Can use patient data without the persons prior

can use patient data without the person's prior approval. One of the interesting implications of
HIPAA is the use of patient data for marketing and fundraising activities. Under the
regulations, a health care organization must have written authorization to use patient
information for purposes that are not related to the treatment or payment of their care. Under
the privacy rule, however, certain marketing and fundraising activities have been allowed
without patient authorization. But, this opportunity to use patient data is only in support of
several limited fundraising and marketing activities.
Many additional provisions were included in President Obama's $787 billion American
Recovery and Reinvestment Act (2009) to further strengthen the HIPAA provisions. Of
particular note are new regulations pertaining to the marketing and release of patient
information. Hospitals, in particular, must be far more careful in terms of not marketing to
patients who opt out of hospital fundraising lists. According to section 13406 of the
Reinvestment Act, health care organizations may not communicate about a product or service
that encourages people to purchase or use a product or service, nor may they communicate
with consumers if the hospital receives or has received direct or indirect payment in exchange
for making such communication. 70
Health care organizations and the institutionally related foundations (foundations that
qualify as nonprofit charitable foundations under section 501(c)(3) of the Internal Revenue
Code and that have in their charter statement of charitable purposes an explicit linkage to the
health care organization) may use or disclose an individual's demographic information and/or
the dates that the individual received treatment without obtaining written authorization.
These uses and disclosures are permissible in the following instances:
1. The covered entity's notice of privacy practices states that individuals may be
contacted for the purpose of raising funds.
2. Any and all fundraising materials include instructions on how to opt-out of future
communications.
3. The covered entity makes reasonable efforts to ensure those individuals' opt-out
requests are honored.
The use or disclosure of patient health information (PHI) for marketing purposes is
permissible without an authorization in three instances:

Regulatory Factors 52
2. 1. First, health care organizations are permitted to use or disclose patient information
without authorization to make marketing communications in face-to-face encounters.
These communications may include discussion of any services or products, including
the services or products of a third party.Second, patient information may be used or
disclosed without authorization to make marketing communications involving
products or services of nominal value. This would allow for the distribution of
calendars, pens, and other merchandise that is generally considered to be of a
promotional nature.