The HIPAA Privacy Rule regulates how patients' protected health information (PHI) can be used for marketing. In general, HIPAA requires written authorization before a covered entity can use PHI for marketing purposes. However, there are a many types of communication that HIPAA does not consider marketing. HIPAA is not intended to restrict providers' ability to communicate about goods and services that are essential for quality healthcare. Also, HIPAA doesn't imply that doctors cannot market to clients—simply that in some instances patient authorization is required. Remember also that all marketing email including for healthcare purposes must abide by the CAN SPAM Act as well. You can find the official definition of marketing under HIPAA here. However, in this blog post we will attempt to provide a more user friendly summary of what marketing means for healthcare providers.
SEE ALSO: How to Write an Effective Healthcare Email Newsletter
Marketing under HIPAA also includes when a business associate pays a covered entity to share patient information so the business associate can market its own product or service. In this case, the authorization that patients sign must indicate that a third party is paying for contact information. It is marketing when:
HIPAA carves out a number of exceptions to its definition of marketing which do not require prior authorization to discuss with patients.
SEE ALSO: Improve Patient Outcomes with Healthcare Email Marketing
Of course, for any these exceptions to HIPAA's definition of marketing, the activity must otherwise be permissible under HIPAA. Also, a covered entity can hire a business associate to make the communication (as long as they have a signed business associate agreement between them). However, the business associate it must sign a contract stating it will only use the information to communicate on behalf of the covered entity.
Now that we've got the HIPAA definition of marketing and non-marketing communication out of the way, let's go over some frequently asked questions which the US Department of Health and Human Services (HHS) provides on its website. The details can be found here, but we've translated the government-speak into plain English below.
Generally, no. A covered entity can communicate about its own health-related services without prior authorization. For example, a hospital’s wellness department could start a weight-loss program and send a HIPAA compliant marketing email to all obese patients seen in the hospital over the past year, even if those individuals were not specifically seen for obesity when they were in the hospital.
SEE ALSO: UrgiKids Uses Paubox Marketing to Share Essential Information with Patients
Moreover, a communication that merely promotes health in a general manner and does not recommend a specific product or service is not considered marketing. Such communications may include educating a patient population about health education or disease prevention. Examples of general health promotional material include:
No. HIPAA does not consider it marketing for a health plan or insurer to send members a list of healthcare providers in the health plan network or for an independent physicians association to send patients a preferred provider list.
Yes. In fact this is a common practice, particularly for managed care organizations. However, remember that only communication about health-related products do not require patient authorization. Also, service must demonstrably add value to enrollees and not merely be a discount or item available to the public at large. So, a Medicare organization could offer a discount for eyeglasses without obtaining patient authorization if the discount were only available to members. However if members were able to obtain the discount directly from the eyeglass store, authorization is required.
Yes, if the communication is for the individual’s treatment, care coordination, or the recommendation of alternative therapies. Similarly, population-based activities in the areas of health education or disease prevention are not considered marketing when they promote health in a general manner. For example, a hospital can use clinical information about patients to target them for a public education campaign.
Alternative treatments are any treatments within the range of treatment options available for a condition. For example, a doctor, in response to a patient asking about treatment options for a skin rash, sends a HIPAA compliant email recommending that the patient purchase various ointments and medications.
Alternative treatment also includes alternative medicine. For example a midwife recommends or sells vitamins and herbal preparations to her pregnant patients.
No. There is no commercial component to communications about benefits available through public programs. Therefore, a covered entity is permitted to use and disclose PHI to communicate about eligibility for Medicare or Medicaid for example without authorization.
There are many ways that healthcare providers can communicate with patients for marketing as well as non-marketing purposes: in person, on the phone, snail mail, etc. However, there is a better way: healthcare email marketing. Paubox Marketing allows healthcare providers to benefit from the powerful tool of personalized email marketing. Recipients view marketing emails like regular emails without relying on out-dated portal notifications which are terrible for the recipient. You can segment your recipients and send secure email including PHI to increase engagement and build your business while remaining HIPAA compliant.
SEE ALSO: Why Paubox Marketing is the Best HIPAA Email Marketing Solution Available
In addition, Paubox Marketing is HITRUST CSF certified. Although you might see HIPAA as a roadblock to implementing an email marketing strategy, it doesn’t have to be.