What a seller can do with your information after you buy

Two documents, and only one of them is a permission

The federal health privacy rules produce two documents a buyer usually meets in the same flow. They do opposite jobs and are easy to confuse.

The first is a notice. It describes how information may be used and disclosed, and what rights you have. Acknowledging a notice is not agreeing to anything.

The second is an authorization. It is a permission slip for a specific use or disclosure that the rules would not otherwise allow.

The difference shows up later. A notice tells you what the rules already permit. An authorization is you handing over something the rules would otherwise withhold.

One scope point governs both, and it is worth stating up front. These duties run to covered entities, and the sale prohibition also to their business associates. Whether a given seller is one of those is a separate question this page does not answer.

What the notice has to contain, and where it has to be

The notice has to be written in plain language and carry a specific statement as a header, or otherwise prominently displayed. That statement says the notice describes how medical information about you may be used and disclosed, and how you can get access to it, and asks you to review it carefully.

It has to describe, with at least one example each, the types of uses and disclosures permitted for treatment, for payment and for health care operations.

It has to describe the other purposes for which information may be used or disclosed without your written authorization, in enough detail to put you on notice.

It has to describe the types of uses that do require an authorization, state that anything not described will be done only with your written authorization, and state that you may revoke one.

It has to warn that information disclosed under the rules may be redisclosed by the recipient and no longer be protected.

And it has to state your rights and briefly describe how to exercise them. Where the organization intends to contact you to raise funds, a separate statement has to tell you that, and that you may opt out.

The posting duty you can check from the outside

One requirement is unusual because you can test it without an account and without asking anyone.

A covered entity that maintains a web site providing information about its customer services or benefits has to prominently post its notice on that site, and make the notice available electronically through it.

There is a timing rule too. A covered health care provider with a direct treatment relationship has to provide the notice no later than the date of the first service delivery, including service delivered electronically.

Except in an emergency, it also has to make a good faith effort to obtain a written acknowledgment that you received the notice. Where it cannot, it has to document the effort and the reason.

That acknowledgment is what a box in a signup flow is often doing. It records receipt, and it is not consent to a use.

And electronic delivery does not cost you the paper. Someone who receives the notice electronically keeps the right to obtain a paper copy on request.

An authorization has named parts, and a missing part breaks it

A valid authorization is not a sentence in a terms page. The rules set out six core elements it must contain.

A description of the information to be used or disclosed, identifying it in a specific and meaningful fashion. The name or other specific identification of who may make the disclosure. The same for who may receive it.

A description of each purpose. An expiration date or an expiration event. And your signature and the date, with a description of authority where a personal representative signs.

Three further statements are required. That you may revoke in writing, with the exceptions and the method. Whether treatment or payment can be conditioned on your signing. And the potential for the recipient to redisclose the information outside these protections.

The document has to be in plain language, and where the organization sought the authorization it has to give you a copy.

The rules also list five defects that make an authorization invalid, including one that was not filled out completely, one known to have been revoked, and one containing material information known to be false.

The clause that stops an authorization from being a toll gate

A covered entity may not condition treatment, payment, enrollment in a health plan or eligibility for benefits on your providing an authorization.

The rule then names its own exceptions, and there are three. Research-related treatment may be conditioned on an authorization for that research.

A health plan may condition enrollment or eligibility on an authorization sought before enrollment, for its eligibility, enrollment, underwriting or risk-rating determinations.

And care provided solely to create information for disclosure to a third party may be conditioned on an authorization for that disclosure.

Reading the exceptions is the point. A permission slip for promotional messages is not on the list, which is why the required statement about conditioning exists at all.

You may revoke an authorization in writing at any time. The revocation does not reach back over action already taken in reliance on it, which is a reason to revoke early rather than eventually.

Marketing is a defined word, and a refill reminder sits just outside it

The definition is short. Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

The first carve-out is the one this market runs on. A communication to provide refill reminders, or otherwise to communicate about a drug currently being prescribed for you, is not marketing.

