HIPAA Fundraising Communications: The Six Data Categories, the Notice Statement and the Opt-Out

The Fundraising Provision at 45 CFR 164.514(f)

The HIPAA Privacy Rule treats fundraising as part of a covered entity's own operations. The definition of health care operations in 45 CFR 164.501 includes, among business management activities, "fundraising for the benefit of the covered entity," consistent with the requirements of section 164.514. The operative rule is section 164.514(f):

Subject to the conditions of paragraph (f)(2) of this section, a covered entity may use, or disclose to a business associate or to an institutionally related foundation, the following protected health information for the purpose of raising funds for its own benefit, without an authorization meeting the requirements of § 164.508

45 CFR 164.514(f)(1)

The provision is a permission, not a mandate, and it is bounded on three sides: the purpose (raising funds for the covered entity's own benefit), the recipients (the entity, its business associates, and an institutionally related foundation), and the data (a closed list of six categories).

The rule began narrower than it is now. In the 2000 final Privacy Rule, 65 FR 82462, HHS noted that it had proposed requiring authorization for any fundraising use and backed away after comments that the requirement would be costly for nonprofit providers and depress charitable giving. The preamble described permissible fundraising activities as "appeals for money, sponsorship of events, etc. They do not include royalties or remittances for the sale of products of third parties (except auctions, rummage sales, etc)." The 2013 Omnibus Rule repeated that description and said the final rule "does nothing to modify the types of communications that are currently considered to be for fundraising purposes."

Which Information a Foundation May Receive

The current list in section 164.514(f)(1) is:

• Demographic information relating to an individual, including name, address, other contact information, age, gender, and date of birth
• Dates of health care provided to an individual
• Department of service information
• Treating physician
• Outcome information
• Health insurance status

Until 2013 the list was only demographic information and dates of care. The Omnibus Rule, 78 FR 5566, added department of service, treating physician and outcome information, which it said commenters "most frequently identified" as needed to target solicitations. The preamble did not define the new terms but explained them. Department of service means the general department of treatment, "such as cardiology, oncology, or pediatrics." Outcome information "includes information regarding the death of the patient or any sub-optimal result of treatment or services," and HHS said it intended outcome information to be used to screen out patients who had a poor outcome, and to be disclosed to a business associate or foundation only where that party performs the screening. The same rule moved date of birth into the regulatory text and listed health insurance status separately, explaining that it did not regard insurance status as truly demographic. HHS also stressed that the minimum necessary standard at 164.502(b) applies to fundraising uses and disclosures like any other.

The rule does not define institutionally related foundation. The 2000 preamble did: "a foundation that qualifies as a nonprofit charitable foundation under section 501(c)(3) of the Internal Revenue Code and that has in its charter statement of charitable purposes an explicit linkage to the covered entity." A foundation may support the covered entity together with other providers in its community, or the members of a hospital chain that includes it. The term "does not include an organization with a general charitable purpose, such as to support research about or to provide treatment for certain diseases, that may give money to a covered entity." HHS explained that the foundation category was needed because tax rules may not allow such a foundation to serve as its hospital's business associate.

The Notice of Privacy Practices Statement

The first condition in section 164.514(f)(2) is a notice requirement: a covered entity "may not use or disclose protected health information for fundraising purposes" under the provision "unless a statement required by § 164.520(b)(1)(iii)(A) is included in the covered entity's notice of privacy practices."

Section 164.520(b)(1)(iii) lists activities that require a separate statement in the notice if the covered entity intends to engage in them. Paragraph (A) is fundraising: "In accordance with § 164.514(f)(1), the covered entity may contact the individual to raise funds for the covered entity and the individual has a right to opt out of receiving such communications." The right-to-opt-out clause was added in 2013. The Omnibus preamble said the notice does not have to describe the opt-out mechanism itself, because each solicitation carries one, though covered entities may include it.

The current eCFR text of the same paragraph also contains a separate item, (E), for covered entities that create or maintain substance use disorder records subject to 42 CFR part 2: if such an entity intends to use or disclose those records for fundraising for the benefit of the covered entity, "the individual must first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications." For those records, the text places the opt-out opportunity before the use, not only in each solicitation.

The Opt-Out and the 2013 Omnibus Changes

Section 13406(b) of the HITECH Act directed HHS to require a clear and conspicuous opportunity to opt out of further fundraising communications and to treat an opt-out as a revocation of authorization. The Omnibus Rule, effective March 26, 2013, implemented it in four implementation specifications now at section 164.514(f)(2)(ii) through (v):

• With each fundraising communication, the covered entity must provide a clear and conspicuous opportunity to elect not to receive further fundraising communications, by a method that does not cause the individual to incur an undue burden or more than a nominal cost
• The covered entity may not condition treatment or payment on the individual's choice about fundraising communications
• The covered entity may not make fundraising communications to an individual who has elected not to receive them
• The covered entity may provide a method for an individual who opted out to opt back in

The third item replaced the earlier standard, which required only "reasonable efforts" to avoid contacting people who had opted out. HHS kept the stricter text over comments citing mailing-list lag times and name and address variations, stating that covered entities choosing to fundraise "must have data management systems and processes in place" to flag opted-out individuals.

The preamble resolved several operational questions. Requiring an individual to write a letter is an undue burden; a pre-printed, prepaid postcard is not. Whether an opt-out covers a single campaign or all future fundraising is left to the covered entity, which must tell individuals which applies. An opt-out does not lapse with time, and a later donation does not by itself put the person back on the list. An opt-out covers all forms of fundraising communications, so a person who opts out by mail must also be removed from e-mail lists. And because the Privacy Rule applies to telephone solicitations, the opt-out requirement applies to each communication "made," not only "sent," to an individual.

HHS also drew the boundary of the whole provision. The notice and opt-out requirements "apply only where the covered entity is using or disclosing protected health information to target the fundraising communication." Its example: a covered entity that mails solicitations to every resident of a service area from a public directory is not subject to them.

Fundraising Versus Marketing

Fundraising and marketing are handled by different provisions with different consent models. Section 164.501 defines marketing as a communication "about a product or service that encourages recipients of the communication to purchase or use the product or service," with exceptions for refill reminders and certain treatment and operations communications where no financial remuneration from a third party is involved. Section 164.508(a)(3) requires a signed authorization for any use or disclosure of PHI for marketing, except a face-to-face communication or a promotional gift of nominal value, and where a third party pays the covered entity the authorization must say so.

Fundraising under section 164.514(f) needs no authorization; it needs the notice statement and the opt-out. The 2000 preamble's description of what counts as fundraising, appeals for money and event sponsorship, but not royalties or remittances from selling third parties' products, is the line between the two. A solicitation for gifts to the hospital's own campaign falls on the fundraising side; a communication encouraging the purchase of a product, particularly one a third party pays to have promoted, is analyzed as marketing.

HHS's web guidance pages on marketing and fundraising were sought for this post but returned access errors, so the description here rests on the regulation text and the two Federal Register preambles.

Frequently Asked Questions