Moving the HME Industry Forward

General Healthcare

Marketing – Understanding HIPAA Restrictions

May 18, 2015

AMARILLO, TX – Innovative marketing has always been important to the successful DME supplier. There is now a confluence of events that is pushing the importance of marketing from the “important” category to the “critical” category.

These events include competitive bidding, aggressive post-payment audits and prepayment review, increasingly stringent documentation requirements, and reduced reimbursement. And yet, with 78 million “Baby Boomers” retiring at the rate of 10,000 per day, the demand for what the DME industry has to offer is increasing exponentially. The DME supplier needs to aggressively market in order to tap this demand.

Most suppliers are aware that when implementing a marketing program involving Medicare/Medicaid patients, they need to avoid violating the commonly-known federal anti-fraud statutes: Medicare anti-kickback statute, beneficiary inducement statute, telephone solicitation statute and the Stark physician self-referral statute. In implementing a marketing program, if the DME supplier either complies with the federal anti-fraud laws or avoids servicing patients covered by a federal or state health care program, then the supplier may feel that it is “home free” and can structure the program however the supplier wants to structure it. While it is certainly helpful if the DME supplier does not have to be concerned about federal anti-fraud statutes, the supplier is not entirely out of the woods. The DME supplier needs to be aware of the HIPAA marketing restrictions.

The Health Insurance Portability and Accountability Act (“HIPAA”) requires “covered entities” to obtain a valid authorization from individuals before using or disclosing protected health information (“PHI”) to market a product or service to them. See 45 CFR § 164.508(a)(3). A DME supplier falls within the HIPAA definition of a “covered entity.” PHI is a subset of “individually identifiable health information,” which is defined as (i) information that is a subset of health information, including demographic information collected from an individual, and (ii) is created or received by a health care provider . . . ; and (iii) related to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual; and (iv) that identifies the individual; or (v) with respect to which there is a reasonable basis to believe the information could be used to identify the individual. 45 CFR §160.103.

HIPAA broadly defines “use” of PHI to include the sharing, employment, application, utilization, examination, or analysis of such information. 42 CFR § 160.103. The new HIPAA definition of marketing states what is not marketing:

Marketing does not include a communication made: . . . [f]or the following treatment and health care operations purposes, except where the covered entity receives financial remuneration in exchange for making the communication[,] . . . to describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication, including communications about: the entities participating in a health care provider network or health plan network; replacement of, or enhancements to, a health plan; and health-related products or services available only to a health plan enrollee that add value to, but are not part of, a plan of benefits.

45 CFR § 164.501 (2013) (emphasis added). Marketing communications require prior valid authorization from the customer. 45 CFR § 164.508(a).

Therefore, to avoid HIPAA’s requirement that the DME supplier obtain a valid authorization from the customer before making a marketing communication, the marketing communication must concern a health-related product or service (i) provided by the supplier and (ii) the supplier cannot receive financial remuneration in exchange for making the communication.

When the Department of Health and Human Services revised the definition of marketing communication, it issued the following comments to the final rule:

We believe Congress intended that these provisions curtail a covered entity’s ability to use the exceptions to the definition of “marketing” in the Privacy Rule to send communications to the individual that are motivated more by commercial gain or other commercial purpose rather than for the purpose of the individual’s health care, despite the communication being about a health-related product or service.

78 Fed. Reg. 5592. HIPAA applies to any patient…no matter how old or how young…and whether the patient is covered by Medicare or commercial insurance. In other words, HIPAA is not limited to Medicare patients. These comments make it clear that a health care provider (including a DME supplier) can only use a patient’s PHI for the medical benefit of the patient. The DME supplier cannot disclose or use the PHI for purposes of marketing (i.e., for the purposes of making money) unless the patient gives a valid prior written authorization for such use or disclosure. In short, when the patient “walks into the provider’s facility,” the patient needs to feel secure that his PHI will only be used for the purpose that it was designed to be used.

Jeff Baird will be presenting the following webinar on May 28, 2015:
AAHomecare’s Educational Webinar

How the Losing Bidder Can Enter the Competitive Bid Arena
Presented by: Jeffrey S. Baird, Esq., Brown & Fortunato, P.C.
Thursday, May 28, 2015
2:30-4:00 p.m. EASTERN TIME
Sadly, there are way too many quality DME suppliers that have not been awarded contracts. There are ways, however, for the non-contract supplier to enter the competitive bidding arena “after the fact.” This program will discuss those ways. Examples include purchasing 100% of a contract supplier’s assets; engaging in a partial asset purchase in which the non-contract supplier purchases only those assets associated with the contract supplier’s competitive bid contract; 100% stock acquisition; and establishing a 5% or more common ownership that will entitle the non-contract supplier to be added to the contract supplier’s competitive bid contract. In addition, the webinar will discuss the recently-published CMS rule that, under certain circumstances, allows a selling contract supplier to “carve up” its competitive bid contract. Lastly, the webinar will discuss whether, as a result of one of these transactions, any liability of one company will be imposed on the other company.

REGISTER for “How the Losing Bidder Can Enter the Competitive Bid Arena” on Thursday, May 28, 2015, 2:30-4:00 pm ET, with Jeffrey S. Baird, of Brown & Fortunato, PC.
Contact Ika Sukh at if you experience any difficulties registering.
FEES: Member: $99.00    Non-Member: $129.00

Jeffrey S. Baird, JD, is chairman of the Health Care Group at Brown & Fortunato PC, a law firm based in Amarillo, Tex. He represents pharmacies, infusion companies, HME companies, and other health care providers throughout the United States. Baird is Board Certified in Health Law by the Texas Board of Legal Specialization and can be reached at (806) 345-6320 or