October 2026Dataset Refreshed: Expanded to 15.17M+ Unique Contacts
[email protected]+1 727-617-0017

What is the CAN-SPAM Act?

Also called: CAN-SPAM, CAN-SPAM Compliance in Healthcare

The CAN-SPAM Act is the U.S. law that sets the rules for commercial email, including business-to-business email. It doesn't require prior consent, but it does require honest sender information and subject lines, a physical postal address, a working opt-out, and handling opt-outs within 10 business days.

By John Britton, VP of Marketing, MedicalProspects · Updated November 4, 2026 · Compliance

Why it matters for healthcare sales and marketing

Any team that emails healthcare professionals in the U.S. for marketing purposes is sending commercial email, and CAN-SPAM applies. There's no exception for B2B messages. Getting it wrong can mean penalties for each email that breaks the rules, and it also hurts deliverability and brand trust.

CAN-SPAM is not a consent law: you can email business contacts who haven't opted in, as long as you follow the rules below. Laws in other countries, such as Canada's CASL and the UK and EU rules, are stricter.

How it works

The FTC summarizes CAN-SPAM's main requirements as:

  1. Don't use false or misleading header information. The From, To, Reply-To and routing information must be accurate.
  2. Don't use deceptive subject lines. The subject must reflect the content.
  3. Identify the message as an ad. Clearly disclose that it is promotional.
  4. Tell recipients where you're located. Include a valid physical postal address.
  5. Tell recipients how to opt out. Give a clear, easy way to stop future emails. It must work for at least 30 days after you send.
  6. Honor opt-outs promptly. Process them within 10 business days, without charging a fee or asking for more than an email address and preferences. Don't sell or transfer opted-out addresses.
  7. Monitor what others do for you. Both the company whose product is promoted and the company that sends the email can be held responsible.

Transactional or relationship messages, such as order confirmations, are mostly exempt from these rules but can't be misleading.

An example B2B email annotated with CAN-SPAM requirements: accurate From and routing information, a subject line that isn't misleading, identification as an ad, a valid physical postal address, a clear opt-out, opt-outs honored within 10 business days, and responsibility for vendors who send on your behalf.
The CAN-SPAM rules mapped onto one example email. General information, not legal advice.

Example

Illustrative scenario. A MedTech company emailing orthopedic surgeons about a new implant sends from a real employee's address on its own domain, uses a subject line that describes the offer, labels the message as promotional in the footer, includes its office address, and provides a one-click unsubscribe link. Opt-outs flow into a master suppression list that every campaign, and every agency sending on its behalf, checks before sending.

Common mistakes

  • "B2B email is exempt." It isn't. CAN-SPAM covers commercial email to businesses too.
  • "The list vendor is responsible." The sender and the company being promoted are responsible for how the email is sent.
  • Unsubscribe links that expire. Opt-out must work for at least 30 days after the send.
  • Separate suppression lists. An opt-out has to apply across all your campaigns and senders, not just one list.
  • Using U.S. rules everywhere. Contacts in Canada, the UK and the EU fall under stricter laws.

How MedicalProspects does it

MedicalProspects supplies business contact data only, for use in CAN-SPAM compliant outreach, and honors removal requests from the people in its database. See the compliance page for our guidelines for customers.

Related terms

  • HIPAA and B2B Healthcare OutreachHIPAA protects patients' health information held by health plans, healthcare clearinghouses, most healthcare providers and their business associates. A clinician's professional contact details are not patient health information, so B2B email to healthcare professionals is governed by marketing laws such as CAN-SPAM rather than by HIPAA.
  • Opt-In Permission Marketing (B2B)Permission marketing ensures B2B communications honor recipient preferences and provide clean, instant opt-out mechanisms.
  • Professional Work Email vs. Personal EmailProfessional work emails ([email protected]) reach physicians in their official capacity, while personal emails (gmail/yahoo) risk high spam complaints.
  • HCP List (Healthcare Professional List)An HCP list is a database of individual healthcare professionals, such as physicians, nurse practitioners, pharmacists and nurses, with identifiers, specialties and contact details used for sales and marketing. Its counterpart, an HCO list, covers healthcare organizations.

Put it to work

Sources

  1. CAN-SPAM Act: A Compliance Guide for Business, Federal Trade Commission
  2. 16 CFR Part 316: CAN-SPAM Rule, eCFR

← Back to the healthcare GTM glossary