Back to Index of HIPAA Changes

HIPAA Changes in H.R. 1
The American Recovery and Reinvestment Act of 2009

Conditions of Certain Contacts as Part of Health Care Operations
House bill Sec. 4406
Senate bill Sec. 13406
Conference agreement Sec. 13406

This text is from the Conference Committee Report

Current Law

Generally, covered entities may use and disclose health information for the purpose of treatment, payment, and other health care operations without the individual's authorization and with few restrictions. Health care operations are broadly defined to include quality assessment and improvement activities, case management and care coordination, evaluation of health care professionals, underwriting, legal services, business planning, customer services, grievance resolution, and fundraising.

Under the Privacy Rule promulgated pursuant to HIPAA, a covered entity may not disclose health information to a third party (e.g., pharmaceutical company), in exchange for direct or indirect remuneration, for the marketing activities of the third party without first obtaining a patient's authorization. Similarly, a covered entity may not use or disclose health information for its own marketing activities without authorization. Marketing is defined as a communication about a product or service that encourages the recipient to purchase or use the product or service. However, communications made by a covered entity (or its business associate) to encourage a patient to purchase or use a health care-related product or service are excluded from this definition and, therefore, do not require the patient's authorization, even if the covered entity is paid by a third party to engage in such activities.

House Bill

The House bill would clarify that a marketing communication by a covered entity or business associate about a product or service that encourages the recipient to purchase or use the product or service may not be considered a health care operation, unless the communication relates to a health care- related product or service. Further, it would prohibit a covered entity or business associate from receiving direct or indirect payment for marketing a health care-related product or service without first obtaining the recipient's authorization. Business associates would be permitted to receive payment from a covered entity for making any such communication on behalf of the covered entity that is consistent with the contract. Fundraising using a patient's protected health information would not be permitted without a patient's authorization.

Senate Bill

Like the House bill, the Senate bill would clarify that a marketing communication by a covered entity or business associate about a product or service that encourages the recipient to purchase or use the product or service may not be considered a health care operation, unless the communication relates to a health care-related product or service. Further, the Senate bill states that a communication about a health care-related product or service would be permitted as a healthcare operation including where the covered entity receives payment for making the communications where (1) the communication only describes a health care item or service previously prescribed for or administered to the recipient, or (2) the covered entity or business associate obtains authorization. Finally, the Senate bill does not include the House provision on fundraising.

Conference Agreement

The conference agreement retains the general rules about marketing in both the House and Senate bills. The conference report makes an exception and allows providers to be paid reasonable fees as determined by the Secretary to make a communication to their patients about a drug or biologic that the patient is currently prescribed. The conference agreement continues to permit fundraising activities by the provider using a patient's protected health information so long as any written fundraising provide an opportunity to opt out of future fundraising communications. If the recipient chooses to opt out of future fundraising communications, that choice is treated as a revocation of authorization under 45 CFR 164.508. All the protections that apply under 45 CFR 164.508 to an individual who has revoked an authorization would thus apply to a recipient of communications who chooses to opt out of receiving future fundraising communications, including the right not to be denied treatment as a result of making that choice.