• E-mail
• Print
• RSS

How would the proposed privacy changes affect marketing?

HIPAA Weekly Advisor, July 12, 2002

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: How would the proposed privacy changes affect marketing?

A: The privacy rule currently defines communications considered "marketing" as any communication "about a product or service" if its purpose is to encourage purchase or use. The final rule also creates a safe harbor that excludes from the definition of marketing, oral communications, and written communications that do not involve payment but describe a provider network or the extent to which a product or service is covered or provided.

Also excluded from marketing are covered entities' communications to an individual about treatment (including ways to manage treatment and alternative types of treatment). However, if the covered entity has received direct or indirect payment for communicating about a product or service, the previously safe harbored communication loses its exempt status.

A marketing communication may be permitted under the final rule with only a consent if it meets the final rule's standards for marketing under health care operations.

The final rule permits marketing communications that do any of the following:

• Occur face-to-face
• Involve products or services of nominal value
• Meet certain "truth in advertising" requirements

In general terms, the "truth in advertising" requirements say the covered entity must identify itself as the party making the communication, must "prominently" state that it received compensation for making the communication, and describe how to opt out of future communications that are not part of a newsletter or related services.

If a covered entity intends to use PHI and the services of a third party to conduct marketing, it must have a business associate agreement in place. Finally, if a covered entity wants to market in ways not allowed in a consent, it must obtain an authorization prior to proceeding.

When the privacy rule was re-opened for comments in February 2001, many said the complex definitions, with safe harbors and special requirements, were unwieldy and confusing. In response, HHS has proposed a streamlined rule on marketing.

For starters, HHS proposes to eliminate all of the disclosure and opt-out requirements in the privacy rule. Instead, anything that falls within the definition of "marketing" would require the authorization of the individual. The most important proposed change is what is-and is not-included within the definition of "marketing."

HHS intends to retain the essentials of the current definition of marketing. "Marketing" under the proposed changes occurs when a covered entity communicates to an individual in a way that encourages or promotes the purchase or use of a product or service.

This change removes the ambiguity of whether the communication "intended" to promote a product or service and looks simply to the effect of the communication, HHS says.

Second, HHS has proposed what it believes are clearer and simplified exceptions to the scope of marketing activities. There is an exception for descriptions of networks and covered services provided by a covered entity and an exception for communications involving treatment for the individual. A third and final exception involves communications about case management or recommendations of treatment alternatives and care options.

Any communication that falls within the broad marketing definition, but does not qualify as an exception, requires an individual authorization.

Finally, HHS stated in the preamble to the NPRM that nothing in the proposed changes will permit a covered entity to sell lists of patients or enrollees to third parties or to disclose PHI to a third party for the in dependent marketing activities of the third party.

Editor's note: Answered by Edward F. Shay, a partner in the national health law practice at the Philadelphia-based law firm of Post & Schell, PC, and adapted from the July 2002 issue of Briefings on HIPAA.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive