Is Email and SMS Marketing HIPAA Compliant for a Clinic?

What this means for you

• "Your refill is due" with the detail behind a login is fine. "Your GLP-1 refill is due" in a subject line is protected health information sent in the clear.
• The sending platform is a business associate. If it will not sign a BAA, it cannot hold patient data, whatever its marketing says.
• Segment names follow the same rule as messages. A leaked audience list named after a condition is a breach.
• Marketing texts need prior express written consent that names the business. A three-year-old list with no consent record cannot be texted.
• Speed-to-lead is the highest-return sequence a clinic runs and the easiest to get wrong, because it starts before the person is a patient.

MedScale Health, a patient-acquisition agency for telehealth and clinics, runs email and SMS lifecycle for clinics because the cheapest patients a clinic will ever acquire are the ones it already paid for: leads that never booked, patients who missed a visit, and last year's patients with no refill reminder. The rules below decide how those sequences can be built. This page is marketing guidance for healthcare operators. It is not medical or legal advice, and platform policies change: check the sources listed at the end before acting on any specific rule.

What HIPAA calls marketing

The Privacy Rule defines marketing at 45 CFR 164.501 as a communication about a product or service that encourages the recipient to purchase or use it, and 45 CFR 164.508 requires the patient's written authorization before protected health information is used for it, with narrow exceptions such as face-to-face communications and promotional gifts of nominal value. If a third party pays the clinic for the communication, the authorization has to say so.

Communications about the patient's own treatment, care coordination, and the clinic's own services related to that treatment are carved out of the definition, which is why appointment reminders, follow-up instructions and refill reminders can be sent without a marketing authorization, subject to the rule's conditions. The line clinics cross is using what they know about a patient's condition to promote something else: the weight-loss program to the sleep patient, the aesthetics menu to the TRT patient. That needs authorization, and most lifecycle tools make it one click to do without noticing.

The sender is a business associate

Any vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate, and 45 CFR 164.504 sets out what the written contract must contain: permitted uses, safeguards, breach reporting, subcontractor flow-down and return or destruction of the data at the end. An email or SMS platform that holds patient names alongside program or appointment data is squarely inside that definition. Several popular marketing platforms will sign a BAA; several will not. The audit of an existing stack starts with that question.

What may never appear in a message or a segment

The practical test is whether the message ties an identifiable person to a condition, a medication or a treatment beyond what they need to act on. A booking link and an appointment time pass. A drug name in a subject line, a condition in a preview text, or a URL that names the program do not, because they are readable by anyone with the phone or the inbox.

Segments are the part most teams forget. A list called by a medication name is a structured record of which patients take it; if it is exported, shared with an ad platform for matching, or exposed in a breach, the segment name itself is the disclosure. Segments are named by program stage or by generic labels, and audience uploads to ad platforms are built from consented, non-condition lists or not at all.

TCPA: consent for every marketing text

The TCPA rules at 47 CFR 64.1200 require prior express written consent for marketing texts and for calls made with an automatic dialing system or an artificial or prerecorded voice, and they set the disclosure and opt-out mechanics. The FCC's one-to-one consent rule for lead generators was vacated in January 2025, so a single consent may again name more than one seller, but nothing about the written-consent requirement itself changed.

For a clinic that means a consent line on every form and call that names the clinic, states the message types and frequency, includes STOP language and links to terms, plus a timestamped record kept for every number. Speed-to-lead sequences run on that consent. Reactivation of an old list runs only where the consent records exist and cover what is being sent; where they do not, the reactivation is by email, or not at all.

Non-HIPAA operators: the FTC's rule still applies

Cash-pay wellness businesses that are not covered entities are not outside the law. The FTC's Health Breach Notification Rule covers vendors of personal health records and related services, and the FTC has used it against health apps that shared user data with ad platforms. The same discipline about where data lives and what leaves the system is the safe default regardless of HIPAA status.

The sequences that earn their keep

• Speed-to-lead: a text and an email within two minutes of a form or a call, with a booking link, then a short timed sequence until they book or opt out. Three touches over two days is enough.
• No-show recovery: reminders at 48 hours and 2 hours, a same-day reschedule path, and a sequence for the people who missed.
• Refill and retention: reminders timed to the program so a subscription patient renews on schedule, with the program name behind the login rather than in the text.
• Reactivation: past patients and old leads segmented by last visit and program stage, re-engaged with a plain offer to come back, email-first where SMS consent is missing.
• Reviews: requests sent after a completed visit to the platforms that decide the local map results, with no condition mentioned in the request.

Where clinics actually get this wrong

The failures are rarely dramatic. A subject line generated from a merge field pulls the program name into the inbox preview. A reactivation segment is named after the medication because that is how the EHR labels it. A speed-to-lead text is sent from a number the platform provided without anyone checking that the form's consent language named the clinic and described marketing texts. A review request mentions the treatment. Each is a small decision made inside a marketing tool by someone who was never told the rule, and each is a disclosure or a consent failure that can be found in a breach or a complaint months later.

The fix is procedural rather than technical: a naming rule for segments and templates, a consent line owned by the clinic rather than the vendor, a monthly review of every active template against the rule, and a written data-path document that says which vendor holds what, under which agreement.

Building the sequences in the right order

Speed-to-lead goes first, because it acts on leads the clinic is paying for today and the return is immediate. No-show recovery goes second, because it recovers visits already booked. Refill and retention sequences go third and pay for the longest, since a subscription patient who renews on schedule is worth more than any new lead. Reactivation goes last and only once consent records have been checked, because it is the sequence most likely to reach people who never agreed to hear from the clinic again. Review requests run continuously from the first completed visit. Each sequence is short, stops when the person acts, carries an opt-out, and reports its own response and opt-out rates so the clinic can see when a message has become noise.

What MedScale does

MedScale Health's email and SMS lifecycle service (medscale.health/services/email-and-sms) puts the sending platform under a signed BAA or audits the one the clinic already has, captures and logs consent on every form and call, builds segments that carry no condition or medication, writes every sequence to the same rules as the ads, handles deliverability setup, and reports response rate, bookings from sequence, no-show rate and reactivated patients monthly. Speed-to-lead and no-show sequences are live on a BAA-covered sender by day 14.