A seven-step operating system for classifying purpose, proving recipient state, controlling claims and capacity, and reconciling email through completed appointments.
A dermatology practice should not start email planning with a campaign calendar. Start with the message's purpose and the recipient's documented state. An appointment confirmation, clinician-owned recall, pathology communication, general skin-health article, cosmetic-service promotion, and review request do different jobs. Combining them under “patient email” creates avoidable privacy, clinical, and operational risk.
This guide builds a permissioned operating system across medical dermatology, procedures, pediatric care, and elective cosmetic services. It does not prescribe clinical follow-up or supply generic copy and cadence rules. Use our separate guides for local-business email strategy and email campaign craft.
Scope and safety: This is marketing education, not medical or legal advice. It does not diagnose, recommend treatment, determine candidacy, or replace a patient-specific clinical channel. Confirm every classification, claim, consent or authorization basis, vendor decision, and jurisdictional requirement with licensed clinical leadership and qualified US privacy, legal, and email specialists.
The output is seven controlled records:
- a communication-purpose classifier and recipient-state register;
- a dermatology service-line capacity card and campaign approval card;
- a data-flow and vendor gate;
- a stage-by-stage funnel dictionary;
- a cohort review sheet with keep, change, pause, or retire authority.
What a dermatology practice needs before drafting
Assign three reviewers before drafting: a qualified US healthcare-privacy or legal reviewer, a dermatology practice-operations or clinical specialist, and an email deliverability practitioner. Give them current source-system maps, approved service facts, communication policies, vendor contracts, and pause authority. Marketing coordinates the record; it does not make clinical or legal classifications.
| Reviewer | Owns | Must stop the draft when |
|---|---|---|
| Healthcare privacy/legal | Purpose, PHI use, authorization, vendor, retention, jurisdiction | Basis or required safeguard is unresolved |
| Dermatology clinical/operations | Clinical ownership, service truth, provider/room/equipment capacity, intake | Copy crosses into advice or operations cannot support it |
| Email deliverability | Sender/domain operations, suppression, bounce handling, documented metrics | Identity, list source, or failure path is unverified |
Collect official vendor documentation before naming a feature. This article stays platform-neutral because the approved source set contains no email or CRM vendor documentation. Search volume, CPC, keyword difficulty, list size, performance benchmarks, and portable patient values are also unavailable.
Classify the email's purpose before writing it
Classify every message before anyone writes a subject line. Separate requested operational communication, clinician-owned follow-up or recall, general education, elective-service promotion, review requests, and internal or vendor mail. Record the purpose owner, clinical and privacy classification, eligible audience, prohibited content, permission evidence, and the event that forces reclassification.
HHS explains that HIPAA controls uses and disclosures of protected health information for marketing and generally requires authorization, subject to defined exceptions. A qualified reviewer must apply that rule to the actual message. Do not call confirmations, care instructions, refill messages, pathology communication, referral updates, billing notices, or clinical recall “marketing” for workflow convenience.
| Purpose | PHI/data fields and audience | Authorization/preference basis; clinical owner; privacy/legal reviewer | Suppression and retention | Reclassification trigger |
|---|---|---|---|---|
| Operational/requested | Minimum approved fields; person requesting the action | Privacy classification; operations owner | Applicable preferences; approved record policy | Promotion is added |
| Clinician follow-up/recall | Only clinical-channel data; intended patient/guardian | Clinical owner plus privacy review | Clinical preference and retention rules | Trigger, advice, or channel changes |
| General education | Permissioned audience; no inferred condition | Documented basis; clinical and legal review | Marketing suppression plus record policy | Content becomes individualized |
| Elective marketing | Approved promotional state; no inferred candidacy | Authorization/preference evidence; legal owner | Commercial opt-out and suppression | Claim, service, or audience changes |
| Review request | Genuine customer under approved privacy rule | Practice owner; privacy/legal review | Request suppression and response policy | Incentive or visit detail appears |
| Internal/vendor | Workforce or vendor minimum data | Contract/security owner | Access and retention policy | Consumer or patient use begins |
For review requests, Google permits asking genuine customers but prohibits incentives and warns businesses to protect private information in public replies. Keep eligibility and response rules in the separate review-management workflow.
