Here's the thing the enforcement wave obscures: patient reactivation email is one of the most defensible marketing activities in healthcare — if you build it right. This is the playbook.

First, the compliance frame: why recall email is allowed at all

HIPAA doesn't ban emailing patients. It regulates marketing uses of PHI — and it carves out treatment-adjacent communications. Under the Privacy Rule, communications about treatment, case management, care coordination, and reminders to obtain care are generally not "marketing" and don't require a separate authorization. A message telling a patient they're overdue for a cleaning, an annual skin check, a follow-up injection, or a lapsed therapy cadence is a healthcare-operations/treatment communication, not an ad.

Where practices get in trouble:

• The tool, not the message. A perfectly permissible recall email becomes a violation when the patient list — names, emails, last-visit dates, procedure interests — sits in an email platform that won't sign a BAA. The segment itself is PHI: "everyone on this list is a patient of a dermatology practice who hasn't been in for 18 months" is health information tied to identity.
• Crossing into true marketing. Promoting a third party's product, or selling the list, requires authorization. Promoting your own services to your own patients, through a BAA-covered stack, generally doesn't — but keep sensitive specifics (diagnoses, specific conditions) out of subject lines and preview text regardless. Assume family members see inboxes.
• Ignoring opt-outs. Patients must be able to opt out of these communications, and the opt-out must actually work, immediately, everywhere.

So the consent basis for a recall program is: existing treatment relationship + BAA-covered systems + no third-party promotion + honored opt-outs. Document that reasoning once, and your reactivation program stands on solid ground. (If your current email tool is Mailchimp or Klaviyo, start with our verdicts on Mailchimp and Klaviyo — the short version is that the list can't live there.)

The infrastructure requirements (non-negotiable)

Before writing a single subject line:

1. A BAA with every system that touches the list. Email platform, CRM, and anything syncing between them.
2. Encryption where the list lives. In PilotPractice, patient contact records, messages, calls, and files sit under field-level encryption — not just disk encryption, but per-field — with an append-only HIPAA audit log recording who accessed what.
3. Access monitoring. Staff logins are audited for new devices and impossible travel, and PHI access patterns are scored for insider-threat anomalies. A reactivation list is exactly the kind of export a departing employee takes to a competitor; you want to see that access happen.
4. Suppression that works. Opt-outs, deceased flags, do-not-contact, and active-treatment exclusions enforced at send time, not batch-cleaned monthly.
5. If any automation drafts or sends messages, it needs guardrails: our AI reply layer runs every outbound draft through medical/legal guard-dog review, a fail-closed egress filter, hard rate caps (max 6 automated messages per 24 hours per contact), and human-in-the-loop approval. Automation should make recall more careful, not less.

Building your dormant-patient segments

"Dormant" is not one list. Segment by why they lapsed and what brings them back:

• Recall-overdue (the core segment). Patients past their clinical recall interval: 6+ months for hygiene, 12+ for annual exams/skin checks, 3–4 months past a typical injectable or maintenance cadence. Highest intent, easiest message — this is a reminder, not a pitch.
• One-and-done. Came once, never rebooked. Usually within the last 6–18 months. The message here is relationship repair plus an easy path back.
• Treatment-incomplete. Accepted a plan (or a phase of one) and stalled — unfinished restorative work, a consult that never converted, a package with sessions remaining. Highest revenue per send; coordinate with clinical staff before sending.
• Long-dormant (18–36 months). Worth one respectful sequence; beyond ~3 years, verify contact info is still theirs before emailing anything patient-flavored at all.
• Exclusions, always: active-treatment patients, balances in collections (different letter, different department), documented opt-outs, deceased, and anyone flagged do-not-contact.

Pull these from the EHR/PMS on a schedule rather than as a one-time export — a stale list re-invites patients who came in last week.

Sample sequences

Keep subject lines free of conditions and procedures. "It's time for your visit" — not "Overdue for your acne follow-up."

