Rules
CASL Healthcare Email Marketing Compliance: What Canadian Clinics Are Still Getting Wrong
CASL healthcare email marketing compliance in Canada rests on express consent, a live unsubscribe and provable records. The CRTC and PIPEDA set the terms.
What to take away
- The CRTC enforces CASL, and the law covers every commercial electronic message a Canadian clinic sends, including a reminder that carries a promotional line.
- Consent on a clinic list normally has to be express, and PIPEDA governs the contact record underneath it.
- Each message needs the sender's name, a physical mailing address, and an unsubscribe that stays live for at least 60 days.
- Proof of consent is the defence. A clinic that cannot produce the record owns the penalty.
Clinic email templates arrive in Canada through U.S. vendors, franchise groups and copied marketing advice. The footer wording travels with the template. So does the assumption behind it, that an opt-out is enough. It is not.
Who holds jurisdiction over clinic email
The CRTC runs the enforcement side. CASL applies to commercial electronic messages sent from Canada or received in Canada, so a clinic in Winnipeg writing to a patient in another province is inside it. Those duties in everyday clinic messages are covered in the Healthcare Marketing Compliance Guide.
The Office of the Privacy Commissioner of Canada oversees PIPEDA, which governs how a clinic collects, uses and retains the email address before any message goes out. Consent under PIPEDA has to be meaningful and tied to a stated purpose, not buried in a general terms page. The OPC's PIPEDA overview describes the fair information principles behind that.
Provincial law applies to health information itself. Ontario's PHIPA, Alberta's Health Information Act and British Columbia's PIPA each bring a commissioner with its own complaint route. Where a province has substantially similar legislation, PIPEDA steps back for information held inside that province.
What a compliant disclosure contains
CASL requires three elements in every commercial message, and the full set of duties is summarised in this overview of Canada's Anti-Spam Legislation:
CASL Required Message Elements
- Name of sender and on whose behalf
- Current physical mailing address
- Working unsubscribe mechanism
- Unsubscribe available at least 60 days
- Honour requests within 10 business days
- No login, fee or extra steps
- Sender identificationthe name of the clinic sending the message, and the name of any party on whose behalf it is sent.
- Mailing addressa physical postal address that stays valid for at least 60 days after the send, plus a phone number, email address or web address.
- Unsubscribe mechanisma clear opt-out that stays live for at least 60 days and is set out plainly in the message.
Text messages carry the same consent and opt-out duty, and Consent and Opt-Out Rules covers that record. Unsubscribe requests must be honoured within 10 business days, and the mechanism cannot demand a login, a fee or more than one step.
Example of a footer that would pass
Lakeshore Family Practice, 88 Water Street, Sault Ste. Marie, Ontario. We hold your email address for appointment reminders and clinic news. You agreed to this on your intake form on 4 March. Unsubscribe in one click.
The clinic name and street address identify the sender, the postal address is the mailing address CASL requires, and the one-click unsubscribe gives the working opt-out the law demands.
Records to keep
The consent record is the first thing a CRTC investigator asks for. Keep it while the address stays on the list and for three years after the last send, because the CRTC can begin a proceeding within three years of the message.
Consent Records to Keep
- Date and method of consent
- Exact wording the patient agreed to
- Sourceintake form or booking page
- Date unsubscribe arrived and honoured
- Message content and send date
A documented trail is easier to defend than a reconstructed one, and Healthcare Email Marketing Programs shows how to keep it.
What happens if you do not
The CRTC can issue an administrative monetary penalty of up to 10 million dollars for a business and 1 million dollars for an individual. Officers and directors can be held liable personally, and the commission publishes the names of the organisations it penalises.
CASL Penalty Exposure
- $10 millionmaximum penalty for a business
- $1 millionmaximum penalty for an individual
- Personal liabilityofficers and directors
- Names publishedorganisations penalised by CRTC
The private right of action that would let individuals sue directly has been postponed and is not in force. That does not reduce exposure, because the CRTC and the OPC both act on patient complaints.
Under PIPEDA, a patient can complain to the OPC. The Office can investigate, publish findings and ask the Federal Court to order compliance. The OPC cannot fine a clinic on its own.
PIPEDA's offence provision sets a maximum fine of 100,000 dollars on indictment and 10,000 dollars on summary conviction.
Provincial commissioners act under their own statutes. Typical ceilings run from 100,000 dollars for an individual to 500,000 dollars for an organisation. The figure turns on the statute, whether the breach was knowing and how many patients were affected.
Where the rules differ by place
Main instrument
- Ontario
- PHIPA
- Alberta
- Health Information Act
- British Columbia
- PIPA
- Quebec
- Law 25
What it adds for clinic email
- Ontario
- Safeguards for health information and breach reports to the provincial commissioner
- Alberta
- A separate commissioner, complaint route and penalty schedule
- British Columbia
- Consent duties for personal information held by private organisations
- Quebec
- Stricter consent, privacy policy and breach reporting duties that are already in force, with administrative penalties the provincial commission can impose
U.S. rules work the other way round. CAN-SPAM permits commercial email without prior consent as long as the recipient can opt out, and HIPAA governs the handling of health information rather than marketing permission. A Canadian clinic that copies a U.S. footer inherits the wrong obligations, as the FTC's CAN-SPAM compliance guide makes clear.
List growth raises different questions, covered in Patient Acquisition.
