Use and Disclosure of Protected Health Information in Marketing

Statement of Policy

Washington University and its member organizations (collectively, “Washington University or “WU”) are committed to conducting Marketing in compliance with all applicable laws, regulations and WU policies to protect the privacy of the Protected Health Information (“PHI”) of Individuals. To help strengthen this commitment, WU has adopted this Policy in order to clearly define the circumstances under which PHI may be Used or Disclosed in connection with marketing activities and when an Authorization is required. This Policy is not intended to interfere with WU’s ability to communicate freely with Individuals about Treatment options and other health-related topics, such as disease management and wellness programs.

Scope of Policy

The scope of this Policy includes Marketing performed by WU or by a Business Associate of WU.

Definition of Marketing

Marketing as defined by the Privacy Rule and this policy is “making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service”.


1) Notice of Privacy Practices.

a) The Notice of Privacy Practices (see WU HIPAA Policy on Notice of Privacy Practices) must contain a statement that WU may contact an Individual to provide information about Treatment alternatives, disease management, wellness programs, or other health-related products and services in a manner consistent with this policy.

2) Communications That Are Not Considered Marketing

a) WU is not engaged in Marketing and does not need to obtain an Authorization from an Individual when it communicates to the Individual about:

i. its employee Health Plan, providers participating in the plan, the services offered by those providers or the benefits covered by the Health Plan;
ii. the Individual’s Treatment; or
iii. case management or care coordination for that Individual, or directions or recommendations for alternative treatments, therapies, health care providers, or setting of care to that Individual.

b) Communications that merely promote health in a general manner and do not promote a specific product or service from a particular provider are not considered Marketing communications (i.e. mailings or newsletters widely distributed to Individuals, enrollees, or other broad groups of Individuals about health improvement or disease prevention, new development in diagnosis or Treatment of a disease, health fairs, health/wellness-oriented classes or support groups).

c) Communications about government or government-sponsored programs are not considered Marketing communications.

3) When Prior Authorization for Marketing is Required

a) Generally, WU may not Use or Disclose PHI to create or engage in Marketing communications without valid, written Authorization from an Individual to Use or Disclose PHI (see WU HIPAA Policy on Authorization Required to Use or Disclosure Protected Health Information). An Authorization obtained for Marketing purposes must describe the Marketing communication with sufficient specificity. Blanket Marketing Authorizations are not acceptable.

b) Any marketing communication that involves direct or indirect remuneration to WU or a Department within the University from a third party, requires an Authorization signed by the patient. The Authorization must state that remuneration is involved. The Authorization does not need to specify the amount or type of remuneration.

c) Once WU obtains an Authorization from an Individual to Use or Disclose that Individual’s PHI for a specified Marketing purpose, it need not include an opt-out provision in the Marketing communication.

 4) When Prior Authorization for Marketing is Not Required

a) WU is not required to obtain prior Authorization from the Individual for the following communications in which WU Uses or Discloses PHI for Marketing purposes:

i. a face-to-face communication made by WU to an Individual (i.e., sample products may be provided to an Individual during an office visit); or
ii. communications that concern a promotional gift of nominal value provided by WU (i.e., pens, toothbrushes, or key chains).

5) Disclosure of PHI to Business Associates

a) WU may Disclose PHI of an Individual, with the Individual’s Authorization, to Business Associates that are undertaking Marketing activities on behalf of WU. WU must obtain a Business Associate Agreement from the Business Associate agreeing that it will only Use the PHI for WU’s Marketing activities (see WU HIPAA Policy on Use or Disclosure of Protected Health Information with Business Associates). WU may engage a Business Associate, as long as a Business Associate Agreement has been obtained, to assist WU in communicating with an Individual about WU’s health-related products or services, the Individual’s Treatment, or case management or care coordination of the Individual.

Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: August 30, 2013