That carve-out carries a condition, and the condition is the interesting part. It holds only if any financial remuneration received for making the communication is reasonably related to the cost of making it.

Financial remuneration has its own definition: direct or indirect payment from or on behalf of a third party whose product or service is being described. Payment for treatment is expressly excluded.

The second carve-out covers certain treatment and health care operations communications, including care coordination and recommending alternative treatments, except where the organization is paid by a third party to make them.

So the same message can fall on either side of the line depending on who paid for it and how much. Money from a third party is the hinge, not the wording of the email.

Where a communication is marketing, an authorization is required. The only exceptions are a face-to-face communication and a promotional gift of nominal value. Where remuneration is involved, the authorization has to say so.

Selling the information is a separate prohibition with its own definition

A covered entity or business associate may not sell protected health information, except pursuant to and in compliance with an authorization meeting the sale-specific requirement.

A sale means a disclosure where the entity directly or indirectly receives remuneration from or on behalf of the recipient in exchange for the information.

The definition then excludes a list, and the exclusions are as informative as the rule. Public health disclosures. Research, where the only payment is a reasonable cost-based fee to prepare and transmit the data.

Treatment and payment purposes. The sale, transfer, merger or consolidation of the entity itself, and related due diligence. And a business associate doing work on the entity's behalf, where the only payment comes from the entity.

That merger exclusion is worth noticing. A company changing hands is a route by which records move without a sale in the regulatory sense.

Where an authorization for a sale is used, it has to state that the disclosure will result in remuneration to the entity. The document has to name the money.

The one restriction a cash-pay buyer can insist on

You may always ask an organization to restrict how your information is used or disclosed. As a general matter it does not have to agree, and the notice has to tell you that.

There is one exception, and it was written for people paying out of pocket. The organization has to agree where three things are true.

The disclosure is to a health plan. It is for the purpose of carrying out payment or health care operations, and is not otherwise required by law. And the information pertains solely to an item or service for which you, or someone other than the plan on your behalf, have paid in full.

That combination is ordinary in a cash-pay market. The restriction is the only one in the rule that an organization is obliged to grant.

It is also sturdier than the others. Where a covered entity terminates a restriction by telling you it is doing so, that route is expressly unavailable for this one.

A separate right covers how you are reached rather than what is shared. A covered health care provider has to permit requests to receive communications by alternative means or at alternative locations, and has to accommodate reasonable ones.

What to establish, and where to look for it

Whether the site posts a notice of privacy practices, and whether you can read it without an account.

Whether the box you ticked was an acknowledgment of receiving that notice, or an authorization permitting a use. The two look similar and do different things.

If it was an authorization, whether it names what is disclosed, who discloses it, who receives it, each purpose, and an expiration date or event.

Whether it says you cannot be denied treatment for refusing to sign, and whether it discloses that anyone is paying for the communication.

How to revoke in writing, and to what address, since the route matters more than the right.

Whether a request to restrict disclosure to a health plan for something you paid in full yourself has a stated channel, and whether a request for contact by alternative means does too.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. Title 45 Code of Federal Regulations Section 164.501, Definitions, including the definition of marketing and its refill-reminder exception — Electronic Code of Federal Regulations, Office of the Federal Register, January 2013
2. Title 45 Code of Federal Regulations Section 164.502, Uses and disclosures of protected health information: General rules, including the prohibition on the sale of protected health information at paragraph (a)(5)(ii) — Electronic Code of Federal Regulations, Office of the Federal Register, April 2024
3. Title 45 Code of Federal Regulations Section 164.508, Uses and disclosures for which an authorization is required, read in full including the core elements and the prohibition on conditioning — Electronic Code of Federal Regulations, Office of the Federal Register, January 2013
4. Title 45 Code of Federal Regulations Section 164.520, Notice of privacy practices for protected health information, including the content requirements and the web site posting duty — Electronic Code of Federal Regulations, Office of the Federal Register, April 2024
5. Title 45 Code of Federal Regulations Section 164.522, Rights to request privacy protection for protected health information — Electronic Code of Federal Regulations, Office of the Federal Register, January 2013