The Privacy rule defines marketing as “making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” Generally, if the communication is “marketing” you must get the individual’s prior authorization before making a communication of this type that involves using or disclosing the patient’s PHI.

Selling patient lists: Because we believe you cannot be certain that every patient on a lengthy list of patients has signed the necessary authorization; we strongly recommend that you do not sell your patient lists for marketing purposes. This would also include prohibiting you from providing a drug manufacturer with your patient lists for their advertising, even if you do not sell the lists to them.

There is no authorization or consent requirement for you to have discussions with your patients recommending that they purchase allergy products which you may be selling in your office or that they undertake activities associated with case management or care co-ordination.

We believe virtually all other communications relative to purchase or use of products or services are marketing communications and require prior patient authorization.

Note: Appointment reminders are not considered marketing. The regulations relative to marketing also contain an exception from the authorization requirement for your provision of nominal value gifts to patients, even if this distribution is designed to encourage the recipient to buy certain products or services from you. Therefore, you may provide your patients with items such as pens, notepads, and cups with your logo embossed on them without fear of violating the HIPAA Privacy Rule.

• Authorization required
• Covers sale of patient lists
  • Recommendation - do not sell patient lists
• No release necessary for face-to-face marketing communication with patient

NEXT>>