Skip to Main Navigation
Skip to Main Content
The University of Texas at Dallas

HIPAA Privacy Manual

Section 35: Marketing


Marketing means the promotion or advertisement, by UTD, of specific products or services if UTD receives, directly or indirectly, a financial incentive or remuneration for the use, access, or disclosure of PHI. Marketing does not include a communication for treatment or health care operations by a health care provider, health plan, or participants in an organized health care arrangement or their affiliated covered entities or business associates.


General Rule on Marketing: It is UTD’s policy that UTD or its personnel may not disclose, use, sell or coerce an individual to consent to the disclosure, use, or sale of PHI for marketing purposes without the consent or authorization of the patient (or surrogate decision maker) who is the subject of the PHI. Certain marketing activities, as described below, do not require UTD to obtain patient authorization for the use or disclosure of PHI.

UTD personnel shall not disclose identifiable information such as policy numbers or similar access data codes from a patient’s policy or transaction account to any non-affiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer, unless the patient has authorized the disclosure. Attached is an authorization form that must be used for marketing consents. The content of the form may not be altered because authorization forms for marketing require additional core elements, which are different from the core elements of the general Authorization forms.

Exceptions to General Rule:

UTD may use and disclose PHI for these excepted activities without obtaining an authorization from the patient:

  • Provide information on health related products and services in a face-to-face encounter with the patient;
  • Common healthcare communications, such as disease management, wellness programs, prescription refill reminders and appointment notifications;
  • Provide the patient with information on participating providers or plans in a network or alternative treatment options. (E.g. UTD notifies patient of preferred providers in its network or discusses alternative treatment option at UT Southwestern Medical Center);
  • Provide sample products to the patient; and
  • Provide marketing communication involving promotional gifts of nominal value (E.g. calendars, key chains, etc. that promotes a UTD or health care manufacturer product or service).

Rules for Written Marketing Communication From UTD:

If the marketing communication is not face-to-face but in written form, UTD must make a determination prior to sending out the marketing communication that the product or service being marketed may be beneficial to the health of the patient. In addition, UTD is required to send envelopes to the patient that has only the addresses of the sender and the recipient and must:

  • State the name and telephone number of UTD or the UTD-affiliated entity sending the marketing information,
  • Explain clearly the recipient’s right to have his/her name removed from the sender’s mailing list,
  • If UTD or UTD-affiliate for marketing purposes receives a patient’s request for removal from the mailing list, such removal must occur immediately, within FIVE days of receipt of request, and
  • UTD must explain in the communication why the patient has been targeted and how the product or service relates to their health.