This page is for orthopedic practice owners, administrators and marketing leads. My background is over ten years in digital marketing and 450 websites built. I am not a lawyer, so have your privacy officer or counsel review every template and rule below before you send anything.
Considering ongoing marketing support? I run orthopedic marketing agency services for practices like yours. I can discuss your priorities and possible scope. Fees, responsibilities, account access and handover terms are defined in a written proposal. Request a marketing review
In my view, your existing patient list is both the easiest audience to reach and the easiest to mishandle. A recall email looks like a harmless reminder. Written badly, it can place a procedure name in a subject line, or send patient data to an email vendor nobody vetted.
Which patients should come back, and when, is a clinical decision. Your clinicians set those rules. This page covers the message and the mechanics around it.
Recall or marketing? Sort every email first
The HIPAA Privacy Rule defines marketing as a communication about a product or service that encourages recipients to purchase or use it, and then lists exclusions. Those exclusions include communications for treatment by a provider, including care coordination and recommending alternative treatments or settings of care, and descriptions of health-related products or services the covered entity itself provides. They stop applying when the covered entity receives financial remuneration from a third party whose product is being described.
If something counts as marketing, the rule says an authorization is required, apart from face-to-face communications and promotional gifts of nominal value.
So the same email can land differently depending on the purpose and on who paid. Here is how I would sort common ones. The right-hand column is my own working default and not a legal ruling, so your compliance contact decides.
| Who it goes to | My default | Question for compliance | |
|---|---|---|---|
| Follow-up reminder a clinician recommended | Patients with that recommendation on file | Likely treatment-related, send once approved | Does our process document who set the recall rule? |
| “Time for your annual check” | Patients past a date the practice sets | Have it reviewed | Is this treatment communication, or promotion of a service? |
| New location or extended hours | Existing patients | Often low risk | Does it name services that imply a condition? |
| New service the practice provides | Existing patients | Have it reviewed | Does any third party pay us for this? |
| Device or product paid for by a vendor | Anyone | Do not send without authorization | Authorization must state the payment is involved |
| Newsletter with general news | Patients who chose to receive it | Fine, with an opt-in record | Is the content commercial under CAN-SPAM? |
What to send
Keep it short and boring on purpose. A recall email has one job, which is to get a person back to your scheduler. Here is a draft for your compliance contact to review.
- Subject: A note from [Practice Name]
- Greeting: Hello [First Name],
- Message: [Practice Name] is sending a reminder that follow-up appointments are open at our [Location] office.
- Booking: To book, use our [online scheduling link] or call [phone number] during office hours. Please do not reply to this email with health questions.
- Footer: [Practice Name], [Street Address, City, State, ZIP]. To stop these emails, use the [unsubscribe link].
I would keep the first name only if your compliance contact is comfortable, and leave the surgeon’s name out if that surgeon’s specialty is narrow enough to imply a condition. When a clinician wants to tell a patient something specific, the patient portal or a phone call is my default channel. Email is a poor home for clinical detail.
What to leave out
Each item on this checklist is my default until your privacy officer says otherwise.
- Diagnosis, condition, body part or side
- Procedure name, implant or device
- Surgery or visit dates
- Specialty clues, such as “your spine surgeon” or a “knee replacement follow-up” subject line
- Sender names or addresses that reveal a service line, such as spine-recall@yourpractice
- Segment names visible to anyone, in the email or its link
- Web addresses that contain a condition or a patient identifier
- Other recipients visible in the To or CC field
- Before and after images or a patient story
- Vendor promotions you were paid or given anything to include
- Open or click tracking that passes patient details to an ad platform
The segment point catches people out. The email may read cleanly while the list it went to is called “Hip replacements 2024” inside a vendor’s system.
The vendor and list checks
Business associate agreement. Ask your privacy officer whether your email platform needs one and whether the vendor will sign it. A patient list in a marketing tool is patient data in a marketing tool. Be wary of a vendor’s “HIPAA compliant” badge, too: the FTC warns against misleading HIPAA claims, so ask for the agreement and not the logo.
Keep lists out of ad platforms. Google’s personalized advertising policy lists health as a sensitive category and says customer lists cannot be used when promoting in those categories. Uploading your recall list for retargeting is off the table there, and I would treat other platforms with the same suspicion.
Email security. Whether your messages need encryption or a portal notification instead is a question for your privacy officer.
CAN-SPAM still applies to commercial email
HIPAA is not the only rule. If the primary purpose of an email is commercial, the FTC’s CAN-SPAM compliance guide requires accurate headers, an honest subject line, a clear disclosure that it is an advertisement, a valid postal address and a working opt-out. You must honor opt-outs within 10 business days, and the opt-out has to keep working for at least 30 days after you send. The guide lists penalties of up to $53,088 per violating email, as of the page I read in November 2026.
The guide says transactional or relationship email is mostly exempt, but a mixed message follows its primary purpose, and that question belongs to your counsel. When the guide mentions “recall”, it means recall information about a product or service the recipient bought, so please do not assume a patient recall email is exempt on the strength of that word.
The guide also says you cannot contract this responsibility away to a vendor.
Google’s email sender guidelines add a deliverability layer: all senders need SPF or DKIM, spam rates must stay below 0.30% with below 0.10% recommended, and senders of more than 5,000 messages a day to Gmail accounts also need DMARC and one-click unsubscribe.
A safe way to start
I would start at one location.
- Your clinicians write the recall rule, in plain language, and your scheduler confirms how patients are flagged.
- Your privacy officer signs off on the rule, the template, the vendor and the opt-out process.
- Pull the list from your practice system, excluding anyone who opted out, and check that the export holds only what the email needs.
- Send a small batch and have one named person watch the phones, because a good recall email creates calls. My guide to call handling covers the peak-hour problem.
- Make sure the booking link actually works on a phone. When I ran the same checks on 21 orthopedic practice homepages for my website study on November 1, 2026, 15 showed no sign of online scheduling and 14 had no form on the homepage. That study covers homepages only, on a small hand-picked sample, and says nothing about email. It does suggest checking where your link lands, and my online scheduling guide covers the options.
How to tell whether it worked
Count what the schedule shows, since opens are a shaky measure.
- Baseline: recall visits booked per month before any email, at the pilot location.
- Change: one approved email to one approved list.
- Measure: visits booked from that list within 30 days, plus opt-outs and spam complaints, logged with the orthopedic marketing KPIs I recommend.
My default stop rule: pause the program if your spam rate approaches Google’s 0.30% limit, if any patient reports a privacy concern, or if the list produces no extra booked visits after two sends. Then fix the rule, the message or the list before you try again.
Frequently asked questions
Is a patient recall email allowed under HIPAA? Often it can be, depending on purpose and on whether a third party pays you, but that call belongs to your compliance contact.
Can we put the procedure name in the subject line? My default is never. A subject line can show on a lock screen or a shared device, and the message works without it.
Can we use our recall list for Google or Facebook ads? Google’s policy says customer lists cannot be used when promoting in sensitive categories, and health is one. For any other platform, check its current terms and talk to your privacy officer first.
How often should we send recall emails? There is no number I can verify for orthopedics. Let the clinical rule set the timing, and my default is to cap it at a few reminders per patient before moving to a phone call or stopping.
Can we ask for reviews in the same email? My default is no. Read my guide to orthopedic patient reviews before you set up review requests.
See what a returning patient finds
I will record a free walkthrough of your website, your Google listings and your top three local competitors, including the booking path a recall email would send someone to. You do not need a call to get it.
I read every enquiry myself. Book a free strategy call if you want a second pair of eyes on this. No pitch, just the audit. Phone: +91 97297 12388.
