This Article summarizes the changes made by the recently released HIPAA regulations regarding the use/disclosure of protected health information (PHI) for fundraising purposes.  Specifically, the Article examines (i) the categories of PHI that can be used/disclosed for fundraising purposes and (ii) the requirements imposed in connection with the use/disclosure of PHI for fundraising purposes.

 

CATEGORIES OF PHI THAT CAN BE USED/DISCLOSED FOR FUNDRAISING PURPOSES

The new regulations significantly expand the types of PHI that may be used or disclosed for fundraising purposes.  Under the new regulations, the categories of PHI that can be used or disclosed include:

  • Demographic information relating to the individual, including name, address, other contact information, age, gender, and date of birth;
  • Dates of health care provided to the individual;
  • Department-of-service information, which includes information about the general department of treatment, such as cardiology, oncology, or pediatrics;
  • Treating physician;
  • Outcome information, which includes information regarding the death of the patient or any sub-optimal result of treatment or services; and
  • Health-insurance status.

Covered Entities must still apply the minimum-necessary standard to ensure that only the minimum amount of PHI necessary to accomplish the intended purpose is used or disclosed.

 

REQUIREMENTS IN CONNECTION WITH USE/DISCLOSURE OF PHI FOR FUNDRAISING PURPOSES

The new regulations also expand the requirements imposed upon a Covered Entity that uses PHI for fundraising purposes.  Under the new regulations, Covered Entities that use or disclose PHI for fundraising purposes are subject to the following requirements:

  • PHI may not be used or disclosed for fundraising purposes unless the Covered Entity informs individuals in its Notice of Privacy Practices that it might contact them to raise funds and that they have a right to opt out of receiving such communications.
  • With each fundraising communication made to an individual, whether made in writing or over the phone, the Covered Entity must provide the individual with a clear and conspicuous opportunity to elect not to receive any further fundraising communications.
  • Covered Entities are free to provide individuals with the choice of opting out of all future fundraising communications or just campaign-specific communications.  Whatever method is employed, the communication should clearly inform individuals of their options and any consequences of electing to opt out of further fundraising communications.
  • The method for an individual to elect not to receive further fundraising communications cannot cause the individual to incur an undue burden or more than a nominal cost.  The new regulations encourage Covered Entities to consider the use of a toll-free phone number, an e-mail address, or similar opt-out mechanism that would provide individuals with a simple, quick, and inexpensive way to opt out of receiving future communications.  Requiring that individuals opt out of further fundraising communications by simply mailing a pre-printed, pre-paid postcard would not constitute an undue burden under the new regulations and is an appropriate alternative to the use of a phone number or e-mail address.  Conversely, requiring individuals to write a letter to opt out constitutes an undue burden.
  • A Covered Entity may choose to provide individuals with the opportunity to select their preferred method for receiving fundraising communications.  If an individual elects to opt out of future fundraising communications, then the opt out is effective for all forms of fundraising communications and the individual must be removed from all such lists.
  • The Covered Entity may not make fundraising communications to an individual where the individual has elected not to receive such communications.  However, the Covered Entity may provide an individual who has elected not to receive further fundraising communications with a method to opt back in to receive such communications.
  • The Covered Entity may not condition treatment or payment on the individual’s choice with respect to the receipt of fundraising communications.