What is HIPAA marketing authorization?

The HIPAA Privacy Rule defines marketing as a communication about a product or service that encourages the recipient to buy or use it. When a practice, health plan or other covered entity wants to use PHI for that kind of communication, it generally needs the patient's written authorization first.

A valid authorization is not a checkbox buried in intake paperwork. It must describe the information to be used, who will use or receive it, the purpose, an expiration date or event, and the patient's right to revoke it. It must be signed and dated. If the marketing involves financial remuneration to the practice from a third party, such as a device maker paying for a mailing, the authorization must state that remuneration is involved.

HIPAA carves out some communications from the definition of marketing. Examples include describing the practice's own health-related services, treatment communications, case management and care coordination, as long as no third party pays for the message. Face-to-face communications and promotional gifts of nominal value are also exceptions to the authorization requirement.

The most common mistake is assuming a general consent form covers marketing. Consent to treatment and acknowledgment of the Notice of Privacy Practices are not marketing authorizations. Another is treating a patient's public review as permission to reuse it in ads with added health details.

Practices also confuse the BAA with authorization. A Business Associate Agreement lets an agency handle PHI for permitted purposes. It does not make a marketing use permitted. Finally, authorizations expire and can be revoked, so keep records and honor revocations quickly. Rules here are detailed; confirm specific campaigns with your compliance or legal team.