When Do You Need a HIPAA Marketing Authorization From Patients?

The Department of Health and Human Services (HHS) Office for Civil Rights released the Health Insurance Portability and Accountability Act (HIPAA) Final Rule on January 25, 2013 with an effective date of March 26, 2013. Covered entities and business associates, including audiologists who are covered entities must come into compliance with the new requirements of the Final Rule by September 23, 2013. The Final Rule provides individuals with new rights to their health information and strengthens the government

The Academy has received an increasing number of questions about the definition of marketing and under what circumstances an audiologist or audiology practice would be required to obtain a marketing authorization from patients under the HIPAA Final Rule.Given the current health care environment and the emphasis on coordination of care and navigation of the health care delivery system, we wanted to to “demystify” the HIPAA rule changes, especially those related to marketing. For example, treatment under HIPAA, which includes care coordination activities, does not require an authorization. Face-to-face communication with your patients, even if “marketing” under the HIPAA rule, does not require an authorization.

The definition of marketing is broad and includes a number of exceptions.Several of the exceptions are likely to be applicable to the activities that audiologists engage in with their patients as part of the regular course of patient care. The Academy has sought the advice of legal counsel to discuss these HIPAA changes in detail and to develop a HIPAA Marketing Requirements Decision Tree that will assist you in determining whether you need patient authorization under HIPAA based on your particular type of communication.

Audiology Marketing Authorization Questions and Answers

Below is a sampling of questions that the Academy has received from members:

One of the most important things to understand about HIPAA when it comes to marketing is that what many audiologists consider to be marketing may not fall under the definition of marketing under HIPAA. One of the very first steps in your analysis must be to determine if a specific activity is considered marketing under HIPAA. If yes, patient authorization is generally required; however, if not, patient authorization is not required in most circumstances. The HIPAA Marketing Requirements Decision Tree should help you analyze common audiology practice activities to determine whether or not patient authorization is required under the Final Rule for HIPAA. It is always advisable to seek the opinion of legal counsel and to also complete a risk analysis for your practice.

Kathy Foltner, AuD, is the Academy past chair of the Practice Compliance Committee and vice president sales, Hearing Care, Sikka Software.

Sharmila Sandhu, Esq., is the Academy Director of Regulatory Affairs.

*This article and Decision Tree were developed with the advice and review of Sarah E. Swank, Esq., a Principal from the law firm of Ober|Kaler.