HIPS Series > Privacy Issues for Marketers > Quiz + Answers

•  •  •  •  •

1. Patients regularly ask the staff at Better Samaritan Hospital about the providers in the BSH preferred provider network, about benefits coverage under alternative plans, and the like. Is providing this sort of information considered marketing under HIPAA?

A. Yes, because any recommendation of particular coverage or a particular provider for a person affects the money that Better Samaritan gets for providing services.

B. No, because questions about benefits, providers, etc., are excluded from the definition of marketing.

C. Maybe. It depends on whether there is remuneration for making particular recommendations.

D. HIPAA regulations do not address this issue.

B is correct. These things qualify as "not marketing" under HIPAA. Your state's statutes may not grant the same exceptions, however.

•  •  •  •  •

2. Physicians at Better Samaritan, like those everywhere else, are routinely asked about alternative treatments for conditions -- such as drugs that their patients have seen in advertisements on TV or in the newspaper. Is the discussion of such options marketing?

A. Yes, because the question is prompted by commercial advertisements.

B. No, because the question relates to the patient's treatment.

C. Maybe. It depends on whether or not the physician or hospital receives any remuneration from the companies that make the products in question.

D. HIPAA regulations do not discuss this issue.

B is again correct. Treatment-related information is "not marketing" under HIPAA.

•  •  •  •  •

3. Some physicians at Better Samaritan Hospital receive remuneration from pharmaceutical companies for prescribing the latters' most profitable drugs. Does this sort of practice require a marketing authorization or a disclosure of the payment arrangement to the patient?

A. No. The marketing definition specifically excludes communications for the individual's treatment and for case management, care coordination or the recommendation of alternative therapies, regardless of whether there is remuneration.

B. No. But it may be a good idea to disclose the arrangement to the patient anyway.

C. No authorization is required, but disclosure is required.

D. Both authorization and disclosure are required.

A is legally correct. We think B is the better answer, ethically. For this practice, it's anti-kickback statutes that one needs to worry about, not health privacy laws.

•  •  •  •  •

4. Better Samaritan plans to sell lists of its patients to pharmaceutical companies, so that the latter can directly market particular drugs to its patients with particular diagnoses. Does this practice require a marketing authorization?

A. Yes, because it is a disclosure to a third party, for remuneration, with the aim of marketing the latter's products.

B. No, because it is related to the patients' treatment, and everything related to treatment is exempt.

C. This would be permitted if there were a business associate contracts in place between the hospital and the pharmaceutical companies.

D. It depends on how much the pharmaceutical companies are paying. If the compensation is "nominal" there is no need for an authorization.

A is correct. Disclosures for a third-party's marketing efforts always require authorization. Such efforts do no qualify for the "treatment" exemption. It doesn't matter is the reimbursement is "nominal."

•  •  •  •  •

5. Better Samaritan is considering launching a series of newsletters and other communications, such as mailings reminding women to get an annual mammogram, providing information about how to lower cholesterol, about new developments in health care (e.g., new diagnostic tools), about health or "wellness" classes, about support groups, and so forth. Does it need an authorization for this?

A. You bet it does. This is clearly marketing.

B. It may have the same effect as marketing -- namely, increasing Better Samaritan's business -- but this sort of general communication requires no authorization.

C. It is permitted as an exception to marketing, only if an "opt-out" letter is sent in advance.

D. The regulations do not address this kind of communication.

B is correct. This qualifies as "not marketing" -- at least from HIPAA's perspective. (Your state's statutes may have a different view.) An opt-out is not required, because it's "not marketing" -- but it would be a good idea to include one anway.

•  •  •  •  •