Build recipient states from evidence, not one master list
Build recipient states from verified records instead of exporting one master list. Separate prospective from existing patients, adults from minors and guardians, and medical from cosmetic audiences. Record location, provider, service category, referral or payment path, appointment state, communication preference, authorization evidence, suppression flags, source system, owner, and verification date.
A row in a scheduling export proves only that the row exists. It does not prove promotional permission, clinical candidacy, interest in a cosmetic service, or a completed appointment. Dermatology creates sharp crossover risks: a guardian's address may relate to pediatric care; a referral record may carry payer context; a website subscriber may never have been a patient.
| Register field | Required states | Evidence and control |
|---|---|---|
| Relationship/age | Prospective, existing; adult, minor, guardian | Source system, owner, relationship date |
| Practice route | Location, provider, service category | Verified practice record; no diagnosis inference |
| Access route | Referral, payer, self-pay | Approved routing state; keep paths separate |
| Appointment | Requested, scheduled, rescheduled, canceled, no-show, completed | Scheduling source and event timestamp |
| Permission | Preference, consent/authorization evidence, purpose scope | Captured language/version and expiry |
| Exclusions | Suppressed, complained, undeliverable | Authoritative flag and return path |
| Governance | Source, owner, last verified, expiry | Hold when stale or conflicting |
Where teams get burned is a “clean” merged export that drops the guardian relationship, purpose scope, or original suppression. Preserve source lineage. If two systems disagree, exclude the record until the accountable owner resolves it.
Set service-line, capacity, and claim boundaries
Set one capacity and claim boundary for each dermatology lane before promotion. General medical, procedure or surgery, pediatric, and elective cosmetic services need separate educational scope, clinician and location truth, referral or authorization rules, provider-room-equipment capacity, scheduling lag, substantiation, expiry, exclusions, and a pause rule. Never add treatment, result, pricing, or urgency advice.
The service-line card prevents a technically approved send from advertising work the practice cannot currently support. A Mohs referral path, a pediatric appointment, a general medical visit, and an elective laser enquiry may use different clinicians, rooms, equipment, payer steps, consent flows, and scheduling horizons.
| Capacity-card field | Practice-owned record |
|---|---|
| Category/profile | Medical, procedure/surgery, pediatric, or cosmetic; planned/time-sensitive profile |
| Economics | Own-source value field if approved, otherwise unavailable; payer/self-pay route; cancellations/no-shows |
| Capacity | Provider, room, equipment, scheduling lag, referral/authorization |
| Market evidence | Seasonality evidence or unavailable; local density observation or unavailable |
| Claim boundary | Approved scope, source/substantiation, expiry, exclusions, pause rule |
| Jurisdiction review | License, facility, device, advertising, consent, privacy, email, retention, referral/payer, permit; bonding status reviewed, not assumed |
Use the FSMB state medical-board directory to locate current jurisdictional sources before stating an advertising, licensure, or professional-conduct rule. The FTC's health-claims guidance sets a federal truthfulness and substantiation floor; it is not clinical or legal approval.
Create a content and review record for every send
Create one content-and-review record for every proposed send. Capture sender identity, purpose, audience, subject, body, destination, service-location-provider facts, health claims, personalization, accessibility, opt-out path, approvers, vendor documentation, approval expiry, and rollback owner. That record enables exact review without pretending that a reusable template is legally, clinically, or universally compliant.
| Approval-card block | Required fields |
|---|---|
| Message | Purpose, audience state, sender, subject, body, destination |
| Truth | Service, location, provider, claims, source/substantiation, approval expiry |
| Rights/data | Patient/media/testimonial flag, consent evidence, personalization fields |
| Release | Accessibility check, opt-out, legal/privacy/clinical reviewers, approval date |
| Control | Vendor-documentation URLs, stop rule, rollback owner |
Before-and-after images, reviews, and testimonials require documented patient permission and specialist review. Do not present health outcomes as typical or let a marketer improvise a result claim. If a destination page changes after approval, expire the record and review the message again.
theStacc's Compliance Profiles inject configured license-number, responsible-firm, and not-advice disclosures at planning time. They steer drafts away from prohibited claims and gate each draft through a human verdict of None, Hold, or Block that automated and agent-key callers cannot override. The licensed professional remains responsible.
