When is an authorization required from the patient before a provider or health plan engages in marketing to that individual?
The HIPAA Privacy Rule expressly requires an authorization for uses or disclosures of protected health information for ALL marketing communications, except in two circumstances: (1) when the communication occurs in a face-to-face encounter between the covered entity and the individual; or (2) the communication involves a promotional gift of nominal value.
Related Questions
- Is it marketing for a covered entity to describe the entities participating in a health care provider network or a health plan network?
- When is an authorization required from the patient before a provider or health plan engages in marketing to that individual?
- Who does the QB, their medical provider or health plan representative call with questions about COBRA?
