§17936 Conditions on certain contacts as part of health care operations

Summary

When a doctor, hospital, or their business partner sends a message that tries to sell or promote a product or service, that message usually is not treated as a routine health-care business activity under federal privacy rules—unless the message is one of the specific types listed in the HIPAA marketing rules. If the covered entity gets paid to send such a marketing message, it still won’t count as routine business only in these cases: the message only talks about a drug or biologic the person already has a prescription for and the payment is reasonable; the covered entity itself sends the message and the person gave a valid written permission; or a business associate sends the message for the covered entity and follows their written contract. “Reasonable in amount” will be defined by the Secretary. Payments for medical treatment are not treated as a “direct or indirect payment.” Written fundraising messages that are treated as routine health-care business must include a clear way for the person to opt out, and opting out counts as revoking permission. These rules apply to written messages sent on or after the effective date in section 13423.