SESK: Stuff Everyone Should Know · sesk.info/hipaa-auth-marketing
A drug company pays a clinic to mail its patients ads for a new product. What does the clinic need?
Each patient's authorization, saying payment is involved.
- Each patient's written authorization ✔
- Nothing, it counts as operations
- Only an opt-out notice in the mailer
Why: Using PHI for marketing needs the patient's authorization. When a third party pays the covered entity, the authorization must say so.
Huh, didn't know that: A covered entity's own face-to-face conversation with a patient about a product needs no authorization.
What did the mailbox say to the letter? Nice to meet you, I'll be in touch.
Like this card?
References
Answer: Each patient's written authorization. Using PHI for marketing needs the patient's authorization. When a third party pays the covered entity, the authorization must say so.
- 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing
Checked 2026-10-10. - 45 CFR 164.508 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
A face-to-face communication made by a covered entity to an individual; or (B) A promotional gift of nominal value
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Work SkillsWhat does a covered entity generally need before disclosing a patient's psychotherapy notes?Work SkillsWhich of these is NOT part of a patient's psychotherapy notes under HIPAA?Work SkillsIs a pharmacy's refill reminder about a drug a patient is currently prescribed considered marketing under HIPAA?
That's stuff everyone should know.