Don't upload it.

Whatever list you're looking at, the export from the old practice management system, the forty thousand rows somebody found in a spreadsheet, the patients who quietly stopped booking sometime in 2022, the instinct is to drop it into an email platform and send a we-miss-you campaign this week. That one decision has killed more reactivation programs than any budget cut ever has.

Not because the patients aren't valuable. They are. Lapsed patients are the cheapest revenue in the building. But a list that has been sitting still for three years is not a mailing list yet. It's raw material.

Some of those addresses no longer exist

Google deletes Google Accounts that go two years without activity, including the Gmail attached to them. The policy has been in force since December 2023, and reading or sending an email is what counts as activity (Google's inactive account policy).

So if a slice of your list is Gmail addresses belonging to people who moved, changed jobs, or just drifted, some of those mailboxes are simply gone.

Gone is the good outcome. That's a hard bounce.

The worse outcome is the address that was abandoned, reclaimed by the mailbox provider after a long dormancy, and quietly turned into a recycled spam trap. Hitting one is a strong signal of stale data on your list, and re-engagement sends to a legacy database are exactly where these surface (Validity's primer on spam traps). You will not see a bounce. You will just see everything get quietly worse.

Your sending reputation is the real constraint

Google requires every sender, at any volume, to keep the spam complaint rate reported in Postmaster Tools below 0.30%, and recommends staying under 0.10%. Cross roughly 5,000 messages a day to personal Gmail accounts and you also have to authenticate with SPF, DKIM and DMARC and support one-click unsubscribe, which became mandatory for those senders on June 1, 2024 (Google's sender guidelines).

Run the arithmetic on a cold list. Three complaints per thousand delivered messages puts you at the ceiling. On a list of people who don't remember opting in, who may not remember your practice name, and who are seeing your brand for the first time in three years, three per thousand is not a hard number to hit.

And the damage isn't confined to that campaign. The same sending domain carries your appointment reminders, your recall notices, and your post-visit instructions. Torching your reputation on a reactivation blast costs you the messages that were actually working.

HIPAA is probably not the blocker you think

Practices often stall here, assuming they need fresh written authorization before they can contact a lapsed patient at all.

Usually not. HIPAA's definition of marketing at 45 CFR 164.501 excludes communications for treatment of the individual, including case management and care coordination, and communications that direct or recommend alternative treatments, therapies, providers, or settings of care (the text is worth reading).

That carve-out has a condition attached. It holds only where you receive no financial remuneration from a third party for making the communication. Take money from the company whose product you're recommending and the same message becomes marketing that needs written authorization.

Within those limits, telling a patient they are overdue for a skin check, an eye exam, or a hygiene visit is a treatment communication. Promoting a discounted cosmetic package is not. The line matters, and it is not the same line as the deliverability one.

The compliance question that actually bites on an old list is simpler. Whatever platform you load it into is about to hold protected health information, and it needs to sign a BAA. We've written about where that line sits.

The order that works

Warm the list from the inside out.

1. Segment by last visit date. Twelve months, twenty four months, thirty six and beyond. These are three different audiences with three different risk profiles, and they should never be in the same send.
2. Start with the smallest, warmest slice. Patients seen in the last year are nearly current. Their addresses are good and they remember you. Send to them first and let the engagement build a signal.
3. Clean before every step out. Validate the next segment before you send to it, not after the bounces come back.
4. Lead with the treatment message. Overdue for a visit reads as useful. A promotion reads as spam, and the complaint rate will tell you so.
5. Read the numbers before widening. Complaint rate, bounce rate, and unsubscribes per segment. If the twenty four month cohort behaves, open the thirty six. If it doesn't, stop.

This takes a few weeks instead of an afternoon. That is the entire trade.

PatientCampaign handles the segmentation and staged sending and will sign a BAA for the list. But the sequencing matters more than the tool. A group that gets the order right with a spreadsheet will beat one that gets it wrong with better software.

The patients in that file already chose you once. They're worth more than one afternoon's worth of care.