Rules
CASL Healthcare Email Marketing Compliance: What Canadian Clinics Are Still Getting Wrong
CASL healthcare email marketing compliance in Canada rests on express consent, a live unsubscribe and provable records. The CRTC and PIPEDA set the terms.
What to take away
- The CRTC enforces CASL, and the law covers every commercial electronic message a Canadian clinic sends, including a reminder that carries a promotional line.
- Consent on a clinic list normally has to be express, and PIPEDA governs the contact record underneath it.
- Each message needs the sender's name, a physical mailing address, and an unsubscribe that stays live for at least 60 days.
- Proof of consent is the defence. A clinic that cannot produce the record owns the penalty.
Clinic email templates arrive in Canada through U.S. vendors, franchise groups and copied marketing advice. The footer wording travels with the template. So does the assumption behind it, that an opt-out is enough. It is not.
Who holds jurisdiction over clinic email
The CRTC runs the enforcement side. CASL applies to commercial electronic messages sent from Canada or received in Canada, so a clinic in Winnipeg writing to a patient in another province is inside it. Where those duties land in everyday clinic messages is the subject of the Healthcare Marketing Compliance Guide.
The Office of the Privacy Commissioner of Canada oversees PIPEDA, which governs how a clinic collects, uses and retains the email address before any message goes out. Consent under PIPEDA has to be meaningful and tied to a stated purpose, not buried in a general terms page. The OPC's PIPEDA overview describes the fair information principles behind that.
Provincial law applies to health information itself. Ontario's PHIPA, Alberta's Health Information Act and British Columbia's PIPA each bring a commissioner with its own complaint route. Where a province has substantially similar legislation, PIPEDA steps back for information held inside that province.
What a compliant disclosure contains
CASL requires three elements in every commercial message, and the full set of duties is summarised in this overview of Canada's Anti-Spam Legislation:
- The name of the sender and, if different, the person on whose behalf it is sent.
- A physical mailing address that is current and reachable.
- A working unsubscribe mechanism, available for at least 60 days after the message is sent.
Text messages carry the same consent and opt-out duty, and Consent and Opt-Out Rules covers how that record should look. Unsubscribe requests must be honoured within 10 business days, and the mechanism cannot demand a login, a fee or more than one step.
Example of a footer that would pass
Lakeshore Family Practice, 88 Water Street, Sault Ste. Marie, Ontario. We hold your email address for appointment reminders and clinic news. You agreed to this on your intake form on 4 March. Unsubscribe in one click.
Records to keep
The consent record is the first thing a CRTC investigator asks for. Keep it while the address stays on the list and for a reasonable period after the last send.
- the date and method of consent, and the exact wording the patient agreed to
- the source, such as a paper intake form or an online booking page
- the date an unsubscribe request arrived and the date it was honoured
- the message content and the send date
A documented trail is easier to defend than a reconstructed one, and Healthcare Email Marketing Programs covers how to keep the file in order.
What happens if you do not
The CRTC can issue an administrative monetary penalty of up to 10 million dollars for a business and 1 million dollars for an individual. Officers and directors can be held liable personally, and the commission publishes the names of the organisations it penalises.
The private right of action that would let individuals sue directly has been postponed and is not in force. That does not reduce exposure, because the CRTC and the OPC both act on patient complaints.
Under PIPEDA, a patient can complain to the OPC. The Office can investigate, publish findings and ask the Federal Court to order compliance.
Where the rules differ by place
| Jurisdiction | Main instrument | What it adds for clinic email |
|---|---|---|
| Ontario | PHIPA | Safeguards for health information and breach reports to the provincial commissioner |
| Alberta | Health Information Act | A separate commissioner, complaint route and penalty schedule |
| British Columbia | PIPA | Consent duties for personal information held by private organisations |
| Quebec | Law 25 | Stricter consent and breach duties, phased in from 2023 |
U.S. rules work the other way round. CAN-SPAM permits commercial email without prior consent as long as the recipient can opt out, and HIPAA governs the handling of health information rather than marketing permission. A Canadian clinic that copies a U.S. footer inherits the wrong obligations, as the FTC's CAN-SPAM compliance guide makes clear.
List growth raises different questions, and Patient Acquisition looks at how far a documented list can be pushed.
Common questions
Does CASL apply to appointment reminders? A reminder that carries no promotion usually falls outside the commercial message definition. Add a line about a new service or a newsletter, and the message becomes commercial and needs consent.
Can we email patients who only left a phone number? No. An address collected for another purpose is not consent to email, and PIPEDA requires the purpose to be stated at the point of collection.
How long does implied consent last? Where it rests on an existing business relationship, the window runs two years from the last transaction or inquiry. Referral and conspicuous publication carry shorter limits.
Does one consent cover every message we send? Yes, as long as the messages fall inside the purpose described to the patient and consent has not been withdrawn.
