HIPAA/marketing question


Would it violate HIPAA if a hospital foundation was provided access to a listing of the hospitals caridac rehab patients so the foundation could solicit donations from those patients for help in developoing a cardiac care center?  The solicitation would be more in the form of face-to-face meetings with selected patients rather than a direct mail campaign.


CMS has been very clear that the fund raising exception does not allow a covered entity to share any diagnostic related with a foundation.  The foundation may neither receive a list of cardiac patients nor request a list of patients broken out by diagnosis.   All that may be shared is demographic information.

Have questions? I’m here to help.