HIPAA final rule brings changes to marketing, fundraising

The HIPAA Privacy and Security Omnibus final rule – issued by HHS on Jan. 17 – should bring some long-awaited clarification and certainty to marketing, fundraising and other aspects of safeguarding and using health information.

"The initial set of rules was tilted toward meeting the needs of the industry. That appears to have significantly changed in the final rule," said Deven McGraw, director of the health privacy project at the Center for Democracy and Technology and a member of the federal advisory Health IT Policy Committee.

In the final rule, the Department of Health and Human Services said that communications subsidized by the manufacturer of a product or service is marketing, and the only exception is for communications about drugs and biologics that a patient is being treated with, including generics. The area in question had been marketing around population-based purposes.  

"It's a very good development for consumers, who when you survey them about their privacy concerns, marketing issues about their data is always really high on the list," McGraw said.

"It is very unnerving for people to get email or mail that indicates that someone knows what medication they are taking. Your threshold of what is sensitive to you is preserved in this rule because you have the right to opt in for communications if you want to get them," she said.

The final rule fills in gaps, clarifies and finalizes some changes to safeguard the privacy, security and enforcement of patient information. The modifications are in response to the 2009 HITECH Act in the stimulus law, which strengthened the Health Insurance Portability and Accountability Act (HIPAA). HHS' Office of Civil Rights enforces HIPAA and oversees health information privacy.

Adam Greene, partner, Davis Wright Tremaine LLP, and former senior health IT and privacy adviser in the Office for Civil Rights, said that fundraising is one of the major changes in the final rule for providers and other covered entities, who will have a greater ability to use protected information for fundraising purposes, such as being able to consider outcomes.

"So if a person had a negative outcome, you're not sending them a fundraising request," he said. 

Under the previous HIPAA privacy rule, a hospital could only use limited demographic information about its patients for fundraising purposes, said Bob Belfort, partner in the healthcare practice at Manatt, Phelps & Phillips.

"Many of my hospital clients have had an interest in targeting fundraising based on the nature of the services a patient received or who their doctor was, and having doctors make personal appeals to the patients, or targeting, say, cancer fundraising at people who had been treated for cancer. They really were not permitted to do that under the prior rule," he said.

Now that's been loosened so that information about the type of department a patient was in within the hospital and who their physician was can be used for fundraising. Patients have the right to opt-out, and hospitals will have to include a notice on all fundraising communications that the patient has the right to opt-out of solicitations, Belfort said.

 "It will be interesting to see what, if anything, the patient reaction is," Belfort said. "Right now patients shouldn't be getting fundraising solicitation where they can see they've been targeted based on the nature of the services they got. I don't know whether patients will have a negative reaction to getting solicitations that indicate fundraisers have looked at their data in more detail."