Do I need consent to email patients? CASL and CAN-SPAM

Canada’s anti-spam law covers commercial electronic messages, which includes marketing email and can include texts. The core ideas are:

1. Consent. You need express consent, or in some situations implied consent, before sending.
2. Identification. Say who you are and give your contact details.
3. Unsubscribe. Every message needs a clear way to opt out, and you must act on unsubscribe requests within 10 business days.

Express consent means someone has clearly agreed, for example by ticking an unticked box on your sign-up form that says what they will receive. Implied consent can arise from certain existing relationships, such as a recent purchase or inquiry, but it has time limits. Implied consent from a purchase or an existing business relationship generally lasts 2 years from the last transaction, and from an inquiry 6 months. and what counts.

Keep a record of when, how and for what each person consented. Don’t assume that a patient’s details in your booking system mean they have agreed to a newsletter.

CAN-SPAM covers commercial email. In summary, as the FTC explains it:

• Headers and subject lines must be honest.
• Marketing messages must be identified as ads.
• You must include a valid postal address.
• You must give a clear opt-out and honour requests within 10 business days.
• You can’t charge for opting out or make it hard.
• Hiring someone to send your email doesn’t remove your responsibility.

Penalties apply per email. Check the current figures on the FTC’s site. Some states have additional rules, and email to patients may also touch health privacy law.

A newsletter promoting your services or offers is a commercial message. A reminder about someone’s booked appointment is usually treated differently, but the line depends on content and local law. Keep reminders factual and keep promotion out of them. Don’t mix the two.

Treat your email list as part of your clinic’s own records. Keep it in your own system, with your own access controls. We don’t hold or handle patient lists. Don’t upload patient lists to ad platforms or share them with others without checking your privacy obligations. Rules differ by province and state.

Don’t put health details in a newsletter or reveal that anyone is a patient to other recipients. Send individually or use blind copy, and use proper email software.

1. Use a sign-up form on your site with unticked consent and a clear description.
2. Ask patients at the front desk or in your intake process and record it.
3. Send a short welcome email confirming what they signed up for.
4. Put your name, address and an unsubscribe link in every email.
5. Process unsubscribes immediately, not just within the deadline.
6. Clean the list now and then and remove inactive addresses.
7. Don’t buy lists.

See how to run a clinic newsletter for content ideas.