Navigating Email Ownership in Medical, Dental, and Allied Health M&A Transactions
In health care M&A transactions, whether involving dental practices, physician groups, med spas, behavioral health clinics, or other practices, one deceptively simple question often leads to complex legal analysis: Who owns the email accounts?
Email systems are central to modern health care operations. They contain clinical communications, administrative workflows, marketing data, and internal correspondence. When a practice is sold to a management company, private equity-backed platform, or health care consolidator, determining who controls these systems post-sale is critical for compliance, continuity, and risk mitigation.
Why Email Ownership Matters in Health Care Transactions
Email accounts are often tied to:
- Clinical communications (e.g., treatment plans, lab results, referrals)
- Administrative operations (e.g., scheduling, billing, HR)
- Marketing and patient engagement (e.g., newsletters, appointment reminders)
- Internal governance (e.g., board communications, vendor coordination)
Ownership and access to these systems can affect:
- HIPAA and state law compliance
- Custodianship of patient records
- Operational continuity post-sale
- Disputes over data control and privacy
Legal Framework: What Governs Email Ownership
Email ownership is shaped by a combination of transaction documents, federal privacy laws, and state-specific professional practice regulations.
- Asset Purchase Agreements (APA). APAs may include broad definitions of “Acquired Assets,” but rarely list email accounts explicitly. Clinical communications and patient records are typically excluded from the sale, either by law or contract. Meanwhile, marketing data (e.g., email contact lists) may be transferred, but operational email systems often remain with the practice or require specific carve-outs.
- Management Services Agreements (MSA). MSAs authorize the buyer (e.g., a management company or MSO) to provide IT infrastructure, including email platforms. However, access to email content is not automatic; it must be explicitly granted. Clinical autonomy is preserved under most state laws, meaning email systems used for patient care remain under the control of licensed providers.
- Shareholder, Operating, and Unitholder Agreements. These documents govern ownership and governance of the clinical entity and any rollover equity. They do not grant operational control over email systems unless specifically negotiated.
- HIPAA and State Law. Emails containing Protected Health Information (PHI) are considered part of the patient record. Under HIPAA, only covered entities and authorized business associates may access PHI. State laws (e.g., NC’s Dental and Medical Practice Acts) often prohibit non-licensed entities from controlling clinical communications or patient records.
How to Categorize Emails for Ownership and Access
To determine which emails can be transferred or accessed post-sale, categorize them by content:
| Category | Description | Transferable? |
| Clinical Emails | Treatment plans, diagnoses, patient communications | No |
| Administrative Emails | Scheduling, billing, HR, vendor coordination | Yes |
| Marketing Emails | Newsletters, contact lists, promotional content | Yes (with consent) |
| Mixed Content Emails | Contain both clinical and administrative info | Review required |
Best Practices for Buyers and Sellers
To avoid disputes and ensure compliance, health care practices and acquirers should:
- Define Email Ownership Explicitly. Include email systems in asset schedules or exclusions and clarify access rights in the MSA and employment agreements.
- Implement a Categorization Protocol. Train staff to distinguish between clinical and non-clinical emails. Also, use automated tools to flag PHI-containing messages.
- Secure Business Associate Agreements (BAAs). Ensure management entities have proper HIPAA-compliant agreements in place. Limit access to only what is necessary for administrative support.
- Plan for Custodianship Transitions. If ownership of the practice changes, ensure proper transfer of patient records and email systems under state law.
Common Pitfalls to Avoid
- Assuming IT access equals content access: Just because a buyer provides the email server doesn’t mean they can read the emails.
- Overlooking mixed-content emails: These require careful review and may need redaction.
- Failing to notify patients: If email systems are used for patient communication, any change in custodianship must be disclosed.
Bottom Line
Email ownership in health care practice sales sits at the intersection of legal compliance, operational control, and patient privacy. While transaction documents may define asset transfers broadly, federal and state laws impose strict boundaries around clinical communications and PHI. Buyers must balance their desire for operational integration with the legal realities of custodianship and access, while sellers must protect their professional obligations and ensure continuity of care. Categorizing email content, negotiating access rights, and implementing safeguards like BAAs are not just best practices—they’re essential steps in preserving trust, avoiding liability, and ensuring a smooth post-sale transition.
Email systems in health care practices are not just communication tools; they are regulated assets. Their ownership and access must be carefully negotiated, documented, and managed to comply with HIPAA, state law, and contractual obligations. Whatever type of health care practice you’re selling, don’t overlook the inbox. It may contain more than you think, and mishandling it could lead to regulatory risk, patient complaints, or litigation.
LEGAL DISCLAIMER
The information herein is not legal advice. The information is in the form of legal education and is intended to provide general information about the matter discussed. The above is not, nor is it intended to be, legal advice and does not create an attorney/client relationship. Consult your attorney with questions.