The Content SEO module supports keyword and SERP research, drafting, queueing, and CMS publishing. It does not send email, manage permissions or suppressions, make clinical or privacy decisions, connect to a practice-management system, or attribute appointments.
Preflight data flow, delivery, destination, and suppression
Preflight the complete data path before release. Verify the source list, permission and preference evidence, minimum fields, vendor access, any BAA decision, exclusions, duplicate logic, sender and domain records, working destination, staffed response route, service capacity, opt-out processing, failure handling, and send cap. Never adopt a universal cadence or follow-up count.
| Data-flow gate | Record before release |
|---|---|
| Collection/source | Source system, consent or authorization, preference, approved exported fields |
| Transfer/vendor | Transfer method, vendor/subprocessor, access, BAA/privacy decision, official documentation URLs |
| Storage/use | Retention, personalization fields, event tracking, minimum-data rule |
| Return path | Suppression write-back, complaints, undeliverables, duplicate handling |
| Failure/end | Incident owner, deletion path, rollback, capacity stop, send cap |
HHS permits provider email with reasonable safeguards and identifies address accuracy, information minimization, Security Rule, and confidential-communication considerations. Apply those points through qualified review. A marketing platform is not automatically the right channel for clinician-owned follow-up.
For commercial email, the FTC's CAN-SPAM guide requires accurate sender information, non-deceptive subjects, applicable identification and postal-address disclosures, a functioning opt-out, and vendor oversight. Run a real suppression test and a destination test. Teams often test the design yet miss that the cosmetic consultation form is unstaffed or the linked location has paused the service.
Map approved public content around the practice's review gates. We can separate research, drafting, compliance review, and publishing from the email and clinical systems that retain their own owners.
Track each email and appointment event separately
Track email queued, sent, delivered, bounced, open only if officially defined and privacy-approved, email click, website call click, form, qualified enquiry, booked appointment, and completed appointment or procedure as separate events. Keep impression and site click stages separate where relevant; an open is not an impression, a click is not a form, and none is a patient.
GA4 publishes separate recommended lead events, but the practice still defines and validates its own event mapping. Use the dictionary below before release; preserve privacy basis, deduplication, reconciliation rules, and exclusions for every row.
| Stage | Definition/timestamp | Source system/owner | Privacy, deduplication, reconciliation, exclusions |
|---|---|---|---|
| Email queued | Eligible unique message enters approved queue; queue time | Email system / email owner | Approved cohort; campaign+recipient key; reconcile to sent; exclude tests/duplicates |
| Email sent | Vendor records send attempt; send time | Email system / email owner | Approved basis; unique attempt rule; reconcile delivery/bounce; exclude suppressed-before-send |
| Delivered | Vendor's current documented delivery event; event time | Email report / email owner | Approved definition; unique message; reconcile sent; exclude bounces |
| Bounced | Vendor records failed delivery; event time | Email report / deliverability owner | Minimum data; unique message; return to suppression; separate failure classes |
| Open | Privacy-approved vendor signal only; signal time | Email report / privacy-approved analyst | Official definition; unique rule; never reconcile as impression; exclude known artifacts where documented |
| Email click | Valid tracked email-link click; click time | Email report / email owner | Approved tracking; unique recipient; reconcile landing session; exclude tests/bots/scanners where identifiable |
| Impression | Business-defined public-content display; display time | Approved media log / media owner | Separate basis and ID; never substitute open; exclude invalid traffic |
| Site click | Valid site interaction outside call/form; event time | Analytics log / analytics owner | Approved event; session rule; reconcile destination; exclude bots/tests |
| Call click | Valid website telephone-link click; event time | Analytics log / analytics owner | Approved event; written repeat-click rule; not a connected call; exclude staff/bots/tests |
| Form | Valid attributable form submission; submit time | Form log / intake owner | Approved fields; unique form rule; reconcile intake; exclude spam/incomplete/tests |
| Qualified enquiry | Connected call or form meets written rules; qualification time | Intake/CRM log / intake owner | Minimum data; unique request; reconcile scheduling; exclude clinical/billing, spam, unsupported service |
| Booked appointment | Qualified request has confirmed appointment; booking time | Scheduling system / scheduling owner | Approved linkage; reschedule once; reconcile completion; exclude tests/duplicates |
| Completed appointment/procedure | Booked event marked completed under written rule; completion time | Practice-management/EHR export / operations owner | Privacy-approved linkage; unique event; reconcile cohort; exclude canceled/no-show/non-completed |
Use formulas only inside one declared cohort; every field below is mandatory. Vendor metrics retain the vendor's current definition and source.
