Universal Mailworks

Healthcare Mailers: The HIPAA Checklist to Run Before You Send

Quick answer

Eleven HIPAA checkpoints every healthcare practice should clear before sending patient mail — BAA, list handling, envelope design, audit trails.

Eleven concrete checkpoints to clear before a healthcare practice sends patient mail — from BAA paperwork to envelope design to data-destruction logs.

## Why a HIPAA checklist matters more than ever HHS Office for Civil Rights enforcement actions related to direct mail have tripled since 2023. The fact patterns are usually the same: a practice handed a patient list to a mail vendor that didn't have a BAA on file, a window envelope exposed treatment information, or a returned-mail pile sat in an unsecured back office for weeks. None of these are exotic — they're checklist failures. Run through every item below before any healthcare mail goes out. We use this internally on every healthcare client and it has saved more than one practice from a six-figure penalty. ## 1. Signed BAA on file with your mail vendor A Business Associate Agreement is non-negotiable when patient PHI (name + address + treatment relationship is enough) leaves your office. If your mail vendor can't produce one within 24 hours, do not send the file. We sign BAAs as a matter of course — request ours [here](/contact). ## 2. The list itself qualifies as PHI Any list of "patients of [practice name]" is PHI, even if it contains only names and addresses. Treat the CSV in your downloads folder with the same care as a chart. Encrypt at rest, transmit via SFTP or secure portal, and don't email it as an attachment. ## 3. Envelope design hides treatment information The single most common HIPAA violation in direct mail: a window envelope that reveals "Annual mammogram reminder" or "Diabetes management program" through the glassine window. Solution: keep the windowed portion to name + address only. Treatment context lives inside. ## 4. No PHI in the outer envelope copy Don't print "From [Oncology Group]" or "Important results enclosed" on the outside. The fact that someone receives mail from your specialty practice is itself PHI. Generic practice name only. ## 5. Address verification with NCOA + apartment append Wrong-address mail isn't just wasted postage — it's a HIPAA breach. NCOA processing catches movers; apartment/unit append catches missing apt numbers that send mail to the wrong tenant. Run both within 95 days of the drop. ## 6. Reseller of list = chain of BAAs If you bought your patient acquisition list from a vendor, that vendor needs a BAA with you, you need a BAA with the mail house, and the mail house needs a BAA with any subcontractor (USPS doesn't count — they're a conduit, not a BA). One missing link breaks the chain. ## 7. Return mail handling protocol Returned mail is PHI. Define in writing where it goes (locked bin), who opens it (designated staff), how it's logged, how it's shredded, and how often. We log every returned healthcare piece by date, return reason, and shred date — and we can produce that log on demand. ## 8. Encrypted at rest, encrypted in transit The CSV on your laptop, the file on the vendor's server, the proof PDF in email — all need encryption. Email is not a HIPAA-acceptable transport for PHI. Use SFTP, encrypted portals, or password-protected zips with the password sent separately. ## 9. Audit log of who touched the data You should be able to answer "who at your office and our vendor accessed this list, on what date, for what purpose?" If you can't, you can't pass an audit. We log every file access, edit, and download by user and timestamp. ## 10. Minimum necessary information HIPAA's "minimum necessary" standard means the mail vendor should only receive the data they need to drop the piece — name, mailing address, and the variable fields used in personalization. Don't send Date of Birth, SSN, MRN, or diagnosis codes unless your piece literally personalizes against them. Strip extra columns before transmission. ## 11. Patient opt-out honored across systems If a patient has opted out of marketing communications in your EHR, that opt-out must propagate to every mailing list every time. The most common failure: pulling an export from EHR but not refreshing the opt-out suppression on subsequent drops. Build the suppression into the export query, not as a post-processing step. ## What we do on every healthcare campaign - Signed BAA before any file transfer - SFTP-only data exchange, AES-256 at rest - NCOA-95 processing + apartment append on every list - Generic-only outer envelope copy review - Returned-mail logging with quarterly destruction certificates - Per-user access logs available on request - Suppression rules baked into the data ingest, not the output If you handle healthcare mail and your current vendor can't tick every box above, that's the conversation to have this quarter — not after an incident. See [our HIPAA-compliant mail service page](/services/hipaa-compliant-mail) or [request a vendor review](/contact).

For a free quote, call (562) 261-9100 or contact us online.

Why Universal Mailworks

Service Areas

We serve businesses across Southern California, including Los Angeles County, Orange County, Riverside County, San Bernardino County, San Diego County, Ventura County, Imperial County, Kern County, and Monterey County.

Contact

Universal Mailworks
6910 Aragon Circle, Suite B
Buena Park, CA 90620
Phone: (562) 261-9100