CAN-SPAM healthcare email marketing guide
CAN-SPAM is the federal floor for commercial email in the United States. It is not the ceiling — HIPAA marketing rules and state consumer laws stack on top for anything sent by a covered entity. This guide walks the statutory checklist, the FTC primary-purpose test, transactional vs commercial classification, the 10-day opt-out rule, and the healthcare-specific overlay that decides whether an otherwise-compliant email is actually safe to send.
- The CAN-SPAM Act (15 USC 7701 et seq.) applies to any electronic mail whose primary purpose is commercial advertisement or promotion. Every message, transactional or commercial, must have accurate header information.
- Seven statutory requirements: no false or misleading headers, no deceptive subject lines, clear identification as advertisement, valid physical postal address, functional opt-out, honor opt-outs within 10 business days, monitor what others do on your behalf.
- Transactional or relationship messages (appointment reminders, prescription notifications, lab-result alerts) have a lighter regime under 16 CFR 316.3 but must still carry accurate headers.
- Penalties are up to USD 53,088 per violation (2024-adjusted) with each recipient counted as a separate violation.
- HIPAA marketing rules stack on top. A CAN-SPAM-compliant email that qualifies as HIPAA marketing without prior written authorization is still a Privacy Rule violation.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
The seven statutory requirements
The Controlling the Assault of Non-Solicited Pornography And Marketing Act — CAN-SPAM — was enacted in December 2003 and took effect January 2004. It is enforced by the Federal Trade Commission with regulations at 16 CFR Part 316. It also confers enforcement authority on state attorneys general, on the Federal Communications Commission for mobile-service commercial messages, and on internet access providers who suffer harm from non-compliant email. The FTC has boiled the statute down to seven operational requirements.
- Do not use false or misleading header information (from name, from address, reply-to, routing information).
- Do not use deceptive subject lines that misrepresent the message content.
- Identify the message as an advertisement, in a clear and conspicuous manner (only where the message is commercial and the recipient did not affirmatively consent).
- Tell recipients where you are located — a valid physical postal address for the sender.
- Tell recipients how to opt out of future messages, with a clear and conspicuous method.
- Honor opt-out requests promptly — within 10 business days, and keep the mechanism functional for at least 30 days.
- Monitor what others are doing on your behalf — a covered entity remains liable for a vendor's CAN-SPAM breaches.
Commercial vs transactional — the FTC primary-purpose test
The classification of an email as commercial, transactional/relationship, or a hybrid is where most healthcare email programs get tripped up. The FTC promulgated the primary-purpose rule at 16 CFR 316.3 to draw the line.
Commercial messages
A message whose primary purpose is commercial advertisement or promotion of a commercial product or service. All seven CAN-SPAM requirements apply.
Transactional or relationship messages
Messages whose primary purpose is one of five categories: to facilitate, complete or confirm a commercial transaction the recipient previously agreed to; to provide warranty, recall, safety or security information; to provide account information or subscription-related notifications; to provide employment or benefit information; or to deliver goods or services the recipient is entitled to receive under a transaction already entered into. Only the "do not falsify header information" rule applies to a pure transactional message.
Hybrid messages
A message containing both commercial and transactional/relationship content is classified by primary purpose. Factors include whether transactional content appears at the beginning of the message, and whether the transactional content would compel a reasonable recipient to conclude that the primary purpose is transactional. In healthcare, an appointment reminder that ends with a promotional paragraph about a new aesthetic service line usually flips the classification to commercial.
The 10-day rule, the 30-day rule, and what a compliant unsubscribe looks like
Every commercial email must include a clear and conspicuous mechanism to opt out. The mechanism must be functional and reachable for at least 30 days after the message was sent. Opt-out requests must be honored within 10 business days. Once someone opts out, the sender cannot sell, exchange or otherwise transfer that address, and cannot send further commercial email to that address without a subsequent affirmative opt-in.
What is not a compliant unsubscribe
- An unsubscribe that requires the recipient to log in to an account.
- An unsubscribe that requires more information than an email address to complete.
- An unsubscribe that forwards to a preferences page with no clear "unsubscribe from all" option.
- An unsubscribe that charges a fee.