| Formula | Numerator | Denominator | Evidence window | Source system | Owner | Exclusions |
|---|---|---|---|---|---|---|
| Delivery rate | Unique messages recorded delivered under the vendor's current documented definition | Unique messages accepted for sending in the same approved campaign cohort | One declared campaign send window | Email service provider report with current metric-definition URL | Email operations owner | Suppressed-before-send, internal tests, duplicates, invalid recipients; bounces reported separately |
| Email click rate | Unique recipients with a valid tracked email-link click under the privacy-approved method | Unique delivered messages in the same campaign cohort | Declared send cohort plus stated click-observation window | Email service provider report with current metric-definition URL | Email owner with privacy sign-off | Bots/security scanners where identifiable under documented rules, tests, duplicates; opens and website call clicks reported separately |
| Call-click rate after email | Unique valid website call-link clicks attributable to the email cohort | Unique attributable landing-page sessions from the email cohort | Declared campaign cohort plus stated observation window | Privacy-reviewed analytics event log | Analytics owner with privacy sign-off | Tests, staff, bots, repeat clicks under written deduplication; never label as connected calls |
| Form submission rate after email | Unique valid forms attributable to the email cohort | Unique attributable landing-page sessions from the email cohort | Declared campaign cohort plus stated observation window | Privacy-reviewed form log plus source identifier | Intake owner | Spam, duplicates, tests, applicants/vendors/students, incomplete forms; report calls separately |
| Qualified-enquiry rate | Unique attributable connected calls or valid forms meeting written service/location/provider/capacity rules | All unique attributable connected calls and valid forms in the cohort, with path subtotals | Campaign cohort plus declared qualification lag | Phone/intake and form/practice-management or CRM logs | Intake owner | Existing-patient clinical/billing messages, spam, duplicates, applicants/vendors/students, unsupported service/location, no capacity |
| Booked-appointment rate | Unique qualified enquiries with a confirmed appointment | All unique qualified enquiries from the same cohort | Campaign cohort plus stated scheduling lag | Scheduling/practice-management system | Scheduling owner | Reschedules counted once; cancellations/no-shows remain booked but not completed; tests and duplicates |
| Completed-appointment rate | Unique booked appointments marked completed under the written rule | All unique booked appointments from the same email-attributable cohort | Campaign cohort plus declared completion lag | Privacy-reviewed practice-management/EHR status export | Operations owner with privacy sign-off | Canceled, no-show, rescheduled outside window, test, duplicate, and non-completed records |
Review a declared cohort after the booking/completion lag
Review one declared cohort only after its stated booking and completion lag. Reconcile delivery, suppressions, clicks, calls, forms, qualification, bookings, cancellations, no-shows, completion, complaints, capacity, and privacy or clinical incidents. Keep, revise, pause, or retire the email from the practice's evidence, never from a vendor benchmark or a claim that follow-ups close.
| Cohort review block | Required fields |
|---|---|
| Identity/window | Campaign, purpose, start/end dates, recipient-state rule, send cap |
| Evidence | Separate stage counts, each denominator, appointment and completion lag |
| Operations | Service capacity, cancellations/no-shows, exclusions |
| Safety | Complaints, opt-outs, privacy incidents, clinical incidents |
| Decision | Owner, decision date, keep/change/pause/retire outcome and rationale |
Keep only when the audience evidence, claims, suppression path, destinations, capacity, and stage data remain trustworthy. Change one documented fault and seek fresh approval. Pause for an unresolved control or capacity problem. Retire a purpose that no longer has a defensible basis. If appointment linkage cannot be performed safely, the downstream result is unavailable.
The operational reality is that cosmetic enquiries, medical-record questions, referral calls, applicants, and vendor messages can all reach the same front desk. Intake must classify them before the cohort report labels anything qualified.
