Email marketing to healthcare practices

This guide is for suppliers, software companies, agencies, billing and staffing firms that sell to medical, dental, pharmacy and therapy practices. It covers how many practices there are, who reads the email, what HIPAA does and doesn't cover, and what to look for in a list.

How many practices can you reach?

The federal register of healthcare providers, CMS's National Plan and Provider Enumeration System (NPPES), gives an upper bound for each group. The table counts distinct addresses with an active registration of each type in the NPPES file of 2026-09-14:

Each count is the number of distinct addresses (street line plus ZIP code) where at least one active registration of that type sits. These are upper bounds, not counts of open practices. Many records are years old: the median dental record was last changed 10.0 years before the file date, the median physician record 5.6 years and the median pharmacy record 5.0 years. A practice that has moved or closed can keep its registration, and one practice can sit at several addresses. The exact figures and the method are on each list page and in its data file.

NPPES holds no marketing email (its only email-like field is a secure clinical messaging address, which isn't for marketing), so every email on a practice list has to come from somewhere else, usually the practice's own website. A list copied from the register alone gives you addresses and phone numbers that may be a decade old.

Who reads email at a practice?

At many independent practices, the email you send lands in a shared inbox that the front desk or the practice manager reads, and the owner sees it only if the manager passes it on. Plan the campaign around that:

• Write to the practice manager. Their job usually covers supplies, software, billing, staffing and vendors. Say what the product does for the office in the first two lines.
• Expect the owner to decide. At a small practice the owner, often a clinician, signs. Give the manager something to forward: a short summary, a price range or a sample.
• Find the group first. Practices that belong to a group often buy centrally, so the decision sits at the group's head office. Dental groups are the clearest case; our guide what is a DSO? explains how they buy. Hospital-owned physician practices usually buy through the health system.
• Pharmacies split by type. Independent pharmacies decide locally. Chain stores, and pharmacies inside supermarkets and big-box stores, decide at head office. Long-term care and mail-order pharmacies buy differently again.

Keep each message short enough to read between patients, and make the subject line say what you sell.

Does HIPAA apply when you email a practice?

HIPAA applies to how a covered entity, and its business associates, use and disclose protected health information about patients. It doesn't govern a vendor emailing the practice about a product.

HHS describes the Privacy Rule as protecting "individually identifiable health information" held or transmitted by a covered entity or its business associate. That is information about a person's health, care or payment for care that identifies them (HHS, Summary of the Privacy Rule; 45 CFR 160.103). A practice's name, address, phone and the office email it publishes on its website describe the business, not a patient.

HIPAA matters to you in three other ways:

• If your product touches patient data, you are likely a business associate. HHS says a covered entity that engages a business associate "must have a written business associate contract" with it, and business associates are "directly liable" for some HIPAA provisions (HHS, Covered Entities and Business Associates). Expect the practice to ask for that contract.
• HIPAA's "marketing" rules are about patients. The Privacy Rule defines marketing as a communication that encourages people to buy or use a product or service, and requires the patient's authorization before a covered entity uses or discloses protected health information for marketing, with exceptions (HHS, Summary of the Privacy Rule). If you help practices market to their patients, those rules apply to the practice and to your service.
• Not every practice is a covered entity. HHS lists doctors, clinics, dentists, chiropractors and pharmacies as covered providers "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard", such as an insurance claim (HHS).

Your email to the practice follows CAN-SPAM. The FTC says the law "makes no exception for business-to-business email" (FTC). Every message needs accurate headers, an honest subject line, your postal address and a working opt-out. Our guide is buying an email list legal? covers the rules.

What a good healthcare practice list contains

A useful list has one row per practice location, not one per clinician, and tells you where each email came from:

Avoid lists that guess addresses from name patterns, and lists of individual clinicians' personal emails. Both raise bounce rates and complaints, and guessing addresses is close to what CAN-SPAM calls a dictionary attack. Check the status of each email before you send, and keep your bounce rate low: our bounce-rate benchmarks show the limits sending platforms set.

The healthcare lists compare our practice lists side by side. Each has one row per location, with the email the practice publishes on its website and the page where we found it. You can order each list nationwide or by state.

What this guide can't tell you

• Whether a particular product or service makes you a business associate. That depends on what data your product touches.
• State health privacy laws, which can add rules beyond HIPAA.
• How many emails a list will contain. The register counts above include stale and duplicate entries, and the register holds no marketing emails.

This is general information, not legal advice.