CAN-SPAM healthcare email marketing guide

The seven statutory requirements

The Controlling the Assault of Non-Solicited Pornography And Marketing Act — CAN-SPAM — was enacted in December 2003 and took effect January 2004. It is enforced by the Federal Trade Commission with regulations at 16 CFR Part 316. It also confers enforcement authority on state attorneys general, on the Federal Communications Commission for mobile-service commercial messages, and on internet access providers who suffer harm from non-compliant email. The FTC has boiled the statute down to seven operational requirements.

• Do not use false or misleading header information (from name, from address, reply-to, routing information).
• Do not use deceptive subject lines that misrepresent the message content.
• Identify the message as an advertisement, in a clear and conspicuous manner (only where the message is commercial and the recipient did not affirmatively consent).
• Tell recipients where you are located — a valid physical postal address for the sender.
• Tell recipients how to opt out of future messages, with a clear and conspicuous method.
• Honour opt-out requests promptly — within 10 business days, and keep the mechanism functional for at least 30 days.
• Monitor what others are doing on your behalf — a covered entity remains liable for a vendor's CAN-SPAM breaches.

The 10-day rule, the 30-day rule, and what a compliant unsubscribe looks like

Every commercial email must include a clear and conspicuous mechanism to opt out. The mechanism must be functional and reachable for at least 30 days after the message was sent. Opt-out requests must be honoured within 10 business days. Once someone opts out, the sender cannot sell, exchange or otherwise transfer that address, and cannot send further commercial email to that address without a subsequent affirmative opt-in.

What is not a compliant unsubscribe

• An unsubscribe that requires the recipient to log in to an account.
• An unsubscribe that requires more information than an email address to complete.
• An unsubscribe that forwards to a preferences page with no clear "unsubscribe from all" option.
• An unsubscribe that charges a fee.
• An unsubscribe that requires a reply email that is not monitored.

A preferences page is permitted, but the CAN-SPAM Compliance Guide is explicit that it must include a single-click option to opt out of all commercial email from the sender. Multi-step opt-outs are common enforcement targets.

Company-specific suppression list

Once an opt-out is received, the address is added to a company-specific suppression list. All future commercial email from any brand, product line or business unit of the same sender must respect the suppression until a new affirmative opt-in is captured. This is where multi-brand health systems get into trouble — a patient who opts out of pediatric-clinic email cannot then be dropped into a hospital-foundation marketing list without a fresh opt-in.

What the FTC has actually enforced

The FTC has brought dozens of CAN-SPAM enforcement actions since 2005. The pattern is instructive. Cases rarely turn on the physical-address requirement — most senders satisfy that mechanically. Cases turn on false or misleading header information, deceptive subject lines, and failure to honour opt-outs.

A subject line that says "Your appointment has been confirmed" for a message whose actual content is a promotional offer for a new service line has been treated as deceptive. A from-address that impersonates a physician when the message is from the marketing team has been treated as false headers. An opt-out that routes through a login-protected preferences centre has been treated as non-functional under the "clear and conspicuous" standard.