HIPAA Marketing Rules and
Why They’re Legal
The First Amendment to the U.S. Constitution guarantees freedom of speech. This means the government cannot censor speech simply because the government disagrees with it, or thinks the speech is about something “too important” to be revealed publicly. Of course, there are limits to what the First Amendment permits. As the famous judge Oliver Wendell Holmes Jr. once said, “the most stringent protection of free speech would not protect a man falsely shouting fire in a theatre and causing a panic.” The issue of HIPAA marketing rules and why they are legal – why they do not infringe on free speech rights – is discussed below.
HIPAA Marketing Rules and the Supreme Court
As the recent Ezekiel Elliot news makes clear, many people are quick to claim that some right of theirs has been violated, without articulating what that right is. Elliot suggested that when his COVID-19 diagnosis was made public, that his HIPAA rights were violated. Rights do not exist in the air. A person must allege a specific right that was violated, and that whomever violated it had no grounds to do so.
The HIPAA Privacy Rule makes quick work of Elliot’s suggestion. Under HIPAA, patients have the right to not have their PHI disclosed without authorization. The entities that are prohibited from making unauthorized disclosures are covered entities and business associates. Elliot did not claim that an unauthorized disclosure was made by either of these groups, so his assertion is just that – a claim, and an inaccurate one at that.
In some instances, though, individual entities allege that specific legal rights have been violated. Cases with these allegations sometimes even get all the way up to the U.S. Supreme Court. One such case involved the clash of two important interests – freedom of speech in aid of marketing, and medical privacy.
These interests met head-on in the 2011 Supreme Court case of Sorrell v. IMS Health. In this case, the Court decided whether a Vermont law that restricted the sale, disclosure, and use of pharmacy records that revealed the prescribing practices of individual doctor (unless a doctor agreed to have the information revealed) violated the First Amendment. Vermont claimed that the law was necessary to protect medical privacy. IMS, a pharmaceutical company, claimed that the law infringed on its right to freedom of speech. The Court held that the law violated the First Amendment. Speech in aid of pharmaceutical marketing, the Court held, is a form of expression protected by the First Amendment.
How does this decision square with the HIPAA marketing rules, which prohibit use of PHI for marketing purposes, in the absence of written patient authorization? The Court specifically addressed this issue by noting that Vermont’s law singled out pharmaceutical companies for unfair treatment. Vermont law made disclosure of prescriber-identifying information available to an almost limitless audience – except for pharmaceutical companies and health insurers. The Court held that if Vermont were really concerned with patient privacy, Vermont would not have banned the speech of only these two groups. Because only these groups were targeted by the ban, the Court held that Vermont needed special justification for the targeting, which, the Court held, it did not provide.
The Court mentioned that HIPAA marketing rules did not present the same free speech concerns, because, under the Privacy Rule, PHI can only be sold or disclosed in only a few narrow and well-justified circumstances (such as when the marketing is for treatment purposes, or is about a covered entity’s own health-related services). In other words, the HIPAA Privacy Rule was more narrowly “tailored” to achieve its goal of protecting privacy, than the Vermont law. The HIPAA marketing rules don’t unfairly single out one group from communicating or receiving marketing information – just as Ezekiel Elliot’s shouting “HIPAA!!” does not constitute a HIPAA violation.
