Would it violate HIPAA if a hospital foundation was provided access to a listing of the hospitals caridac rehab patients so the foundation could solicit donations from those patients for help in developoing a cardiac care center? The solicitation would be more in the form of face-to-face meetings with selected patients rather than a direct mail campaign.
CMS has been very clear that the fund raising exception does not allow a covered entity to share any diagnostic related with a foundation. The foundation may neither receive a list of cardiac patients nor request a list of patients broken out by diagnosis. All that may be shared is demographic information.
