Can contractors (business associates) use PHI to market to individuals for their own business purposes?
No. While covered entities may share PHI with their contractors who meet the definition of “business associates” under the HIPAA Privacy Rule, that definition is limited to contractors that obtain PHI to perform or assist in the performance of certain health care operations on behalf of covered entities. Thus, business associates, with limited exceptions, cannot use PHI for their own purposes. Although, under the HIPAA statute, the Privacy Rule cannot govern contractors directly, the Rule does set clear parameters for how covered entities may contract with business associates. Further, the Privacy Rule expressly prohibits health plans and covered health care providers from selling PHI to third parties for the third party’s own marketing activities, without authorization.
Related Questions
- Can contractors (business associates) use protected health information to market to individuals for their own business purposes?
- Can contractors (business associates) use PHI to market to individuals for their own business purposes?
- Can contractors (business associates) use protected health information for its own marketing purposes?
