{"page":"/blog/hipaa-marketing-rule","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Item","Communication","Marketing?","Exception or exemption","Authorization needed?","Citation"],"rows":[["1","Hospital mails patients about its own new MRI service; no third-party payment","No","Own health-related service, 164.501(2)(ii)(B)","No","164.501"],["2","Same mailing, paid for by the MRI maker","Yes","Exception lost: financial remuneration","Yes, with remuneration statement","164.501; 164.508(a)(3)(ii)"],["3","Pharmacy refill reminder; maker pays only labor, supplies and postage","No","Refill exception, 164.501(2)(i)","No","78 FR 5597"],["4","Same reminder; maker adds an incentive above cost","Yes","Cost test failed","Yes, with remuneration statement","78 FR 5597"],["5","Adherence or generic-equivalent message about a current prescription","No, within the cost test","Refill exception as read by HHS","No, if payment stays within cost","78 FR 5596"],["6","Email promoting a drug the patient is not prescribed, paid by its maker","Yes","None","Yes, with remuneration statement","164.501; 164.508(a)(3)"],["7","Doctor recommends an alternative drug in person and hands over a pamphlet; a third party pays","Yes","Face-to-face exemption","No","78 FR 5596"],["8","Same recommendation by phone, mail or email; a third party pays","Yes","None: not face-to-face","Yes","78 FR 5596"],["9","Free package of formula and baby products for new mothers","Yes","Promotional gift of nominal value","No","HHS guidance"],["10","Health plan mails members nearing Medicare age about its own supplemental plan","No","Own plan products, 164.501(2)(ii)(B)","No, unless a third party pays","HHS guidance"],["11","Health insurer promotes its home and casualty insurance","Yes","None: not health-related","Yes","HHS guidance"],["12","Hospital tells former patients about an outside cardiac facility offering a $39 EKG, not as treatment advice","Yes","None","Yes","HHS guidance (2003 example)"],["13","General message encouraging annual mammograms, no specific provider's product","No","Outside the definition","No","78 FR 5597"],["14","Message about Medicare, Medicaid or CHIP eligibility","No","Outside the definition","No","78 FR 5597"],["15","Hospital fundraising appeal using demographics and dates of care","Handled by the fundraising rule, not the marketing rule","164.514(f), with an opt-out offered in every appeal","No","164.514(f)"],["16","Plan sells its member list to a glucose-monitor company for the buyer's own mailing","Yes, and a sale of PHI","None","Yes, stating the remuneration","164.508(a)(4); HHS guidance"]],"sourceUrls":[["https://www.ecfr.gov/current/title-45/section-164.501"],["https://www.ecfr.gov/current/title-45/section-164.501","https://www.ecfr.gov/current/title-45/section-164.508"],["https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the"],["https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the"],["https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the"],["https://www.ecfr.gov/current/title-45/section-164.501","https://www.ecfr.gov/current/title-45/section-164.508"],["https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the"],["https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the"],["https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html"],["https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html"],["https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html"],["https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html"],["https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the"],["https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the"],["https://www.ecfr.gov/current/title-45/section-164.514"],["https://www.ecfr.gov/current/title-45/section-164.508","https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html"]]}