Fundraising, Marketing, Informational Newsletter Summary Chart
Fundraising, Marketing & Informational Newsletter Guideline Chart
| Fundraising Communication | Marketing Communication | Informational Newsletter | |
|---|---|---|---|
| Definition | Communication to an individual by a covered entity (or the entity's business associate or institutionally related foundation) for the purposes of raising funds for the covered entity. | Communication to an individual by a covered entity (or the entity’s business associate) about a product or service that encourages recipients of the communication to purchase or use the product or service. | Communication to an individual by a covered entity for general informational purposes that is NOT intended to either (1) raise funds (fundraising activities) or (2) encourage purchase or use of product or service (marketing activities) of the covered entity. |
| HIPAA Authorization Required? | Maybe. Access, use or disclosure to business associate (or institutionally related foundation) is permitted for limited PHI, including demographic information. For full list of PHI that may be disclosed to BA/IRF, review: Uses and Disclosures of PHI for Fundraising Purposes Policy. Access, use or disclosures of PHI beyond that which is listed in the Uses and Disclosures of PHI for Fundraising Purposes Policy requires written patient authorization. | Yes, if the covered entity receives financial remuneration from a third party whose product or service is being marketed. | No, as long as the communication is an informational newsletter or mailer for informational purposes only. |
| HIPAA Business Associate Agreement Required? | Yes, if a covered entity contracts with a third party to perform services (e.g., distribute fundraising materials) on behalf of the covered entity and the third-party will create, receive, transmit, access, or store PHI to perform those services, then a BAA must be obtained. | Yes, if a covered entity contracts with a third party to perform services (e.g., distribute marketing materials) on behalf of the covered entity and the third-party will create, receive, transmit, access, or store PHI to perform those services, then a BAA must be obtained. | Yes, if a covered entity contracts with a third party to perform services (e.g., distribute informational newsletters) on behalf of the covered entity and the third-party will create, receive, transmit, access, or store PHI to perform those services, then a BAA must be obtained. |
| Other Requirements | All fundraising communications must include clear and conspicuous instructions, in “plain language,” on how an individual may opt-out from receiving fundraising communications from the UNC SOM. See Uses and Disclosures of PHI for Fundraising Purposes Policy. | If the communication is a health-based marketing communication and you do not have patient authorization, you must include appropriate language describing how the product or services relate to the health of the individual targeted. See Uses and Disclosures of PHI for Marketing Policy. | Informational newsletters that are sent to individuals, whether by mail or electronic means, should include unsubscribe options for recipients, but need not include fundraising opt-out language, as long as the purpose of the newsletter is not to raise funds for the covered entity. |
| Examples | Includes solicitations for donations or gifts, sponsorship of events, and communications for events or activities held to raise funds for the covered entity | Includes communications to promote a particular product or service and for which the covered entity receives financial remuneration from a third party whose product or service is being marketed | Departmental informational newsletters that do not include solicitations for donations or gifts or events/activities to help raise funds for the covered entity. Communications promoting health in general and that do not promote a product or service from a particular provider, such as communications promoting a healthy diet or encouraging individuals to get certain routine diagnostic tests, do not constitute marketing and do not require individual authorization |
Fundraising_Marketing_Newsletter_Guidelines_Summary