UAMS ADMINISTRATIVE GUIDE
UAMS ADMINISTRATIVE GUIDE
NUMBER: 3.1.36
DATE: 04/01/02
REVISION: 03/01/04
| SECTION: | GENERAL ADMINISTRATION |
| AREA: | ADMINISTRATION |
| SUBJECT: | USE OF PHI FOR MARKETING |
SCOPE
UAMS Workforce
PURPOSE
To establish guidelines and restrictions for the use and disclosure of Protected Health Information by UAMS in connection with marketing activities.
DEFINITIONS
For purposes of this policy, the following definitions apply:
Marketing means communications about a product or service that encourages recipients of the communication to purchase or use the product or service. Marketing also includes any arrangement between UAMS and another party in which UAMS discloses PHI for the other party to make a communication about its own product or service that encourages recipients of the communication to purchase or use that product or service.
For purposes of this policy, “Marketing” does not include the following communications that are made by UAMS:
1. Communications by UAMS to an individual for the purpose of describing to that individual a health-related product or service that is provided by UAMS, or included in a UAMS plan of benefits; or
2. Communications by UAMS to an individual as part of the treatment of the individual; or
3. Communications by UAMS to an individual in the course of managing or coordinating treatment of that individual, or for the purpose of directing or recommending to that individual alternative treatments, therapies, health care providers, or settings of care.
Protected Health Information (PHI) means information that is part of an individual’s health information that identifies the individual or there is a reasonable basis to believe the information could be used to identify the individual, including demographic information, and that (i) relates to the past, present or future physical or mental health or condition of the individual; (ii) relates to the provision of health care services to the individual; or (iii) relates to the past, present, or future payment for the provision of health care services to an individual. This includes PHI which is recorded or transmitted in any form or medium (verbally, or in writing, or electronically). PHI excludes health information maintained in educational records covered by the federal Family Educational Rights Privacy Act and health information about UAMS employees maintained by UAMS in its role as an employer.
UAMS Workforce means for purposes of this Policy, physicians, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for UAMS, are under the direct control of UAMS, whether or not they are paid by UAMS.
UAMS will not use or disclose a patient’s Protected Health Information (PHI) for Marketing purposes except as allowed by federal and state law, including the Federal HIPAA Privacy Regulations, and any PHI that is used for disclosed by UAMS in compliance with this Policy will be limited to the minimum necessary to achieve the purpose of the use or disclosure.
A. Prior Patient Authorization Required: Except as allowed by this Policy, UAMS will obtain the patient’s authorization in writing, using a UAMS Authorization form prior to using or disclosing a patient’s Protected Health Information for Marketing purposes. See the UAMS Use and Disclosure PHI and Medical Records Policy, 3.1.28 for the required elements of a HIPAA compliant authorization. If the Marketing involves direct or indirect remuneration to UAMS from a third party, the Authorization must state that such remuneration is involved.
Patient Authorization also is required prior to the use or disclosure of PHI made in connection with any arrangement between UAMS and another entity whereby UAMS discloses Protected Health Information to the other entity, in exchange for direct or indirect remuneration, for the other entity or its affiliate to make a communication about its own product or service that encourages recipients of the communication to purchase or use that product or service.
This would include, for example, a situation where a company seeks access to a list of UAMS patients or any other PHI which the company will use for its own Marketing activities, regardless of whether the company is to use the PHI on behalf of UAMS as well, and seeks to do so under the guise of a Business Associate relationship or agreement. This situation requires prior patient Authorization.
B. Prior Patient Authorization NOT Required: UAMS is not required to obtain a written or verbal Authorization from a patient to use or disclose a patient’s Protected Health Information for any Marketing communications about products or services of UAMS or a third party when the communications occur in the following circumstances:
1. face-to-face communication between UAMS and the patient (this does not include communications by telephone, e-mail or facsimile); or
2. UAMS provides to a patient a promotional gift of nominal value (e.g., items with the UAMS name or another company’s name, or sample products).
C. Communications Which are NOT Marketing, and Therefore, No Prior Patient Authorization Required: The following types of communications made by UAMS to an individual are not considered “Marketing” for purposes of this policy, and therefore, no prior patient authorization is required:
1. Communications by UAMS to an individual for the purpose of describing to that individual a health-related product or service that is provided by UAMS, or included in a UAMS plan of benefits; or
2. Communications by UAMS to an individual as part of the treatment of the individual; or
3. Communications by UAMS to an individual in the course of managing or coordinating treatment of that individual, or for the purpose of directing or recommending to that individual alternative treatments, therapies, health care providers, or settings of care.
D. Business Associate Agreement Required: If UAMS intends to disclose Protected Health Information to a third party for the purpose of the third party communicating with individuals about the products or services of UAMS, such disclosure does not constitute Marketing communications and does not require patient Authorization. Prior to such disclosure, UAMS is required to enter into a written agreement with the third party, restricting the third party’s use of the Protected Health Information to communications on behalf of UAMS and UAMS’ own products and services. The agreement will be a Business Associate Agreement UAMS Business Associate Policy, 3.1.33 as defined under the HIPAA regulations and approved by UAMS.
Note that the use of a Business Associate Agreement will not take the place of a patient Authorization in situations involving the use or disclosure of PHI to facilitate or conduct communications with patients about the products or services of others. This would include, for example, a situation where a company seeks access to a list of UAMS patients or any other PHI which the company will use for its own Marketing activities to promote its own products or services, regardless of whether the company is to use the PHI on behalf of UAMS as well, and seeks to do so under the guise of a Business Associate relationship or agreement. This situation requires prior patient Authorization.