Demystifying HIPAA

When Do You Need a HIPAA Marketing Authorization From Patients?

The Department of Health and Human Services (HHS) Office for Civil Rights released the Health Insurance Portability and Accountability Act (HIPAA) Final Rule on January 25, 2013 with an effective date of March 26, 2013. Covered entities and business associates, including audiologists who are covered entities must come into compliance with the new requirements of the Final Rule by September 23, 2013. The Final Rule provides individuals with new rights to their health information and strengthens the government

The Academy has received an increasing number of questions about the definition of marketing and under what circumstances an audiologist or audiology practice would be required to obtain a marketing authorization from patients under the HIPAA Final Rule.Given the current health care environment and the emphasis on coordination of care and navigation of the health care delivery system, we wanted to to “demystify” the HIPAA rule changes, especially those related to marketing. For example, treatment under HIPAA, which includes care coordination activities, does not require an authorization. Face-to-face communication with your patients, even if “marketing” under the HIPAA rule, does not require an authorization.

The definition of marketing is broad and includes a number of exceptions.Several of the exceptions are likely to be applicable to the activities that audiologists engage in with their patients as part of the regular course of patient care. The Academy has sought the advice of legal counsel to discuss these HIPAA changes in detail and to develop a HIPAA Marketing Requirements Decision Tree that will assist you in determining whether you need patient authorization under HIPAA based on your particular type of communication.

Audiology Marketing Authorization Questions and Answers

Below is a sampling of questions that the Academy has received from members:

Q: When is a communication considered marketing under HIPAA?

A: Under HIPAA, marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. Marketing does not include the following communications:

For treatment of a patient, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the patient;
To describe a health-related product or service or payment for such product or service that is provided by the covered entity making the communication; or
For case management or care coordination, contacting individuals with information about treatment alternatives, and related functions to the extent these activities do not fall within the definition of treatment.

If you receive remuneration for any of these communications then these activities become marketing activities, which requires an authorization. However, absent remuneration, these activities do not require patient authorization.

Q: When do I need an authorization to send marketing communications to my patients under HIPAA?

A: If the communication is marketing as defined by HIPAA (see above), you must have a valid, written authorization that meets the requirements of HIPAA from the patient before marking the communication. You do not need an authorization for the items that are listed as exceptions to HIPAA marketing definition (see above), including the treatment of your patient, describing a health-related product or service to your patient, or for case management or care coordination, unless you receive direct or indirect remuneration in exchange for making that communication.

For example, if you receive remuneration from a hearing aid vendor for a communication that provides information to your patients regarding treatment alternatives such as alternate hearing aid options, you need authorization. Remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described. Direct or indirect remuneration does not include any payment for treatment of a patient. Making a communication to your patients about services or products provided by you absent any remuneration, does not require patient authorization under HIPAA.

If you use or disclose protected health information (PHI) outside of the exceptions listed above, you will generally need authorization. However, two additional exceptions to this rule exist. You do not need authorization for:

Face-to-face communication with your patient or
Gifts of nominal value.

Q: What if I receive payment or remuneration to make a marketing communication under HIPAA?

A: If you receive payment or direct or indirect remuneration to make a communication from a third party about a product or service that encourages recipients of the communication to purchase or use the product or service, you will need to obtain an authorization from each of your patients that will receive the communication before making such communication. You must include a statement in the authorization acknowledging that the remuneration was received in exchange for the communication. This statement is only required if remuneration is involved and does not need to be added to all authorization forms.

Q: If I talk to my patients face-to-face about a product or service that encourages recipients of the communication to purchase or use the product or service do I need authorization?

Q: I want to send information to patients about treatment alternatives or care coordination, do I need authorization?

A: Generally you do not need authorization to discuss with your patients their treatment alternatives or care coordination, such as appointment reminders. As discussed above, these activities are exceptions to the HIPAA definition of marketing so you do not need to obtain authorization from your patients when communicating about appointment reminders. You will only need an authorization if you receive remuneration to make the communication.

Q: Relatedly, can I email or mail patient's appointment reminders?

Q: Can I sell protected health information (PHI) about my patients?

A: Generally, you cannot sell PHI without the authorization of the patient. For example, you may only sell PHI in the following situations:

Public health purposes;
The sale, transfer, merger, or consolidation of all or part of a covered entity and for related due diligence;
Business associate in connection with the business associate's performance of activities for the covered entity;
To a patient or beneficiary upon request, and;
As required by law;
Research purposes.

One of the most important things to understand about HIPAA when it comes to marketing is that what many audiologists consider to be marketing may not fall under the definition of marketing under HIPAA. One of the very first steps in your analysis must be to determine if a specific activity is considered marketing under HIPAA. If yes, patient authorization is generally required; however, if not, patient authorization is not required in most circumstances. The HIPAA Marketing Requirements Decision Tree should help you analyze common audiology practice activities to determine whether or not patient authorization is required under the Final Rule for HIPAA. It is always advisable to seek the opinion of legal counsel and to also complete a risk analysis for your practice.

Kathy Foltner, AuD, is the Academy past chair of the Practice Compliance Committee and vice president sales, Hearing Care, Sikka Software.

Sharmila Sandhu, Esq., is the Academy Director of Regulatory Affairs.

*This article and Decision Tree were developed with the advice and review of Sarah E. Swank, Esq., a Principal from the law firm of Ober|Kaler.

Audiology Marketing Authorization Questions and Answers

Join the Academy