Is it legal to buy a doctor email list and email physicians?
Yes, in the US. CAN-SPAM has no rule against buying a list and no consent step. It sets seven requirements for every commercial email, and the FTC says it makes no exception for business-to-business email. HIPAA covers patient data, which a list of practice contacts does not hold. Penalties run up to $53,088 for each email.
We sell physician email lists, and we are not lawyers. This page summarizes two primary sources we read on Oct 7, 2026: the FTC's CAN-SPAM guide and the federal regulation that defines HIPAA's terms. It is not legal advice. For a specific campaign, ask counsel.
By Ryan Doyle, founder of Doctor Email List. Published Oct 19, 2026.
What CAN-SPAM requires on every email
The FTC's compliance guide for business lists seven main requirements. Prior consent is not one of them.
- Accurate header information. The From, To, Reply-To and routing details must be accurate and identify the person or business that sent the message.
- A subject line that matches the message. The subject line must accurately reflect the content.
- A clear notice that it is an ad. The law leaves room in how you say so, but you must disclose it clearly and conspicuously.
- Your location. The message must include your valid physical postal address: a street address, a registered post office box or a registered private mailbox.
- How to opt out. A clear explanation of how the recipient can stop future marketing email from you, with a return address or another easy online way to say so.
- Opt-outs honored promptly. You must honor an opt-out request within 10 business days. You cannot charge a fee or ask for more than an email address.
- Oversight of anyone who sends for you. Hiring another company to send does not move your legal responsibility to it.
The guide is plain about the audience: no exception for business-to-business email. A cold message that promotes a product to a physician is a commercial message, so all seven apply.
Who is responsible when a seller supplies the addresses
You are. The FTC says both the company whose product is promoted and the company that sends the message may be held responsible, and that you cannot contract away the duty by hiring someone else to send. A list seller is not the sender of your campaign, so the opt-out handling, the postal address and the honest subject line are yours.
One rule also binds the seller: once someone opts out, you can't sell or transfer their email addresses, even as a mailing list. Ours is handled by NPI on the opt-out page, and a physician who asks is removed from every future file within five business days.
What about HIPAA?
The regulation that defines HIPAA's terms (45 CFR 160.103, read Oct 7, 2026) says a covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction. Protected health information is individually identifiable health information, which the regulation defines as information that relates to an individual's physical or mental health, the care they receive, or payment for that care and identifies the individual.
A physician's practice address, phone number and mailbox describe a business, not a patient's health, care or bills. Sending a product email to a physician does not make you a covered entity, and our files hold no patient data. If you are a covered entity yourself, HIPAA governs your own patient records, which is a separate question from who you may email.
What to ask a list seller
- Which public registry do the rows come from? Ours start from the CMS file modified Aug 18, 2026 (data page).
- Does any row describe a patient or hold a home address or personal phone number? Ours: The files hold practice contact details from a public federal registry: no patient data, no home addresses and no personal phone numbers.
- How does a physician opt out, and how fast is it honored?
- What happens to the list if more than a small share of the emails bounce? Ours has a written refund rule (terms).
How many rows can you email at all?
A list is not a set of mailboxes. In our test of 400 cardiologists, 55 (14%) ended with an address that passed an SMTP check. For the rest the only routes are phone and post, which follow other rules than the ones above. The test and how to find an address are on their own page.
What this guide does not cover
Outside the US, such as Canada's CASL and the EU and UK rules; state laws beyond the federal baseline; phone calls and fax; and the rules for advertising a drug or a device. Each has its own requirements. Ask counsel before you send.
Sources
- FTC, CAN-SPAM Act: A Compliance Guide for Business: the seven requirements, the business-to-business statement, the opt-out deadline, responsibility and penalties. Read Oct 7, 2026.
- 45 CFR 160.103, Definitions (eCFR): the definitions of covered entity and individually identifiable health information. Read Oct 7, 2026.
- CMS Doctors and Clinicians national downloadable file: the public dataset our lists start from, modified Aug 18, 2026.
- Our email test: 400 cardiologists, run Sep 10, 2026, described on the finding guide.
Questions buyers ask
In the US, yes. CAN-SPAM's list of requirements has no consent step; it asks for seven things on every commercial message instead. The FTC adds that the law makes no exception for business-to-business email, so a message to a physician's practice is covered.
HIPAA's rules apply to covered entities, meaning health plans, clearinghouses and providers that bill electronically, and to their business associates, and they protect information about an individual's health, care or payment. A list of practice addresses and phone numbers holds none of that.
You need a clear explanation of how to opt out and an easy way to do it, and you must honor a request within 10 business days. A reply address counts as the easy way when you monitor it.
The FTC puts them at up to $53,088 for each separate email in violation (read Oct 7, 2026). The company whose product is promoted and the company that sends the message can both be held responsible.
The files hold practice contact details from a public federal registry: no patient data, no home addresses and no personal phone numbers. They start from the CMS Doctors and Clinicians file, a public federal dataset modified Aug 18, 2026. The data page lists the columns.