Careers
Part of Dental email marketing: the practical version
What matters most in dental email marketing questions
common dental email marketing questions cover consent, purpose, HIPAA, opt-outs, patient data, sender identity, replies, accessibility, and measurement.
What to take away
- Rules attach to the message, not the software. Classify every send as commercial, transactional or clinical.
- CAN-SPAM requires accurate headers, an ad identifier and a valid postal address. Opt-outs must be honored within 10 business days.
- HIPAA does not forbid patient email. A risk analysis must support it, and safeguards such as encryption are expected. Breach notice runs to 60 days from discovery.
- An address held for treatment is not consent for a marketing list.
- A vendor sending on your behalf does not absorb your liability.
Two laws govern most dental email in the United States, and they answer different questions. CAN-SPAM controls how a commercial message is built and how a recipient can stop it. HIPAA controls whether patient information may travel in that message at all. Neither law excuses the other.
Classify the message before you send it
A recall reminder for a cleaning that is due is a treatment communication. A whitening offer with a price is marketing. A message that does both is judged by primary purpose.
The FTC guide treats primary purpose as what a reasonable recipient would conclude from the subject line and the body. Wrapping an offer inside a health reminder does not change the classification. It adds risk.
Practical test: if a staff member cannot say in one sentence why this person is receiving this email, hold the send. The classes, and the paperwork each one needs, are set out in dental email marketing.
What CAN-SPAM requires of a dental practice
CAN-SPAM applies to commercial messages whatever the list size. It also reaches mail a vendor sends in the practice's name.
CAN-SPAM Email Requirements
- Accurate headers
- Nondeceptive subjects
- Ad identification
- Valid postal address
- Clear opt-out method
- Prompt honoring of requests
- Oversight of vendors
What CAN-SPAM requires
| Requirement | What the practice must do |
|---|---|
| Header information | Accurate From, To, Reply-To and routing lines; no false domain |
| Subject line | No deceptive subject; it must reflect the content |
| Advertisement notice | Clear and conspicuous identification as an ad |
| Postal address | A valid physical postal address in every commercial message |
| Opt-out mechanism | Clear and conspicuous, and functional for at least 30 days after the send |
| Opt-out timing | Requests honored within 10 business days |
| Vendor oversight | Know what your email platform sends in your name |
The FTC's CAN-SPAM compliance guide is the controlling summary. Civil penalties reach up to $53,088 per email, a figure the FTC adjusts for inflation each January. Both the sender and the company whose product is promoted can be liable.
Address harvesting and dictionary attacks add criminal exposure of up to five years.
HIPAA safeguards for patient email
The Security Rule does not ban email. It requires safeguards that fit the risk.
- Include email in the annual security risk analysis.
- Encrypt protected health information in transit, or document an equivalent safeguard.
- Send the minimum necessary information for the purpose.
- Record the patient's preferred channel and honor a change request.
- Hold a business associate agreement with any platform that touches patient data.
- Notify affected patients within 60 days of discovering a breach.
The HIPAA Security Rule treats encryption as addressable rather than optional in practice. Skip it, and the risk analysis has to justify that choice. Breaches touching 500 or more people in a state also require notice to HHS at the same time, plus media notice.
Privacy Rule marketing limits sit alongside this. Patient authorization is required before protected health information is used for marketing, with narrow treatment and operations exceptions.
A reminder about due care is treatment. A promotion for a service the patient has not received is marketing. HIPAA-compliant dental marketing covers where that line falls for campaigns.
Example: a message-class matrix
Message-class matrix
Example
- Transactional
- Appointment confirmation, billing receipt
- Clinical
- Post-operative instructions, recall for due care
- Commercial
- Whitening offer, new-patient promotion
- Newsletter with an offer
- Practice newsletter carrying a sponsor
Opt-out treatment
- Transactional
- Not required, though honoring one is safer
- Clinical
- Honor patient channel requests
- Commercial
- Required, clear and conspicuous
- Newsletter with an offer
- Required when the offer leads
Staff should place a draft in one row before choosing a list.
Opt-outs, replies and vendor responsibility
Once a patient opts out, the address may not be used for another commercial send. It also may not be sold or transferred for another party's marketing. A login, a fee or a reply email as the only exit fails the requirement. How to improve dental email marketing covers list hygiene after the opt-out lands.
Replies need an owner. Route clinical, billing, scheduling and urgent content into named queues rather than a shared inbox. A reply carrying symptoms belongs in the chart, not in a marketing thread.
Vendors do not move the duty. The FTC places responsibility on the sender, and a practice can be liable for a vendor's message sent in its name. Contract for template approval, list approval and a business associate agreement.
Canada: consent under CASL and PIPEDA
Canada adds consent rules on top of everything above. CASL requires express or implied consent before a commercial electronic message, full sender identification, and unsubscribe honored within 10 business days. Business penalties can reach $10 million CAD.
PIPEDA governs the personal information behind the list. It requires consent for collection and use, and notice to the Privacy Commissioner and to affected people as soon as feasible after a breach carrying real risk of significant harm.
What to keep in writing
One record per message class is enough. It should capture:
- The message class and the rule it rests on.
- The approved data fields and the eligible population.
- The sender identity and the monitored reply route.
- The opt-out method and the date it was last tested.
- The reviewer and the next review date.
If the audience, jurisdiction, vendor or message purpose changes, the earlier answer does not carry over. Review before the next send.
dental marketing strategy development shows how these records stack into a workable plan.
Common questions
Does CAN-SPAM apply to a small practice newsletter?
Yes. The Act covers commercial messages regardless of list size, and the FTC guide contains no business-to-business exception.
Can we email every patient whose address is in our software?
No. A treatment relationship supports care messages. Marketing to the full list needs a lawful basis and, under HIPAA, often an authorization.
Is encryption required for patient email?
The Security Rule lists encryption as addressable. A practice must use it or document why another safeguard handles the risk.
Who is liable if our vendor sends the email?
Both parties can be. The practice stays answerable for the content, the list and the opt-out honored in its name.
