1. Purpose

1.1. This regulation applies to East Carolina University's Health Care Components ("ECU Health Care Components") which create or maintain protected health information ("PHI"). Additionally, this regulation covers interactions involving uses and disclosures between an ECU Health Care Component and other areas of ECU that may receive PHI. The purpose of this regulation is to describe the manner in which PHI may be used for Marketing purposes.

2. Definitions

2.1. Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

2.1.1. Marketing does not include a communication made:

2.1.1.1. To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, unless any Financial Remuneration received by the ECU Health Care Component in exchange for making the communication is Reasonably Related to the ECU Health Care Component's cost of making the communication.

2.1.1.2. For the following treatment and health care operations purposes, except where the ECU Health Care Component receives financial remuneration in exchange for making the communication:

2.1.1.2.1. For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual;

2.1.1.2.2. To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the ECU Health Care Component making the communication, including communications about: the entities participating in a health care provider network or health plan network; replacement of, or enhancements to, a health plan; and health-related products or services available only to a health plan enrollee that adds no value to, but are part of, a plan of benefits; or

2.1.1.2.3. For case management or care coordination, contracting of individuals with information about treatment alternatives, and related functions to the extent these activities do not fall within the definition of treatment.

2.2. Direct Payment means Financial Remuneration that flows directly from the third party whose product or service is being marketed to an ECU Health Care Component.

2.3. Face-to-Face Communication means communication made in person. It does not include communications made over the telephone, or communications sent through the mail, message service or via email.

2.4. Financial Remuneration means Direct Payment or Indirect Payment from or on behalf of a third party whose product or services is being marketed. It does not include any payment for treatment of an individual.

2.5. Indirect Payment means Financial Remuneration that flows to an ECU Health Care Component from an entity on behalf of the third party whose product or service is being marketed.

2.6. Reasonably Related means costs that cover only the costs of labor, supplies, and postage to make the communication. It does not include financial remuneration received in exchange for making the communication that generates a profit or includes payments for other costs.

3. Regulation

3.1. ECU Health Care Components will comply with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") regarding the use of PHI for Marketing. Specifically, PHI will not be used or disclosed for Marketing purposes without the written authorization of the individual to whom the information relates.

4. Exceptions

4.1. The following communications are exceptions to the authorization requirement for Marketing:

4.1.1. A Face-to-Face Communication made by an ECU Health Care Component to an individual; or

4.1.2. A promotional gift of nominal value provided by the ECU Health Care Component.

5. Procedure

5.1. ECU Health Care Components must obtain an authorization for any use or disclosure of PHI for Marketing.

5.2. If an ECU Health Care Component requires the use or disclosure of PHI for Marketing that does not fall under the two exceptions above, please contact the ECU HIPAA Privacy Office by calling 252-744-5200 or by email at healthcareprivacy@ecu.edu.

5.2.1. An ECU authorization to use or disclose PHI must be obtained for marketing purposes. If Marketing involves Financial Remuneration to an ECU Health Care Component from a third party, the authorization must state that such remuneration is involved and the individual must receive a copy of the authorization.

5.3. Individuals will not be coerced to authorize the disclosure, use, or sale of PHI for any purpose, including Marketing.