Last winter, I came across the following question (paraphrased):

"I provide a lead gen service and work with a doctor who has requested we include prospective patient's names in the email subject lines of our leads. As all of our forms go through a vault, we require our clients to log into the CRM to get the information. The doctor doesn't care and I told him he would need to sign something taking full responsibility."

I answered:

Wow, HIPAA violations galore on this. First of all, don't think about it as specifically as email subject lines, it's much more high level than that. To summarize the biggest points, YOU shouldn't be seeing their names at all (sort of hard to avoid when you're the one managing the emails), and marketing emails don't fall under any of the permitted uses of PHI (personal health information).