What is the CAN-SPAM Act?
The CAN-SPAM Act is a 2003 federal law that sets rules for commercial email messages sent in the US. It does not require opt-in consent, but it bans deceptive headers and subject lines and requires a valid physical postal address and a clear way to opt out. Opt-outs must be honored within 10 business days. The Federal Trade Commission enforces it.
- Applies to commercial email, including business-to-business messages.
- Requires: honest headers and subject lines, ad identification, postal address, working opt-out.
- Honor opt-outs within 10 business days; the mechanism must work for at least 30 days after sending.
- For practices, HIPAA also governs email that uses patient information.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What CAN-SPAM requires
CAN-SPAM covers any email whose primary purpose is commercial advertisement or promotion of a product or service. Transactional or relationship messages, such as appointment confirmations or account updates, are mostly exempt, though they still must not contain false routing information.
For commercial email, the law requires that header information (from, to, reply-to and routing) is accurate; that the subject line is not deceptive; that the message is identified as an advertisement where required; that it includes the sender's valid physical postal address; and that it explains how to opt out. The opt-out mechanism must work for at least 30 days after the message is sent, opt-out requests must be honored within 10 business days, and the sender cannot charge a fee or ask for more than an email address and opt-out preferences to process it. Businesses remain responsible for email sent on their behalf by vendors. The FTC can seek civil penalties per violating email, and the amount is adjusted for inflation each year.
How it applies to practice email
- Newsletters and promotions are commercial; include the address and a one-click unsubscribe.
- Reminders and visit follow-ups are usually transactional, but adding promotions can change the primary purpose.
- One suppression list: sync unsubscribes across every email tool, location and vendor.
- Patient data: using patient lists for email is also a HIPAA question. Communications about your own services are generally allowed; third-party-paid promotions need authorization.
- Deliverability: mailbox providers now expect sender authentication and easy unsubscribes for bulk senders.
Our CAN-SPAM healthcare email guide covers templates. For list use, see HIPAA for marketing teams.
Common mistakes and limits
CAN-SPAM sets a federal minimum, not a quality standard. Meeting it does not guarantee inbox placement, and it does not address HIPAA, state privacy laws or text messaging, which falls under the TCPA. Common mistakes include subject lines that promise offers the email does not contain, unsubscribe links that require a login, and a vendor's list that does not receive the practice's opt-outs.
Purchased lists bring both CAN-SPAM and reputation risk and rarely perform. Practices that send email from several platforms, such as a booking system, a CRM and a newsletter tool, should name one owner for the suppression list and test unsubscribes every quarter. Email copy is also advertising, so state medical board rules on claims apply, as covered in the state medical board advertising guide. For specific campaigns, confirm the approach with your compliance or legal team.
Related pages from the US team
CAN-SPAM healthcare email guide
Email rules and templates for practices.
HIPAA for marketing teams
Using patient lists the right way.
Patient email and SMS marketing
How Ichelon Consulting US runs email programs.
US healthcare marketing glossary
Every term, defined in plain English.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Does CAN-SPAM require consent before emailing?
No. CAN-SPAM is an opt-out law. It does not require prior consent for commercial email, but it requires accurate headers, honest subject lines, a postal address and a working opt-out. Practices still need a HIPAA basis to use patient information for email marketing.
How fast must a practice honor email unsubscribes?
Under CAN-SPAM, within 10 business days. The opt-out mechanism must also keep working for at least 30 days after the email is sent. Practices should sync opt-outs across all email tools and vendors.
Are appointment reminder emails covered by CAN-SPAM?
Mostly not. Transactional or relationship messages, such as appointment confirmations, are largely exempt from CAN-SPAM's commercial email requirements, though they must not have false routing information. Adding promotional content can change how the email is classified.
Who enforces CAN-SPAM?
The Federal Trade Commission is the main enforcer, and civil penalties apply per violating email, with amounts adjusted for inflation. Some other federal agencies and state attorneys general also have enforcement roles, and internet service providers can sue in some cases.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Want your practice email to be compliant and actually read?
Book a 30-minute call. We'll review your lists, templates and opt-out handling.