The Marketing Email That Looked Like a Reminder
A regional orthopedic group wants to grow its sports-medicine line. Its marketing vendor drafts an email to 4,000 patients who had a knee or shoulder procedure in the past 18 months. The email promotes a new 'premium recovery program' that includes concierge scheduling and a $99 monthly fee, and it names the patient's procedure type ('Since your ACL repair...'). The vendor will send it from the practice's domain. The practice's privacy officer is asked to approve it the day before send. The practice has a signed business associate agreement with the vendor covering 'marketing support services.' No patient authorizations have been collected. The practice's Notice of Privacy Practices says it may contact patients about 'treatment alternatives and health-related benefits.'
1. Is this communication permitted under the Privacy Rule? Analyze whether it is treatment, payment, operations, or marketing.
Read the worked answer
This is marketing, not treatment or operations, and the analysis turns on the definition in §164.501.
- A communication is marketing if it encourages a recipient to purchase a product or service, unless it is about the recipient's own treatment, is a treatment-alternatives communication made face-to-face or involving a promotional gift of nominal value, or is a refill reminder/general health promotion not tied to a product.
- The email is financial in nature - it promotes a paid program with a monthly fee. That is the classic marker of marketing rather than treatment communication.
- The 'treatment alternatives' language in the NPP does not save it. Communications about treatment alternatives must be made face-to-face or involve a nominal-value gift to fall outside the marketing definition. An email blast to 4,000 people is neither.
Because it is marketing, written authorization is required before sending. The practice has none. Approving the send would be an impermissible use of PHI.
2. The vendor argues the BAA covers this. Explain why the BAA does not authorize the communication, and identify the separate problem with the email content.
Read the worked answer
The BAA is not a permission slip. A BAA governs how a business associate may use and disclose PHI on the covered entity's behalf and requires the BA to comply with the Privacy Rule's restrictions. It cannot expand the covered entity's own authority to use PHI. If the underlying use is impermissible, the BAA does not launder it - the BA is simply doing an impermissible thing at the CE's direction. A BAA scoped to 'marketing support services' is also too vague to authorize patient-identifiable targeting; the practice should confirm the BA is not making its own independent use of the list.
The content problem is separate and serious. Naming the patient's procedure ('Since your ACL repair...') puts PHI into the body of an email. Even with a valid authorization, the practice must consider whether the channel is appropriate and whether the authorization is specific enough. Without authorization, it is an outright impermissible disclosure. The combination - PHI in the message plus a commercial pitch plus no authorization - is the worst case for the practice.
3. Assuming the practice wants to proceed, what would a compliant path look like?
Read the worked answer
A workable path:
- Obtain valid authorizations. Under §164.508, marketing authorizations must be specific, plain-language, and must state that the practice receives remuneration for the communication (if it does). The authorization must be separate from other consents and cannot be a condition of treatment.
- Reduce PHI exposure. Do not put procedure type in the subject line or body unless the authorization specifically covers it. A generic message with a secure portal link is lower risk.
- Fix the NPP. The current NPP language about 'treatment alternatives' does not describe marketing uses; it should be accurate about what the practice actually does.
- Re-scope the BAA to describe the marketing activity and the permitted uses.
- Document the approval decision and the legal basis, because the privacy officer's sign-off is the record that will be examined later.
If the practice cannot get authorizations before send, the correct answer is do not send. A one-day deadline is a scheduling problem, not a legal excuse.