Last winter, I came across the following question (paraphrased):
"I provide a lead gen service and work with a doctor who has requested we include prospective patient's names in the email subject lines of our leads. As all of our forms go through a vault, we require our clients to log into the CRM to get the information. The doctor doesn't care and I told him he would need to sign something taking full responsibility."
I answered:
Wow, HIPAA violations galore on this. First of all, don't think about it as specifically as email subject lines, it's much more high level than that. To summarize the biggest points, YOU shouldn't be seeing their names at all (sort of hard to avoid when you're the one managing the emails), and marketing emails don't fall under any of the permitted uses of PHI (personal health information).
Start here, then read the linked PDF fact sheets at the bottom of the page.
To go into more detail, from my understanding, you can't even perform this service for him because to even have access to patient PHI:
- You need to be a HIPAA covered entity (CE). You might be, but I'm assuming you're not, because that's rare for agencies (I've looked into it myself)
- If you are a CE, to be a Business Associate (BA), you need to sign a Business Associate Agreement (BAA)
- The doctor would need to disclose this usage to patients. ("permitted uses and disclosures must be addressed in a covered entity’s Notice of Privacy Practices.")
And even if you did somehow meet all that criteria, again, this doesn't fall into HIPAA's definition of "health care operations," which, according to the first PDF linked on that page, include the following:
- Conducting quality assessment and improvement activities
- Developing clinical guidelines
- Conducting patient safety activities as defined in applicable regulations
- Conducting population-based activities relating to improving health or reducing health care cost
- Developing protocols
- Conducting case management and care coordination (including care planning)
- Contacting health care providers and patients with information about treatment alternatives
- Reviewing qualifications of health care professionals
- Evaluating performance of health care providers and/or health plans
- Conducting training programs or credentialing activities
- Supporting fraud and abuse detection and compliance programs.
The item in bold is the only loose-fit one on this list that I can see that might be OK for emails, if the emails are strictly about treatment alternative, which probably isn't the main thing the doctor wants to send. But again, you can't send those emails on his behalf because the following conditions must also be met:
- Both CEs must have or have had a relationship with the patient (can be a past or present patient)
- The PHI requested must pertain to the relationship
- The discloser must disclose only the minimum information necessary for the health care operation at hand.
I'm assuming you, the agency, have no relationship with their patients.
So yeah, this is majorly not OK. Him simply saying he'd take full responsibility probably doesn't eliminate your risk (obligatory I'm not a lawyer).
Source: I've been doing digital marketing for healthcare systems and medical practices for about 10 years, and they do not mess around with HIPAA.
