel at any time.
- You're responsible for having reasonable privacy and security safeguards in place when sharing health information over email.
The HHS is explicit on appointment reminders specifically:
"A health care provider should accommodate an individual's request to receive appointment reminders via email, rather than on a postcard, if email is a reasonable, alternative means for that provider to communicate with the patient."
For more details on permitted practices, see these HHS resources:
- Does the HIPAA Privacy Rule allow for emailing patients about their health and treatment?
- Does the HIPAA Security Rule allow for sending PHI in an email?
🩵 Jane Tip: If a patient prefers not to discuss their health over email, Jane's Secure Messaging feature is a more private alternative.
Can patients manage their email preferences?
Yes. While logged in to their Jane account, or directly from any email they've received, patients can opt in or out of appointment reminder and notification emails at any time.
For marketing emails, patients must actively opt in before Jane will include them in those communications.
If you have questions related to privacy and compliance at your practice, reach out to Jane's Privacy and Security team via the Contact us page.