Home : Academic/Research : Health Sciences

Health care components must evaluate prospective marketing communications to determine if an authorization is required under HIPAA before PHI may be used or disclosed for this purpose. The criteria outlined below must be followed to make these determinations.

MARKETING COMMUNICATIONS WHERE AUTHORIZATION IS REQUIRED
Written authorization is always required for the following type of marketing activity:

An arrangement between a health care component and any other entity whereby the health care component discloses PHI to the other entity, in exchange for direct or indirect remuneration, for the other entity or its affiliate to make a communication about its own product or service that encourages recipients of the communication to purchase or use that product or service.

Written authorization is also required for a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, unless the activity meets one of the exceptions listed below.

EXCEPTIONS TO THE AUTHORIZATION REQUIREMENT
Written authorization is not required when the health care component communicates to the individual in the following circumstances:

1. For the individual's treatment;
2. About case management or care coordination for the individual, or directions or recommendations for alternative treatments, therapies, health care providers, or settings of care to the individual;
3. To describe a health related product or service, or payment for the product or service that is provided by, or included in the health care component's plan of benefits;
4. When the communication occurs in a face-to-face encounter between the health care component and the individual; or
5. When the communication involves a promotional gift of nominal value such as calendars, pens, or product samples that promote the health care component or another company.