DHHS POLICIES AND PROCEDURES

________________________________________________________________________________________________________________________

Section VIII:	Privacy and Security
Title:	Privacy Manual
Chapter	Use and Disclosure, Marketing and Fundraising
Current Effective Date:	5/1/05
Revision History:	2/19/04
Original Effective Date:	4/14/03

________________________________________________________________________________________________________________________

Purpose

The purpose of this policy is to set forth the requirements of the North Carolina Department of Health and Human Services (NC DHHS) regarding the disclosure of individually identifiable health information for purposes of marketing or fundraising activities.

This policy shall apply to any of the following DHHS agencies:

• The Health Insurance Portability and Accountability Act (HIPAA) covered health care components and
• Internal business associates.

Background

‘Marketing’ is defined as a communication about a product or a service, the purpose of which is to encourage clients to purchase or use the product or service. The following are examples of communications that are NOT considered marketing:

• Describing a product or service provided by the agency;
• Reviewing treatment with a client;
• Discussing case management or coordination of care; and
• Recommending alternative treatments.

‘Fundraising’ is defined as an organized activity of raising funds for an agency cause, including appeals for money and sponsorship of events.

Policy

DHHS agencies shall not disclose individually identifiable health information about clients without authorization for marketing or fundraising purposes. Such authorization must include the specific reason for using the client’s information.

Marketing

Agencies shall not disclose, sell, or coerce a client to permit disclosure of individually identifiable health information for marketing purposes without the authorization of the client who is the subject of the confidential information or the client’s personal representative. This prohibition includes the disclosure, use, or selling of prescription drug patterns.

Exception: DHHS agencies must obtain an authorization for marketing except when the communication is in the form of:

• Face-to-face communication made by an agency to a client or
• Promotional gift of nominal value provided by DHHS.

This provision allows agencies to discuss products or services as well as provide sample products without restriction.

The health care services listed below are common communications that a client generally expects to receive as part of his/her continued health care services and are not considered marketing.

• Disease management
• Wellness programs
• Prescription refill reminders
• Appointment reminders

Fundraising

Agencies performing fundraising activities, including appeals for money and sponsorship of events, may internally use only dates of treatment and demographic information, unless the client or the client’s personal representative gives authorization for more expansive use of the client’s individually identifiable health information. Demographic information that may be disclosed without authorization typically includes:

• Name;
• Address;
• Other contact information;
• Age;
• Gender; and
• Insurance status.

Disease-related information such as diagnosis may not be used in fundraising. In addition, information about the component from which a client received services also cannot be used for fundraising purposes without the client’s authorization if that information could reveal the nature of the diagnosis, service, or treatment the client received.

Agencies that allow clients to participate in fund-raising activities (e.g., raffle to raise funds to help pay for an off campus trip for a patient care unit) must ensure that the client’s participation is voluntary. For incompetent clients, authorization from the client’s guardian is required before the client can participate in such fund-raising activities.

Agencies may disclose a client’s dates of treatment and demographic information for fundraising purposes without the client’s authorization only as follows:

• To a covered health care component’s business associate, pursuant to a business associate agreement;
• To an agency-related foundation, unless prohibited by law;
• The agency has included in their “Notice of Privacy Practices” that a client’s individually identifiable health information may be used or disclosed for fundraising purposes;
• When clients are sent fundraising materials that include a description of how the client may opt-out from receiving any further fundraising communications; and
• Reasonable efforts have been made to ensure that clients who decide to opt-out from receiving future fundraising materials are not sent any materials from that point forward.

Implementation

DHHS agencies that are engaged in marketing or fundraising activities must ensure that the requirements listed below are met.

1. Authorizations
   An authorization for the purposes of marketing and fundraising must meet the requirements listed below.



• The authorization states that the purpose of the disclosure is for marketing or fundraising activities.
• The authorization denotes whether the individual's health information will be disclosed to a third party.

(Refer to the DHHS Privacy Policy, Use and Disclosures Policies, Authorizations for requirements for DHHS Authorization.)

2. Notice of Privacy Practices
   Agencies shall include in their Notices of Privacy Practices a statement explaining that client individually identifiable health information may be disclosed for marketing or fundraising purposes.
   
   (Refer to the DHHS Privacy Policy Client Rights Policies, Notice of Privacy Practices.)



3. Fundraising Materials
   Fundraising materials must describe how an individual may opt-out of receiving any further fundraising communications. Covered health care components must document a process for fulfilling those requests.



4. Business Associate Agreements
   Agencies may enlist a third party to assist with marketing and fund raising. However, before disclosing individually identifiable health information to a third party, agencies must ensure that a Business Associate Addendum or a Memorandum of Understanding (MOU) addendum has been executed and attached to the DHHS contract or MOU.
   
   (Refer to the DHHS Privacy Policy Administrative Policies, Business Associates (Internal/External).)

Reference:

DHHS Directive No. III-11; 45 CFR 160.103; and 42 CFR; NC General Statute 58-39-75

For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the DHHS Policy Coordinator.