Title 42 › Chapter 156— HEALTH INFORMATION TECHNOLOGY › Subchapter III— PRIVACY › Part A— Improved Privacy Provisions and Security Provisions › § 17936
Says when a health-care provider or its business partner can treat a promotional message as a normal health-care operation under the privacy rules. If a message encourages people to buy or use a product or service, it usually is not a health-care operation unless it matches specific marketing types in the privacy rule. If the provider received payment to send such a marketing message, it generally is still not a health-care operation, except when one of three things is true: the message only describes a drug the person is already prescribed and any payment is reasonable; the provider sent the message and the person gave a valid written authorization; or a business associate sent the message for the provider and it follows their written contract. “Reasonable in amount” will be defined by the Secretary. “Direct or indirect payment” does not include payment for treatment as defined in the privacy rule. Written fundraising messages that are health-care operations must clearly let recipients opt out of future messages, and opting out counts as revoking authorization. These rules apply to written communications on or after the effective date in section 13423.
Full Legal Text
The Public Health and Welfare — Source: USLM XML via OLRC
Legislative History
Reference
Citation
42 U.S.C. § 17936
Title 42 — The Public Health and Welfare
Last Updated
Apr 5, 2026
Release point: 119-73not60