Can contractors (business associates) use protected health information for its own marketing purposes?
No. While covered entities may share protected health information with their contractors who meet the definition of “business associates” under the HIPAA Privacy Rule, that definition is limited to contractors that obtain protected health information to perform or assist in the performance of certain health care operations on behalf of covered entities. Thus, business associates, with limited exceptions, cannot use protected health information for their own purposes. Although, under the HIPAA statute, the Privacy Rule cannot govern contractors directly, the Rule does set clear parameters for how covered entities may contract with business associates. See 45 CFR 164.502(e) and 164.504(e), and the definition of “business associate” at 45 CFR 160.103. Further, the Privacy Rule expressly prohibits health plans and covered health care providers from selling protected health information to third parties for the third partys own marketing activities, without authorization. So, for example, a
Related Questions
- Can contractors (business associates) use protected health information to market to individuals for their own business purposes?
- Can contractors (business associates) use PHI to market to individuals for their own business purposes?
- Can contractors (business associates) use protected health information for its own marketing purposes?
