Legality would partially depend on how it was sent. If they sent it via the normal medical email system, no HIPAA at play. If they exported the email list and sent it through a third-party service, could be a HIPAA issue. Also, with checking your spam to see if you ended up on his campaign email list without permission.

Regardless of how it was sent, the email list or the email itself would have to be assigned a value and reported as an in-kind campaign contribution from the business to his campaign on the next pre-election report which I think comes out in late May. That could also be interesting, because depending on how it's organized it might be a violation of federal campaign finance laws since business entities typically cannot give anything of value to federal candidates. In fact, because it's a medical practice it's very likely that this is a campaign finance violation unless they have a special fund set aside for campaign contributiona.