Fundraising Under HIPAA —The Privacy Rule—
AHP's Special Analysis

From Stuart R. Smith, FAHP - Chair
William C. McGinly, Ph.D., CAE - President, Chief Executive Officer
Reviewed and Presented by AHP Legal Counsel - Peter Parvis, Esq., Venable,
Washington, D.C.

Short Answer
Response/Conclusion:
See also: Long Answer

Although the main concern for AHP is fundraising, it is important to understand how the final regulations will effect marketing.

The 2002 Final Rule requires the patient's authorization to use any PHI in connection with marketing, except for face-to-face communications and use of promotional gifts with a nominal value. Marketing is no longer defined as part of health care operations[16], meaning that marketing efforts (in the absence of authorization, which is impracticable) must either be based on information that is not PHI or fit within one of the carve outs described below. Covered entities should take care in the use of directed communications or newsletters to have the contents either fall outside the definition of marketing, or avoid ufssing PHI to target the recipients.

The marketing rules have caused confusion. Some guidelines may help:

1. A health care provider can not disclose PHI to another entity for the purpose of that entity's marketing.

2. A health care provider is not “marketing” under HIPAA when it describes the services and products it offers. Therefore, a health care provider can use a PHI derived mailing list to send communications describing its own products or services. The Office of Civil Rights of HHS gave the following example in its December 3, 2002 FAQ release:
   
   A health care provider [can] use its patient list to announce the arrival of a new specialty group (e.g., orthopedic) or the acquisition of new equipment (e.g., x-ray machine or [MRI]) through a general mailing or publication.

3. Similarly, a communication is not marketing under HIPAA if it is made for treatment or for operations (e.g., recommending alternative treatments, case management or care or for co-ordination, etc.)

4. If a business associate is used to perform permitted marketing, it must agree not to use the PHI for its own or anyone else's purpose.

5. Generally, health promotion and wellness programs do not fall under the HIPAA definition of marketing. The FAQ approves the example of a health care provider sending a flyer about its new weight-loss program to all patients who were defined as obese, even if the treatment received was not specifically for obesity [17].

The issue can be avoided by using mailing lists that are not derived from the health care provider's patient lists for newsletters and similar widely disseminated mailings that contain marketing that does not fit within one of the carve-outs discussed above. HIPAA forbids the use or disclosure of PHI (including the names and addresses or patients) for marketing, but other sources of mailing lists are available.

Previous Page