HIPAA marketing rules: when a US practice needs patient authorization

The definition is short and broader than most practices expect. Marketing is a communication about a product or service that encourages recipients to purchase or use that product or service. It turns on the effect of the message rather than the channel, so a newsletter, a text message, a social post and a printed card all fall to be tested the same way.

The consequence of the label matters. A communication that counts as marketing requires written authorization under 45 CFR 164.508 before the practice may use protected health information to make it. A communication that stays outside the label sits in ordinary treatment or health care operations, where consent and the practice's own notice of privacy practices govern instead.

The definition itself removes several categories. Communications for treatment, including case management and care coordination for a patient, and communications that direct or recommend alternative treatments, therapies, providers or settings of care, sit outside marketing. So does a description of a health related product or service the practice itself provides, and the case management contact that follows a course of treatment.

One condition runs across all of those categories. Where the practice receives financial remuneration in exchange for making the communication, the carve out stops applying. That is the hinge the whole rule turns on, and it is why a message that reads as ordinary patient communication can become marketing when a supplier is paying for it.

Where a communication is marketing and no carve out applies, the practice needs an authorization that meets the requirements of 45 CFR 164.508. That is a specific written permission from the patient, separate from a general consent to treatment, and it describes what information will be used and for what purpose.

Two exceptions survive the authorization requirement: a communication made face to face by the practice to the patient, and a promotional gift of nominal value provided by the practice. Both are narrow by design. Neither covers an email campaign, a direct mail list, an audience built from patient records or an advertisement placed beside patient information.

Financial remuneration means direct or indirect payment from, or on behalf of, a third party whose product or service is being described. Payment for treating a patient does not count, which keeps ordinary clinical billing outside the rule. A supplement supplier paying for a mention in the practice newsletter does count.

Where remuneration is involved, both surviving exceptions narrow further, and the authorization itself has to state that the practice is being paid. That statement is the point of the provision: a patient can weigh a recommendation differently once they know who funded it.

Appointment reminders, test results, follow up instructions and care coordination messages sit on the treatment side. A newsletter that describes the practice's own new service, with no third party paying, sits in the health care operations carve out. A campaign promoting a supplier's product to a patient list sits on the marketing side and needs authorization and a remuneration statement.

The useful habit is to ask the funding question before the content question, because funding decides which exceptions remain available. A practice that answers both questions before a campaign is written avoids rebuilding it after counsel reads it.