Email and text marketing to patients

Your patient list is one of the practice’s most valuable marketing assets, and it is protected health information. You can use it to stay in touch with patients, but where it is stored, what you send and who you send it to all matter.

Reminders and marketing are different messages

Appointment reminders, recall notices and messages about a patient’s own treatment are care communications. Newsletters, promotions, whitening specials and “refer a friend” campaigns are marketing in the everyday sense, even when HIPAA doesn’t require authorization for them because they promote your own services. The consent rules for the two are different, so keep them as separate lists with separate consent records, and don’t slip promotions into reminder messages.

Consent: texts and email

• Texts: the Telephone Consumer Protection Act and the FCC’s rules require consent before sending automated texts. Care-related texts generally need the patient’s prior express consent, and marketing texts generally need prior express written consent, which is a higher bar. Every message should offer a way to opt out.
• Email: under the FTC’s CAN-SPAM rules, commercial email must identify the practice honestly, avoid misleading subject lines, include a physical address and offer a working unsubscribe that you honor.
• Opt-outs everywhere: when a patient opts out, by reply or by telling the front desk, make sure it reaches every system that sends messages.

The details, including how to record consent per phone number, are in reminders, texts and consent.

Vendors need a business associate agreement

When you upload patients’ names and contact details to an email or texting platform, that company is holding PHI for the practice. It generally needs to sign a business associate agreement first. Many general-purpose email tools won’t sign one, or only on certain plans, so check before you upload anything. Platforms built for dental practices, and the messaging features inside your practice software, often will. Don’t export the list to a staff member’s personal account or a free tool “just this once.”

Keep treatment details out of the message

Emails and texts can be read on lock screens, shared phones and family computers. Write every message as if someone else will see it:

• No diagnoses, treatment names, balances or clinical details in subject lines, previews or text messages.
• Don’t segment promotions by condition or treatment (“patients with gum disease”) without talking to your privacy officer first; a targeted message reveals why the person received it.
• Send to the whole patient list or broad groups, such as all active patients, rather than clinical segments.
• Never share, sell or upload the patient list to another company, including ad platforms.

On that last point, the paid ads guide explains why patient lists should never be sent to Google or Meta.