Most med spas run their email marketing on a tool that quietly prohibits the exact data they're putting into it. If you're emailing patients about their Botox follow-up, their last filler appointment, or a membership tied to a treatment plan, you're handling protected health information (PHI) — and the platform sending those emails needs to be HIPAA-compliant. Mailchimp isn't. This is the gap most practices don't discover until an audit, a complaint, or a breach forces the question.

Here's what HIPAA email marketing for a med spa actually requires, why Mailchimp can't meet the standard, and how to fix it without abandoning the campaigns that drive revenue.

Why a med spa is a HIPAA-covered business in the first place

There's a persistent myth that med spas operate in a gray zone — half retail, half medical — and therefore sit outside HIPAA. That's wrong in most cases. The moment a licensed provider performs or supervises a medical procedure (injectables, laser treatments, microneedling, prescription skincare, weight-loss programs) and you bill, chart, or store information about it, you're creating PHI. If you transmit that information electronically in connection with a covered transaction, you're a covered entity.

PHI isn't limited to a diagnosis or a chart note. In an email context, it includes far more than practice owners assume:

• A patient's name combined with the fact that they're your patient
• Appointment reminders that reference a specific treatment
• "We miss you" win-back emails segmented by procedure history
• Birthday or membership emails tied to a treatment plan
• Any list where being on the list reveals someone received a medical service

That last point catches most people. You don't have to mention a procedure in the email body. If your audience segment is "everyone who got CoolSculpting in Q1," the segment itself is PHI.

What HIPAA actually requires from an email platform

HIPAA doesn't ban email marketing. It requires that any vendor touching PHI on your behalf — a "business associate" — formally agree to protect it. That agreement is the Business Associate Agreement (BAA), and it's non-negotiable. Without a signed BAA, sharing PHI with a vendor is a violation on its face, regardless of whether a breach ever happens.

A compliant email marketing setup for a med spa needs four things:

1. A signed BAA between your practice and the email platform.
2. Encryption of PHI in transit and at rest.
3. Access controls and audit logging so you can see who touched what.
4. Vendor accountability — the platform has to actually take on liability for safeguarding the data, not just check a box.

The BAA is the load-bearing requirement. Everything else follows from a vendor that's willing to sign one.

Why Mailchimp won't work — and it's not a configuration problem

Mailchimp does not sign a BAA, and its Terms of Use explicitly prohibit using the platform to collect, store, or transmit PHI. This isn't a setting you can turn on, an add-on you can buy, or a tier you can upgrade into. It applies to every plan — Free, Essentials, Standard, and Premium — and has remained the position of Mailchimp's parent company, Intuit, since the 2021 acquisition.

That means there's no compliant way to run patient email marketing on Mailchimp. If you upload a list of patients, segment by treatment, or send a campaign that reveals someone is under your care, you're sharing PHI with a business associate that has explicitly refused to protect it. You're not one careful configuration away from compliance — the platform's own terms put the activity off-limits.

This trips up med spas constantly because Mailchimp is excellent at general marketing. The templates are clean, the automations are easy, and most teams adopted it before there was a provider on staff. The tool didn't change; the practice's obligations did the day it started delivering medical services.

The risk isn't theoretical. A disgruntled patient complaint, a former employee, or a routine compliance review can surface the issue. And because using a non-compliant platform is a violation regardless of breach, you don't get the benefit of the doubt. The exposure is the setup itself.

What med spas should use instead

The fix is straightforward: move patient email marketing to a platform that will sign a BAA and is built to handle PHI. When you evaluate alternatives, look for:

• A BAA offered as standard, not buried behind an enterprise sales call or a six-figure contract.
• Healthcare-specific features — treatment-based segmentation, appointment and recall reminders, and consent tracking — built with PHI handling in mind.
• Encryption and audit logging included by default, not as paid upsells.
• Marketing capability that's actually competitive with general tools, so you're not trading compliance for clunky campaigns.

That last criterion matters more than people expect. Plenty of "HIPAA-compliant" tools are transactional email systems bolted onto a patient portal — fine for reminders, useless for the kind of segmented, automated, brand-forward campaigns that fill appointment books. You shouldn't have to choose between staying compliant and running marketing that works.

This is exactly the gap Patient Campaign was built to close. We sign a BAA with every practice as a standard part of onboarding, encrypt PHI in transit and at rest, and give you treatment-based segmentation, automated recall and win-back flows, and the campaign tooling med spas actually need — without the Mailchimp compliance liability. You get the marketing horsepower and the legal footing in one platform.

How to make the switch without losing momentum

Migrating off Mailchimp is less disruptive than most owners fear. A clean transition looks like this:

1. Inventory what you're sending. Separate genuinely general content (a newsletter with no patient-specific data) from anything that touches treatment history, appointments, or patient status. The latter is what has to move.
2. Export your audience and rebuild segments inside a BAA-backed platform, keeping treatment-based segments intact so your recall and win-back automations survive the move.
3. Recreate your core automations — post-treatment follow-ups, membership reminders, reactivation flows — on the new platform first, since those are where PHI shows up most.
4. Confirm the BAA is signed and on file before you send a single patient campaign. This is the step that makes everything above legitimate.
5. Document the change. A short note in your compliance records showing when and why you migrated demonstrates good-faith diligence if you're ever asked.

You don't have to do it all in a weekend. But you should stop sending PHI through a non-compliant platform now, even if the full migration takes a few weeks.

The bottom line

HIPAA email marketing for a med spa comes down to one question: will your platform sign a BAA and protect PHI? Mailchimp answers no — clearly, in its own terms, on every plan. Continuing to run patient campaigns there isn't a calculated risk; it's a standing violation waiting to be noticed.

The good news is that the alternative is better, not just safer. A purpose-built, BAA-backed platform like Patient Campaign lets you market the way you want to — segmented, automated, on-brand — without betting your practice on a tool that told you, in writing, not to use it for this. Make the move, get the BAA signed, and put the compliance question behind you for good.