AMARILLO, TX – The second the prospect of a marketing or cross-promotional arrangement is brought to the attention of a regular reader of the articles featured in Medtrade Monday, they might, reflexively and almost involuntarily, respond that the proposed arrangement needs to be reviewed for compliance with the Anti-Kickback Statute. This is a healthy reaction and you should be proud of your keen instincts.
However, with the rise of tracking technology and internet-based marketing, the opportunities for Protected Health Information (PHI) to be inadvertently implicated in these types of agreements have skyrocketed, and it is not always readily apparent that a use or disclosure of PHI is even in play.
Under HIPAA, marketing is defined as making “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” HIPAA prohibits the use or disclosure of PHI for marketing purposes. However, HIPAA also excepts certain common behaviors (which are often otherwise permissible as “Treatment, Payment, Operations”, or “TPO”) from the definition of marketing where no remuneration is involved.
Let’s go over what you can do first:
- You can reach out to your own patients to promote your own product or service. E.g. You can announce a new location, inform patients of additional services that you provide, or advise them of your other product offerings. As a rule, these should be general distribution communications – not targeted to specific individuals.
- You can always communicate with your own patients about their individual treatment, such as sending resupply reminders, appointment reminders, and corresponding with them about their individual care.
- You can share an individual’s PHI with others when it is necessary for case management or care coordination for that individual, or to recommend alternative treatments, therapies, health care providers, or settings of care to that individual in a manner that falls under a permissible TPO purpose.
- General health and wellbeing newsletters that do not promote any product or service. An example of this could include providing general information about diet and exercise for the patient population you serve – so long as no specific products or services are promoted alongside this informational newsletter.
In addition to the above, there are two activities which are considered marketing under HIPAA, but are expressly permitted without the need to obtain a signed marketing authorization as long as no remuneration is involved. Under these allowances:
- You can provide your patients with a promotional gift of nominal value for purposes of promoting your or another entity’s products or services– such as tote bags, notepads, or pens.
- You can talk to your patients about any product or service in a manner that encourages them to purchase or use the product or service – but only if the communication is made face-to-face.
Finally, even these activities are still subject to other state and federal laws and other aspects of HIPAA. Under CAN-SPAM, in order to send that benign newsletter or an announcement regarding your new product line, the patient must provide “opt-in” consent to receive emails that do not relate directly to their individual care, and such emails must provide an unsubscribe option.
Under the Telephone Consumer Protection Act (TCPA), auto-dialed text messages must have similar opt-in consent and unsubscribe options. Several states, including Texas, require an affirmative opt-in for any email communications made by healthcare providers, even for purposes of treatment, and Texas also has more stringent marketing rules contained in the Texas Medical Privacy Act (TMPA) – placing additional restrictions on both marketing generally and specific requirements for physical mailers. Assuming these other state and federal laws have been satisfied, a HIPAA-compliant email marketing platform should still be used to comply with HIPAA security standards for the use of the patient’s email address, which is also PHI.
The nature of PHI itself has also changed. HHS guidance regarding tracking technologies and subsequent case-law tells us that information collected via tracking pixels, cookies, and other standard website tools on the websites of Covered Entities are also PHI when they are collected in relation to activities like appointment-booking, product-ordering, and portal use. Advertising that utilizes information collected during these activities, or even performed in association with these activities (such as targeted advertising, pop-ups, product offers, and other forms of promotion) must therefore be scrutinized under the HIPAA Marketing Rule. Furthermore, any tracker that communicates information to a third party regarding this individual’s activity, including Google Analytics or Meta Pixel, may be an impermissible disclosure of PHI, absent a signed marketing authorization.
For DME Suppliers, who often rely on web-based advertising and cross-promotion, the HIPAA Marketing Rule often feels like a straitjacket. However, there is at least one option available to those Covered Entities that wish to have the full breadth of FTC-compliant marketing at their fingertips – They may ask patients for a marketing authorization as part of their intake process. This authorization must:
- Include a disclosure that PHI will be used for marketing purposes;
- Include a disclosure that the Covered Entity is receiving remuneration – which may include in-kind remuneration (such as cross-promotion), if applicable; and
- Seek consent for selling PHI if the Covered Entity intends to disclose PHI to another entity in return for payment.
In addition to the elements above, the authorization must meet all of the other required elements of a standard HIPAA authorization – including (among others) the right to revoke and a statement that the availability of treatment cannot be conditioned upon execution of the authorization. That is, the authorization must be optional and not prejudice access to care. Though HIPAA does not allow for a simple checkbox consent, many user friendly consent-management tools now exist to help obtain the required signature, which may be electronic.
After considering all of the above – don’t forget to do your Anti-Kickback analysis.
Jeffrey S. Baird, Esq., is chairman of the Healthcare Group at Brown & Fortunato, a law firm with a national health care practice based in Texas. He represents pharmacies, infusion companies, HME companies, manufacturers, and other health care providers throughout the United States. Baird is Board Certified in Health Law by the Texas Board of Legal Specialization and can be reached at (806) 345-6320 or [email protected].
Amanda F. Hobbs, Esq. is a shareholder with the Healthcare Group at Brown & Fortunato and an CIPP-US certified privacy professional. Hobbs represents hospitals, ASCs, physician groups, HME companies, and other healthcare organizations across the United States and can be reached at (806) 345-6312 or [email protected].
AAHOMECARE’S EDUCATIONAL WEBINAR
Loan Closets, Employee Liaisons, and Other Arrangements with Referral Sources
Presented by: Jeffrey S. Baird, Esq., Brown & Fortunato & Noel Neil, ACU-Serve
Tuesday, November 10, 2026
1:30-2:30 p.m. CENTRAL TIME
In the non-health care world, businesses (e.g., auto parts stores) have very few restrictions regarding their relationships with referral sources. By contrast, the health care world is a totally different animal. Because a large portion of a DME supplier’s revenue is derived directly (or indirectly) from tax dollars, there are myriad federal and state laws designed to protect the tax dollars from fraud. Many of these laws focus on relationships health care providers have with physicians, hospitals, and other referral sources. This program will discuss such relationships between DME suppliers and referral sources. These arrangements include (i) loan closets (also known as consignment closets and stock and bill arrangements), (ii) employee liaisons, (iii) Medical Director Agreements, (iv) physician advisory boards, (v) preferred provider agreements, (vi) patient service agreements, (vii) marketing service arrangements, and (viii) subcontract agreements. The program will discuss how these relationships can be legally entered into…and pitfalls that need to be avoided.
Register for Loan Closets, Employee Liaisons, and Other Arrangements with Referral Sources on Tuesday, November 10, 2026, 1:30-2:30 p.m. CT, with Jeffrey S. Baird, Esq. and Noel Neil.