Are you "marketing" or marketing? A HIPAA fine print review

Back in July, we wrote about HIPAA and HITECH compliance as it relates to automatic patient communications, and discussed how software tools like RevenueWell adhere to these regulations. This month, as the September 23rd deadline for compliance to the March 26th Omnibus rule is upon us, we're being asked whether these more recent changes to the law affect the ability to market to one's patient base, and if so, how.

First off, you'll be happy to know that despite the thoroughness of the 138 page final rule, the 2013 amendments to the HIPAA rules under the HITECH Act are very straightforward with regard to patient communications, and really revolve around one simple concern: are you “marketing” to your patients or just marketing to them? If you’re wondering about the goofy punctuation, please know that this is the whole point. You may think you’re marketing to your patient base using patient communication software, but you’re really not – at least as far as the regulators are concerned. Let us explain.

First, the definition.

The Privacy Rule requires covered entities to obtain a valid authorization from individuals before using or disclosing protected health information to market a product or service to them (78 FR 5592).Title 45 of the Code of Federal Regulations, section 164.501 defines “marketing” as “making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” As you might imagine, this rather straightforward definition of marketing isn't all that straightforward when have a business to run. After all, depending on the person considering the definition, just about any type of messaging from a dental office to a patient could be considered “marketing.” To make things easier (and to allow patient communication to continue unencumbered by federal regulation), the law outlines several specific types of communications that are excepted from this definition.

The exceptions

For the most part, the exceptions cover everything you can do with an automated dental practice marketing solution like RevenueWell. This includes messaging related to treatment plans, alternatives to treatment, new services, additional benefits, and case management services. In other words, these are the communications you wouldn't think twice to send out, and that many of you have been doing already in one form or another for some time now. However, there is always that moment in legal discourse ...

When everything gets flipped upside-down

And, as you might imagine, that moment usually involves money. In this case, the government believes that monetary influence changes the intent of the message, so the moment a covered entity or their business associate receives any third-party “financial remuneration” to send these or other messages to their patients, these messages are no longer exempt from the marketing definition, and would thus require permission from the recipient.

The good news

This whole “financial remuneration for marketing” concept doesn’t get a lot of play in a typical dental office. For you to be in conflict with the law, you’d have to, for example, get paid by an oral cancer screening device manufacturer to send their brochure to all of your middle-aged patients who smoke. If you sent the brochure (or an email campaign) without getting compensated, just because you believe that these high-risk patients should be screened, then you’re in the clear. This same logic applies to all other patient communications you may put out there yourself or using RevenueWell, no matter how marketing-ish and promotional they may seem. So market away.

P.S. If you're at all interested in reading the full 138 page treatise, it can be located at the Office of the Federal Register, and is awaiting your curious attention!