HIPAA Blog

Nugget 13: Marketing (this ought to be linked with nugget 7 on Fundraising): A big component of the Omnibus Rule wrestles with the fact that most marketing activities require an express authorization from the patient.  Specifically, the Privacy Rule now explicitly states that an authorization is needed for three things: the release of psychotherapy notes, marketing, or sales of PHI.  The former definition of marketing included where a covered entity received compensation from a third party for giving the third party PHI so the third party could market its goods and services to the individuals whose PHI was provided; that's no longer there, since that would be selling PHI, and it specifically requires an authorization.

Under the proposed rule:

Marketing is a communication about a product or service that encourages recipients of the communicton to purchase or use the product or service.  There are exceptions: communications by a covered entity about the covered entity's own healthcare-related products or services; treatment communications; and communications about case management, care coordination, or alternative treatments/therapies.  If the marketing communication is delivered face-to-face or consists only of promotional gifts, no authorization is required.  However, an authorization is needed if the information is non-healthcare related, or if the covered entity gives or sells the PHI to a third party to do the marketing.

With a few exceptions, if the covered entity is compensated for making the communication, it is considered marketing and an authorization is required.  If the compensation received for making the communication is not financial remuneration but is in-kind or other remuneration, then it does not elevate the communication to "marketing." 

If the remuneration is in exchange for some service other than making the communication, it doesn't lose the possibility of being excluded from the definition of marketing.  Refill reminders and information about drugs and biologics currently prescribed, for which the covered entity receives "reasonable" compensation, are not marketing.  Communications to the individual by the provider relating to health-related products (including case management, cooridination of care, and alternative treatments) are not marketing; however, if the provider is compensated and the communication is in writing, the patient must have the opportunity to opt out.  And the provider's NoPP must describe the possibility of these communications and note that the patient can opt out of receiving them.

Under the Omnibus Rule:

If the covered entity receives financial remuneration (not in-kind or other remuneration) for making the communication (a "subsidized communication"), even though it is for treatment or healthcare operations (such as refill reminders, case management or care coordination, or alternative therapies).  A covered entity can provide those, but cannot receive any financial remuneration for doing so.  So, you don't need that NoPP description of the possibility of the communications (they're almost certainly treatment of healthcare operations uses/disclosures) or the ability to opt out.  And if the covered entity can't get paid for the communication, the covered entity's business associate can't either.

To be a "subsidized communication," the financial remuneration must be for the making of the communication, not for something else.  A health plan can pay a provider to set up a disease management program, and the provider can make communications to patients encouraging them to participate in the disease management program without having to obtain prior authorization; the payment was not for the communication about the program, but for the establishment of the program.  Also, a provider can be compensated for making communications to patients without needing an authorization if the communication is made face-to-face (not over the phone) or the communication is a promotional gift of nominal value.  Also, refill reminders and communications about a currently-used drug or biologic are still OK, even if they are subsidized, as long as the subsidy is reasonably related to the costs of providing the reminder/communication.  Finally, communications regarding health generally (promoting healthy diets or regular exams) and about government programs are not marketing

Likewise, sales of PHI generally require an authorization.  There are limited exceptions: public health activities; research (as long as the compensation is reasonable and cost-based); treatment and payment for services; sale in connection with sale of the covered entity to another covered entity (and related due diligence); services by a BA; payment by an individual for copies of his/her PHI; and as HHS otherwise determines.  The authorization can't just state that the PHI is being provided, but that the covered entity is receiving compensation for it.  The final rule uses a definition and exceptions to effect these requirements.  Unlike the marketing prohibition, which only applies to financial remuneration, the prohibition of sales of PHI without authorization applies to any remuneration that might be provided in exchange for the provision of the PHI.