Health Information Compliance Alert

Published on Thu Apr 07, 2022 PDF

Question: Our small practice often sends out annual reminders to our patients about things like flu season, heart health, or mammograms. Would these be considered marketing under the HIPAA Privacy Rule?

AAPC Forum Participant

Answer: No. Wellness programs and annual reminders that promote population health or preventative medicine are not considered “marketing” by the HIPAA Privacy Rule standards.

“A communication that merely promotes health in a general manner and does not promote a specific product or service from a particular provider does not meet the definition of ‘marketing,’” notes the HHS Office for Civil Rights (OCR) online guidance. “Such communications may include population-based activities in the areas of health education or disease prevention,” the agency adds, mentioning examples like mailings on support groups, cancer prevention, or lowering cholesterol levels.

Nuts and bolts: However, it is still important to investigate what OCR does consider marketing. “The Privacy Rule defines ‘marketing’ as making ‘a communication about a product or service that encourages recipients of the communication to purchase or use the product or service,’” the agency says. “Generally, if the communication is ‘marketing,’ then the communication can occur only if the covered entity first obtains an individual’s ‘authorization.’”

That’s why the language your practice uses in these endeavors matters, especially in marketing materials. You must understand what constitutes appropriate language for marketing materials to patients, as well as what is OK in terms of marketing data and other information to covered entities.

For example: If you discuss a product or service — regardless of whether you’re speaking about the item or you are providing the patient with written materials — or encourage the individual to purchase or use that product or service, the communication would likely fall under the HIPAA Privacy Rule’s helm of “marketing.” And you’d need an authorization for that, OCR warns.

Here’s where it gets complicated. If you talk about a product or service that is directly related to that particular patient’s treatment, then it wouldn’t be considered marketing. For instance, when “a primary care physician refers an individual to a specialist for a follow-up test or provides free samples of a prescription drug to a patient,” that would not be marketing but rather part of the treatment, OCR indicates.

Tip: You may ask patients to sign a waiver that ensures that they’re OK with certain practices, but it’s helpful to know exactly which types of communications skirt the line between treatment and health promotion versus actual marketing. That way you can avoid noncompliance with the HIPAA provision and the legal issues associated with it.