Turn the seven records into a reviewable content operation. Keep email delivery, permissions, scheduling, clinical judgment, and appointment evidence with their accountable practice owners.
Frequently asked questions about dermatology email marketing
These answers resolve edge cases that appear after the seven records exist: classification of mixed messages, service promotion, medical-versus-cosmetic states, automation, engagement signals, suppression portability, and cadence. Each answer is conditional because the practice's data, jurisdiction, contracts, communication policies, and clinical ownership determine the valid operating choice.
What is dermatology email marketing?
Dermatology email marketing is a governed use of email for an approved practice purpose and recipient state. It may cover permissioned general education or elective-service promotion, but the label does not absorb appointment notices, clinician-owned follow-up, or other operational communication. Qualified reviewers classify each message before marketing handles it.
Is every email from a dermatology practice a marketing email?
No. The message's primary purpose, content, data, and recipient relationship determine its classification. An appointment confirmation, pathology communication, refill message, billing notice, or clinician-directed recall should not become marketing because it uses email. Route each proposed communication to the practice's clinical, privacy, and legal reviewers before assigning a system or owner.
Can a dermatology practice email patients about services?
A practice may email about services only after qualified reviewers approve the purpose, recipient basis, claims, data use, sending path, and opt-out controls. HHS says HIPAA marketing generally requires authorization, subject to defined exceptions. The FTC also requires health-related advertising claims to be truthful, non-misleading, and appropriately substantiated.
How should medical and cosmetic dermatology email audiences differ?
Medical and cosmetic audiences should differ by proven recipient state, approved purpose, service category, and intake route. Do not infer a diagnosis from a medical visit or cosmetic interest from browsing. Keep referral and payer pathways separate from self-pay pathways, and check the relevant provider, room, equipment, and scheduling capacity before release.
Can a practice automate patient follow-up emails?
A practice may automate only a communication that its clinical, privacy, security, and legal reviewers have approved for that trigger, data set, channel, and stop rule. Marketing automation must not make treatment decisions or write individualized advice. Reclassify the workflow whenever its content, audience, trigger, vendor, or data fields change.
Does an email open or click count as a patient enquiry?
No. An open is a vendor-recorded signal under its documented definition, and an email click is a separate event. Neither establishes a connected call, valid form, qualified request, booked appointment, completed appointment, or patient. Report each stage from its own source system, or mark the downstream count unavailable when safe linkage is absent.
How should a dermatology practice handle unsubscribes and suppressions?
Apply suppressions before each send and return new opt-outs, complaints, and undeliverable flags to the authoritative record through a tested path. Preserve enough evidence to explain the action without exposing unnecessary health data. A vendor change or list re-import must not resurrect a person whom the practice has already suppressed for that purpose.
How often should a dermatology practice send marketing email?
There is no universal dermatology marketing-email cadence. Declare a send cap for one approved cohort, then review complaints, opt-outs, wrong-audience incidents, current service capacity, scheduling lag, and the practice's own evidence. Keep, reduce, pause, or retire the frequency rule; do not import a vendor benchmark or fixed follow-up sequence.
Build one governed cohort before expanding email
Start with one purpose, one evidenced recipient state, one dermatology service lane, one approved claim set, and one declared evidence window. Complete all seven records, run the send through its reviewers, and wait through the stated appointment-completion lag. Expand only after the practice can reconstruct who received what, why, and what happened next.
For broader acquisition context, use the healthcare SEO guide and theStacc for healthcare. The Local SEO module covers GBP posts, approval-based review replies, citations, and local rank tracking. It does not send email, decide review-request eligibility, manage PHI or suppression, connect to practice management, or attribute appointments.
Compliance Profiles support regulated public-content planning with configured disclosures, prohibited-claim steering, and a human review verdict. They assist review; they do not certify compliance or replace the licensed dermatologist, clinical operations lead, privacy officer, counsel, deliverability specialist, or email operator.
Build the public-content layer around qualified human review. We will show where theStacc fits and document the boundaries that must stay with your practice and email systems.
Sources & references
Blog SEO, Local SEO, and Social Media — one dashboard, no headaches.
Weekly local SEO teardowns
One practical email a week. Map Pack, GBP, AI Overviews — no fluff. Unsubscribe anytime.