HIPAA-Compliant Email Marketing: Which Metrics You Can Track Without Pixels, and What the Rules Actually Say

Updated 1 November 2026. This is an operational guide for marketing and patient-engagement teams, not legal advice; confirm your program with counsel.

What HIPAA calls "marketing", in the rule's own words

The Privacy Rule (45 CFR 164.501) defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service," and then lists what marketing "does not include":

• Refill reminders or communications "about a drug or biologic that is currently being prescribed for the individual," provided any remuneration is "reasonably related to the covered entity's cost of making the communication."
• Communications "for treatment of an individual by a health care provider, including case management or care coordination," or to recommend "alternative treatments, therapies, health care providers, or settings of care."
• Communications "to describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication."
• "Case management or care coordination, contacting of individuals with information about treatment alternatives, and related functions."

The treatment and operations exclusions apply "except where the covered entity receives financial remuneration in exchange for making the communication," and "financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described."

Where a communication is marketing, 45 CFR 164.508(a)(3) requires an authorization, except for "a face-to-face communication made by a covered entity to an individual" or "a promotional gift of nominal value provided by the covered entity." If the marketing involves financial remuneration, "the authorization must state that such remuneration is involved."

The decision tree

Scroll for more → On small screens, choose cards for wide tables.

Who needs a BAA

A patient's email address on a provider's list is PHI because it identifies an individual as a patient. Consequences:

• The ESP or engagement platform that holds and sends to the list is a business associate and must sign a BAA. Many mainstream ESPs will not; choose one that does, or keep PHI out of the sending system entirely (for example, by sending only to a list that carries no patient status, which is rarely true for a provider).
• Agencies that handle the list are business associates (or subcontractors of one).
• Encryption of email in transit is an "addressable" specification under 45 CFR 164.312(e)(2)(ii): "Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate." Addressable means you assess, implement what is reasonable, and document; TLS in transit is the baseline every major provider now requires anyway. Content that includes individual PHI (test results, diagnoses) belongs in the portal, not in marketing email.

Tracking technologies: what changed in 2024, what didn't

HHS's Office for Civil Rights published a bulletin on online tracking technologies in December 2022 and revised it in March 2024. In July 2023, OCR and the FTC sent joint letters to about 130 hospital systems and telehealth providers about tracking tools on their websites and apps.

On 20 June 2024, in American Hospital Association v. Becerra, the Northern District of Texas vacated the bulletin's "proscribed combination": the position that a tracking tool connecting an individual's IP address with a visit to an unauthenticated public webpage creates PHI. The court stated that no other part of the guidance was invalidated. HHS appealed in August 2024 and withdrew the appeal in September 2024.

What that means operationally:

Scroll for more → On small screens, choose cards for wide tables.

State law adds a second layer: Washington's My Health My Data Act (in force for most entities from March 2024) regulates consumer health data beyond HIPAA, and twenty states have comprehensive privacy laws as of August 2026. A program that is clean under HIPAA can still fail a state statute.

Which email metrics you can track

Scroll for more → On small screens, choose cards for wide tables.

EngageHealth is built for the "yes" column. A unified patient profile with consent and status per channel, first-party event tracking, aggregate reporting, configurable US data residency, and BAAs confirmed per deployment. Request early access →

A compliant program, in practice

1. Classify every email stream with the decision tree: treatment and operations communications (appointment reminders, recall, your own services), general newsletters, and anything a third party pays for.
2. Contract the stack. BAA with the ESP or engagement platform and any agency; encryption in transit; access controls and audit logs on the list.
3. Keep PHI out of content. No diagnosis, test result or visit detail in a marketing or newsletter stream; subject lines and preheaders are read on lock screens.
4. Consent and preferences per channel. Email, SMS and portal messaging recorded separately, with timestamps; a working one-click unsubscribe (required by Gmail and Yahoo for bulk senders regardless of industry).
5. Measure in aggregate. Rates per send; appointments per send from the scheduling system; no individual engagement exported.
6. No third-party pixels on portals, scheduling, intake forms or condition-specific pages; first-party analytics only.
7. Deliverability rules still apply: SPF, DKIM, DMARC alignment, the 0.3% complaint limit, a sunset policy. A provider's domain has the same reputation mechanics as anyone else's.
8. Pre-send review with a healthcare line in the checklist: nothing patient-specific in a marketing stream, no third-party product without authorization on file.

FAQ

Is email marketing allowed under HIPAA? Yes. Communications about a covered entity's own health-related services, treatment, care coordination and refill reminders are not "marketing" under 45 CFR 164.501 unless a third party pays for them. Promoting a third party's product requires patient authorization.

Do I need a BAA with my email platform? If the platform holds or sends to a list that identifies people as your patients, yes: that list is PHI and the platform is a business associate.

Can I track opens and clicks on patient emails? As aggregate rates inside a BAA-covered platform, yes, which is common practice. Do not export individual engagement to ad platforms or non-BAA vendors, and do not join it to conditions or visits outside covered systems.

What did the 2024 court ruling change about tracking? It vacated HHS's position that an IP address plus a visit to a public, unauthenticated page is PHI. Guidance on authenticated pages stands, HHS dropped its appeal, and state laws and FTC enforcement continue.

Can I send appointment reminders and recall emails without authorization? Yes; they are treatment communications. Keep them free of unnecessary detail and send them through a BAA-covered system.

Does HIPAA require encrypted email? Encryption in transit is an "addressable" specification: you must assess it, implement what is reasonable and document the decision. TLS is the baseline; individual PHI belongs in the portal, not in bulk email.

Planning a reactivation or recall program for a clinic or network? Talk to us about EngageHealth: unified patient profiles, consent per channel, aggregate measurement. Contact us →

Sources

• 45 CFR 164.501, definition of "Marketing" (via Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/164.501 (checked 1 Nov 2026)
• 45 CFR 164.508(a)(3), "Authorization required: Marketing". https://www.law.cornell.edu/cfr/text/45/164.508 (checked 1 Nov 2026)
• 45 CFR 164.312(e), "Transmission security" (integrity controls and encryption, addressable). https://www.law.cornell.edu/cfr/text/45/164.312 (checked 1 Nov 2026)
• American Hospital Association v. Becerra (N.D. Tex., 20 June 2024) and HHS's withdrawal of its appeal (September 2024), as summarized by Ropes & Gray, Hunton, Morrison Foerster, Fierce Healthcare. (checked 1 Nov 2026)
• HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (December 2022, revised March 2024), as summarized by the law-firm analyses above (HHS pages were not retrievable during research).
• OCR and FTC joint letters to approximately 130 hospital systems and telehealth providers (July 2023); FTC actions against GoodRx (February 2023) and BetterHelp (March 2023).
• Washington My Health My Data Act (2024); Secure Privacy and Enzuzo on 20 US state privacy laws (August 2026). Secondary.
• Google, Email sender guidelines; Yahoo, Sender Best Practices: one-click unsubscribe, complaint-rate limits.
• EngageMKTG, EngageHealth, Patient Reactivation for Clinics and Health Systems, Pre-Send QA Checklist (internal).