Protecting an email address when booking medical care means entering a separate alias for each provider on the booking form, while the patient portal keeps a permanent address for the medical record. The address entered on a booking form passes to a scheduling system as well as to the clinic, and that system may disclose booking data to further parties under its own policy. A distinct alias for each provider keeps confirmations, reminders and follow-up mail in a separate stream, and that stream can be closed without changing the main inbox address. The alias covers booking and reminder mail only and never serves as the medical record identity. Rules and booking tools differ by country, and the documented example in this article comes from the United States.
Disclosure from booking forms
An online medical booking passes through the clinic and the scheduling system that operates the form. Zocdoc, a large online scheduling service, describes the booking as a transfer of information to the doctor for scheduling the visit, including the name, insurance details, date of birth, visit reason and chosen appointment time. Intake forms completed before an appointment are relayed to the doctor on the patient's behalf, according to the same description in Zocdoc's account of its data handling. The email address moves as part of that record.
The categories receiving the address are set out in policy tables. Personal identifiers, including first and last name and email address, are listed with disclosures to service providers, healthcare providers and parties authorised by the patient. Booking appointment data, defined as the appointment date and time, provider information, visit reason and whether the patient is new to a provider, is listed with disclosures to service providers, analytics partners and healthcare providers. Those tables appear in the Zocdoc privacy policy, effective 4 March 2026. Other booking tools publish their own policies, and the disclosure categories in those policies differ, but the pattern repeats: an address entered once is held by more than one organisation.
A separate policy covers consumer health data. Zocdoc's consumer health data policy, also updated 4 March 2026, names service providers for web hosting, data storage, technology and communications, analytics and insurance verification, together with healthcare providers, insurance clearinghouses, business partners, payment processors, parties to a corporate transaction and government agencies, as categories that may receive consumer health data. The policy states that service providers may use the data only in connection with performing services for Zocdoc and are not authorised to use it for their own benefit. The full list appears in the Zocdoc consumer health data privacy policy. Marketing mail arriving later on the same address is harder to attribute, because the address has passed through several hands by that point. A distinct alias for each provider gives each mail stream its own address, so later mail can in principle be traced to the booking that produced it.
Healthcare breach exposure
Healthcare systems hold booking addresses alongside clinical and administrative records, and those systems are a frequent breach target. A compilation of data from the HHS Office for Civil Rights (OCR), updated 15 October 2026 from OCR data obtained 10 October 2026, records the 2024 Change Healthcare ransomware attack as affecting an estimated 192.7 million individuals, the largest healthcare breach on record. The same compilation records 772 large breaches, each affecting 500 or more individuals, reported in 2025. The figures appear in the HIPAA Journal healthcare data breach statistics. The federal record behind those figures is the HHS OCR breach portal, which publishes breaches affecting 500 or more individuals.
A booking alias does not prevent a breach of a booking system. The protection is narrower: when a booking system is breached, the address in its records is the alias, rather than the address used for banking, work or personal mail. When an alias appears in breach data, a check on Have I Been Pwned identifies which address was exposed, and the alias can then be closed. The same containment logic applies in other booking contexts, such as protecting an email address when buying event tickets, where the seller is not the only party holding the address.
Email addresses as health identifiers
An email address alone is ordinary contact detail. Linked to a clinic name, a visit reason and an appointment time, the address becomes an identifier tied to health care. Guidance from the US Department of Health and Human Services (HHS) on de-identification lists email addresses among the 18 identifiers that must be removed for health information to qualify as de-identified under the Safe Harbor method. That guidance is published in the HHS guidance on de-identification methods. The practical consequence is direct: a booking confirmation in an inbox names a provider and a visit reason, and a leaked address linked to a clinic shows that the owner sought care there.
The rules for email between providers and patients come from the HIPAA Privacy Rule. Covered providers may communicate by email with patients, provided reasonable safeguards are applied, such as checking the address for accuracy before sending and limiting the amount or type of information in unencrypted email. A patient may request communication by alternative means or at alternative locations, and HHS gives appointment reminders by email rather than postcard as an example a provider should accommodate if reasonable. That guidance appears in the HHS FAQ on email and HIPAA. The rule binds the provider. It does not bind every scheduling tool, marketing partner or analytics provider that touches a booking, which is why the address given at booking warrants separate handling.
Agent booking routes
Booking routes continued to expand in October 2026, when Zocdoc opened its booking platform to registered AI agents, with Google Gemini, Amazon Health AI and Instinct already connected. The company reported that AI agent traffic on its platform had grown nearly 30-fold since July 2026, and that agents must obtain patient consent before booking or cancelling, according to the report in Healthcare Dive's account of the Zocdoc agent opening. Each additional booking route is another place where the address given at booking is stored. The alias method is unchanged by the route: the address handed to the booking system, whether entered on a form or passed by an agent, is the alias for that provider.
One alias per provider
The method rests on separation before the booking is made. Each provider or booking tool receives a distinct alias, created in advance and labelled with the provider name, following the AliasFleet guide to creating aliases and the first-alias walkthrough. Mail arriving on that alias belongs to that provider's stream. When reminders stop and marketing mail starts on the same alias, the source is visible in the address itself. When a provider changes, the old alias can be closed without touching mail from any other provider. When an alias appears in a breach, only that stream is affected.
The principle matches the practice of using a different email address for every website, applied here to a narrower case. The same advance preparation applies to protecting an email address when getting insurance quotes, where the form is a lead as well as a request.
Permanent address on the patient portal
The patient portal and the medical record are distinct from booking mail. The portal holds the medical record, test results, prescriptions and messages with clinicians, and it needs a stable address that the clinic can rely on for account recovery, identity checks and clinical communication. An alias given at booking must never replace that address, and it must never be presented as the medical record identity. The same pattern holds for other sensitive accounts: a bank account keeps a permanent real address used only for financial accounts, and a government account keeps its own registered address. Aliases cover everything else, which keeps the sensitive address isolated.
The two addresses serve different purposes. The permanent address stays on the portal and on the medical record, and the alias goes on the booking form and receives confirmations, reminders, rescheduling notices and follow-up mail for that provider. The alias contains booking mail, not the medical record.
The patient portal keeps the permanent address for the medical record. The alias covers booking and reminder mail only.
Alias constraints for booking mail
An alias does not make a booking anonymous. The provider and the scheduling tool still know who booked, when, and for what reason. An alias does not stop the scheduling tool from disclosing booking data to its service providers, analytics partners or clearinghouses under its policy, encrypt reminder mail, or remove the address from a system that has already stored it. Acceptance is not guaranteed: some clinics or portals may reject an alias address, and no verified count of clinic alias acceptance was found for this article.
An alias also does not replace checking what was already exposed. When an address has been used for medical bookings for years, closing it now does not recall past mail. A check of whether the address appears in known breaches, described in how to check if your email was leaked, establishes what already happened, and the alias system then limits what happens next.
AliasFleet and booking mail
AliasFleet provides email aliases that forward to a verified destination inbox. A user creates a distinct alias for each provider, labels it with the provider name, and gives that alias on the booking form. Booking confirmations, reminders and follow-up mail for that provider arrive through the alias. The alias can be paused or closed when the provider changes or when its mail stream is no longer wanted, without changing the destination inbox address.
AliasFleet does not hold the medical record, and it does not replace the patient portal. The permanent address on the portal stays in place, and the alias covers booking and reminder mail only. The mechanism is described in how email aliases actually work: the alias is a forwarding address under the user's control, not a separate inbox, and replies route back through the alias so the destination address stays out of the booking system.
Top comments (0)