Download Marketing Standard

Information Privacy and
Security Program
Title:
MARKETING STANDARD
I.
No.
Page:
Effective Date:
Retires Policy Dated:
Previous Versions Dated
EC.PS.02.05
1 of 4
04-04-16
09-16-13
04-13-03
PURPOSE:
The purpose of this Standard is to facilitate compliance with requirements of the Health
Insurance Portability and Accountability Act (HIPAA) Standards for Privacy of Individually
Identifiable Health Information, (Privacy Standards) that relate to uses and disclosures of
protected health information (PHI) for marketing purposes.
II.
DEFINITIONS:
A.
“Financial Remuneration” means direct or indirect payment from or on behalf
of a third party whose product or service is being described. Direct or indirect
remuneration does not include any payment for treatment of an individual.
B.
“Highly Confidential Information” means the subset of PHI that: (1) is
maintained in psychotherapy notes; (2) is about mental illness, mental retardation
and developmental disabilities; (3) is about alcohol or drug abuse or addiction; (4)
is about HIV/AIDS testing, diagnosis or treatment; (5) is about communicable
disease(s), including venereal disease(s); (6) is about genetic testing; (7) is about
child abuse and neglect; (8) is about domestic abuse of an adult; or (9) is about
sexual assault.
C.
“Marketing” means a communication about a product or service that encourages
recipients of the communication to purchase or use the product or service other
than those defined in the Non-Marketing section below.
D.
“Non-Marketing” means a communication about a product or service that
encourages recipients of the communication to purchase or use the product or
service and the communication is:
1.
To provide refill reminders or otherwise communicate about a drug or
biologic that is currently being prescribed for the individual, provided that
any financial remuneration received by the Tenet Facility in exchange for
making the communication is reasonably related to the Tenet Facility’s
cost of making the communication;
2.
For the following Treatment and Health Care Operation purposes,
provided the Tenet Facility receives no financial remuneration for making
the communication:
a.
For treatment of an individual by a health care provider, including
case management or care coordination for the individual, or to
direct or recommend alternative treatment, therapies, health care
providers, or settings of care to the individual;
Information Privacy and
Security Program
Title:
MARKETING STANDARD
E.
III.
No.
Page:
Effective Date:
Retires Policy Dated:
Previous Versions Dated
EC.PS.02.05
2 of 4
04-04-16
09-16-13
04-13-03
b.
To describe a health-related product or service (or Payment for
such product or service) that is provided by, or included in a plan
of benefits of, the covered entity making the communication,
including communications about: the entities participating in a
Health Plan network; replacement of, or enhancements to, a Health
Plan; and health-related products or services available only to a
Health Plan enrollee and add value to, but are not part of, a plan of
benefits; or
c.
For case management or care coordination for the patient, or to
direct or recommend alternative Treatments, therapies, Health Care
Providers, or settings of care to the patient.
Additional capitalized terms used herein are defined in the Information Privacy &
Security Glossary of Definitions.
STANDARD:
Tenet obtains a patient’s authorization before using or disclosing the patient’s PHI for Marketing
unless an exception exists under this standard. Under no circumstances may Tenet use or
disclose Highly Confidential Information for Marketing purposes unless otherwise permitted by
law or the patient’s signed Authorization Form.
A.
Authorization must be obtained from a patient or the patient’s Personal
Representative for any use or disclosure of PHI for marketing, except for
communication in the form of:
1.
A face-to-face communication made by a member of the facility
workforce to an individual; or
2.
A promotional gift (e.g., infant formula) of nominal value provided by the
facility.
3.
A communication regarding a prescription drug, provided that any
financial remuneration received is “reasonably related” to the Tenet
Facility’s cost of making the communication
B.
If the Marketing involves direct or indirect remuneration to the facility from a
third party, the authorization must state that such remuneration is involved.
C.
Facilities may conduct Non-Marketing activities without patient authorization,
including communicating to patients via newsletters, mailings or other means
regarding treatment options, health related information, disease-management
programs, wellness programs, or other community-based initiatives or activities in
which the facility is participating.
Information Privacy and
Security Program
Title:
MARKETING STANDARD
D.
IV.
No.
Page:
Effective Date:
Retires Policy Dated:
Previous Versions Dated
EC.PS.02.05
3 of 4
04-04-16
09-16-13
04-13-03
All documentation for marketing shall be maintained in accordance with
Administrative policy AD 1.11 Records Management and its Record Retention
Schedule.
IMPLEMENTATION:
A.
B.
Tenet Facility WITHOUT Regional Privacy Officer
1.
The Tenet Facility Compliance Officer, Tenet Facility Information
Security Officer, Tenet Facility Compliance Committee, and Tenet
Facility Leadership are responsible for distribution and oversight of
Information Privacy and Security Program (the “Program”) Standards at
the facility level.
2.
Tenet Facility Leadership will:
a.
Adopt this standard and where necessary develop specific written
procedures in order for the Tenet Facility to operationalize this
standard;
b.
Develop appropriate methods to monitor adherence to the written
procedures; and
c.
Report monitoring activity to the Tenet Facility Compliance
Officer.
Tenet Facility WITH Regional Privacy Officer
1.
The Regional Privacy Officer, Tenet Facility Information Security Officer,
Tenet Facility Compliance Committee, and Tenet Facility Leadership are
responsible for distribution and oversight of Program Standards at the
facility level.
2.
Tenet Facility Leadership will:
a.
Adopt this standard and where necessary develop specific
written procedures in order for the Tenet Facility to
operationalize this standard;
b.
Develop appropriate methods to monitor adherence to the
written procedures; and
c.
Report monitoring activity to the Regional Privacy Officer;
Information Privacy and
Security Program
Title:
MARKETING STANDARD
C.
V.
No.
Page:
Effective Date:
Retires Policy Dated:
Previous Versions Dated
EC.PS.02.05
4 of 4
04-04-16
09-16-13
04-13-03
Home Office/Region/Market
1.
Tenet’s Information Privacy/Security Office will work with the Regional
Privacy Officers, Tenet Facility Compliance Officers, Tenet Facility
Information Security Officers, Tenet Facility PIRTs, Tenet Compliance
Committees, and Tenet Facility Leadership to develop, maintain, and
update procedures and standards for protecting the privacy of PHI and
other Confidential/Proprietary information, and affording patients their
rights with respect to their PHI.
2.
Home Office and Region/Market Offices must incorporate these standards
into their specific policies and procedures where necessary.
REFERENCES:
- EC.PS.02.00 Patient Information Privacy Policy
- Information Privacy & Security Glossary of Definitions
- OCR Privacy Rule Guidance, Marketing
- Administrative policy AD 1.11 Records Management and its Record Retention Schedule