Sequence A — Recall overdue (3 touches over 3 weeks)

1. Day 0 — the reminder. "You're due for a visit." Warm, short, one button to the online scheduler. From the provider, not "the marketing team."
2. Day 8 — the friction-remover. "Booking takes 60 seconds." Restate hours, insurance participation, and the self-scheduling link. Offer a reply-to-book option.
3. Day 21 — the last word. "We'll hold a spot for you this month." Light urgency, then stop. Silence after three touches is an answer; respect it and recycle them into next quarter's pull.

Sequence B — One-and-done winback (2 touches)

1. "We'd love to see you again" + a genuinely useful piece (seasonal care tips, a new-service announcement from your own practice).
2. One week later: direct booking invitation, optionally with a new-patient-style convenience (early/late slots, online intake done in advance).

Sequence C — Treatment-incomplete (2 touches, clinician-approved)

1. "Let's finish what we started" — reference the plan generically, never the diagnosis, and route to a phone call or portal message for specifics.
2. Follow-up from the front desk offering to handle scheduling and benefits re-verification.

The newsletter that keeps them warm. Between sequences, a monthly newsletter — practice news, staff highlights, seasonal health tips, new services — keeps the reactivation well from refilling. Same rules: BAA-covered sending, no condition-based content targeting sensitive segments, working unsubscribe.

Deliverability: the quiet killer of recall programs

Compliance gets the attention, but deliverability decides whether the program works. Practices resurrect a three-year-old list, blast it from a domain that has never sent bulk email, and land in spam for months — including for transactional messages like appointment confirmations. Protect yourself:

• Warm the sending domain (or use a dedicated subdomain for campaigns so recall email can't damage your transactional reputation). SPF, DKIM, and DMARC configured before the first send — receivers increasingly reject mail without them.
• Validate before you send. Long-dormant lists carry dead addresses; a 10%+ bounce rate on send one can tank your domain reputation for the quarter. Verify emails, and start with the most recently active segment to build engagement signals first.
• Throttle. Send the recall-overdue segment over days, not in one blast. Gradual volume looks like a practice communicating with patients; a spike looks like a purchased list.
• Watch replies and complaints, not just opens. A single "who is this?" complaint from a patient whose email changed hands is a signal to tighten your long-dormant verification step.

What good looks like: benchmarks

Set expectations before the first send so nobody declares failure at the wrong moment. Well-run recall sequences to the overdue segment typically see 30–50% open rates (these are patients who know you), and it's normal for replies and phone calls to outnumber link-through bookings — dormant patients often want to ask a question before committing. That's why the reply-handling step matters more than the click-tracking step. A reactivation program that books even 3–5% of a genuinely dormant list usually pays for itself many times over against what those same patients would cost through paid acquisition; treatment-incomplete segments convert meaningfully higher. Measure quarterly, not per-send.

Close the loop or don't bother

The step everyone skips: routing the reply. A reactivation email that generates a response into an unmonitored inbox torched the goodwill you just spent. In our stack, replies land in the same encrypted inbox as calls, texts, and web forms; booking links go to an EHR-integrated scheduler (30+ integrations) so a reactivated patient books straight into your actual calendar — no double entry, no "we'll call you back." Measure the program on kept appointments per segment, not opens.

The reactivation checklist

1. BAAs signed with email platform + CRM + any sync layer
2. List stored encrypted, access-audited — never exported to a non-covered tool
3. Segments defined: recall-overdue, one-and-done, treatment-incomplete, long-dormant
4. Exclusions enforced at send time (opt-out, active treatment, collections, deceased)
5. Subject lines and preview text free of conditions/procedures
6. Sequences capped (3 touches max), from the provider, one clear booking path
7. Replies monitored; booking link writes to the EHR
8. Reporting on kept appointments, not opens

Do it — or have it done

Everything above is doable in-house if you have the encrypted stack, the BAAs, and someone to build segments, write sequences, and watch the replies. Most practices have none of the three, which is why the dormant list just sits there. PilotPractice includes the encrypted CRM, the guarded automation, the EHR-integrated booking, and the team that actually writes and runs the sequences — reactivation is part of the engagement, not an add-on tool.

Related reading: HIPAA-compliant marketing automation, HIPAA-compliant SMS (the recall channel that out-performs email), and the full HIPAA-compliant marketing guide. Compliance evidence lives at trust.pilotpractice.com. Want your dormant list working by next month? Book a demo.