- An unsubscribe that requires a reply email that is not monitored.
A preferences page is permitted, but the CAN-SPAM Compliance Guide is explicit that it must include a single-click option to opt out of all commercial email from the sender. Multi-step opt-outs are common enforcement targets.
Company-specific suppression list
Once an opt-out is received, the address is added to a company-specific suppression list. All future commercial email from any brand, product line or business unit of the same sender must respect the suppression until a new affirmative opt-in is captured. This is where multi-brand health systems get into trouble — a patient who opts out of pediatric-clinic email cannot then be dropped into a hospital-foundation marketing list without a fresh opt-in.
Physical postal address — what qualifies
Every commercial email must include a valid physical postal address for the sender. The FTC accepts a current street address, a post office box registered with the United States Postal Service, or a private mailbox registered with a commercial mail-receiving agency registered under Postal Service regulations. A physical address is not optional and cannot be replaced by a phone number, an email address or a website URL.
For multi-location healthcare providers, the address can be the corporate headquarters, but it must be a real, receivable address. A registered agent's address is acceptable if the sender's own mail is actually deliverable there.
Why CAN-SPAM alone does not clear a healthcare email
1. Marketing under HIPAA
An email that meets the CAN-SPAM definition of commercial and the HIPAA definition of marketing needs prior written authorization under 45 CFR 164.508(a)(3) before the send — even if every CAN-SPAM box is ticked.
2. The email service provider BAA
If the sender is a covered entity and the recipient is a patient, the email service provider is processing PHI and must sign a Business Associate Agreement.
3. PHI in the subject line
Diagnosis, treatment or condition information in the subject line is a HIPAA disclosure to anyone who can see the inbox preview. Treat subject lines as public.
4. Segmentation on PHI
Segmenting the send list by condition, medication or treatment history is a use of PHI for marketing, which triggers the HIPAA authorization requirement even for otherwise-transactional messages.
What the FTC has actually enforced
The FTC has brought dozens of CAN-SPAM enforcement actions since 2005. The pattern is instructive. Cases rarely turn on the physical-address requirement — most senders satisfy that mechanically. Cases turn on false or misleading header information, deceptive subject lines, and failure to honor opt-outs.
A subject line that says "Your appointment has been confirmed" for a message whose actual content is a promotional offer for a new service line has been treated as deceptive. A from-address that impersonates a physician when the message is from the marketing team has been treated as false headers. An opt-out that routes through a login-protected preferences center has been treated as non-functional under the "clear and conspicuous" standard.
Backed by ICG global leadership
Every email engagement runs under senior review from operators who have run HIPAA-scoped marketing on the standard enterprise ESPs and who have negotiated the BAA schedules that make the send legal.
Our own tools run inside every engagement
Ichelon Consulting US uses software built by our own product team. Practices can also use most tools on their own, billed in USD.
CAN-SPAM healthcare email — common questions
What is a commercial email message under CAN-SPAM?
A message whose primary purpose is the commercial advertisement or promotion of a commercial product or service. The FTC primary-purpose regulation at 16 CFR 316.3 sets the tests.
Do CAN-SPAM opt-outs apply to appointment reminders?
Appointment reminders are transactional/relationship messages, so the opt-out rule does not require them to carry an unsubscribe link. Header and from-line accuracy still apply.
How quickly must we honor an unsubscribe?
Within 10 business days of receipt. The opt-out mechanism must remain functional for at least 30 days after the message was sent.
What are CAN-SPAM penalties?
Up to USD 53,088 per violation (2024-adjusted). Each recipient of a non-conforming email is a separate violation.
Does CAN-SPAM pre-empt state email laws?
Yes, except to the extent state law prohibits falsity or deception. State AGs and internet access providers retain enforcement authority.
What is the HIPAA overlay for healthcare email?
Meeting CAN-SPAM is necessary but not sufficient. Marketing under HIPAA generally requires prior written authorization before the email goes out.
Ship a CAN-SPAM + HIPAA-clean email program
Book a 30-minute call with the Leadership Team, email the US practice lead, or WhatsApp us in your time zone. Retainers are custom-scoped per engagement · from $499/month.