1. Purpose

1.1. This regulation applies to East Carolina University's Health Care Components ("ECU Health Care Components") that create or maintain Protected Health Information ("PHI"). Additionally, this regulation covers interactions involving uses and disclosures between an ECU Health Care Component and other areas of ECU that may receive PHI. The purpose of this regulation is to describe when the use or disclosure of PHI will result in a Sale of PHI and when authorization is required for the Sale of PHI.

2. Definitions

2.1. Reasonable Cost-Based Fee means:

2.1.1. Both direct and indirect costs, including:

2.1.1.1. Labor, materials, and supplies for generating, storing, retrieving, and transmitting PHI;

2.1.1.2. Labor and supplies to ensure the PHI is disclosed in a permissible manner;

2.1.1.3. Related capital and overhead costs

2.1.2. Reasonable Cost-Based Fee does not include:

2.1.2.1. Fees charged to incur a profit from the disclosure of PHI

2.2. Sale of PHI means a disclosure of PHI by an ECU Health Care Component in which a direct or indirect remuneration is received from or on behalf of the recipient of the PHI in exchange for the PHI.

2.2.1. Sale of PHI includes a transfer of ownership, as well as disclosures of PHI based on an access, license or lease agreement.

2.2.2. Sale of PHI includes in-kind remuneration.

2.2.2.1. For example, consider that an ECU Health Care Component is offered computers in exchange for disclosing PHI:

2.2.2.1.1. Sale of PHI: if the ECU Health Care Component is permitted to use the computers for other purposes or to keep the computers even after the disclosures have been made.

2.2.2.1.2. Not a Sale of PHI: if the computers are solely used for the purpose of preparing and transmitting PHI to the person collecting the PHI and are returned when such disclosures are completed.

3. Regulation

3.1. ECU Health Care Components will comply with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") regarding the sale of PHI. Specifically, an ECU Health Care Component must obtain a written authorization for any disclosure of PHI which is a Sale of PHI and such authorization must state that the disclosure will result in remuneration to the ECU Health Care Component.

4. Exceptions

4.1. The following communications are exceptions to the authorization requirement for Sale of PHI:

4.1.1. Public health purposes;

4.1.2. Research if the payment is a Reasonable Cost-Based Fee to cover the cost to prepare and transmit the PHI;

4.1.3. Treatment and payment purposes;

4.1.4. Sale, transfer, merger, or consolidation transaction involving an ECU Health Care Component;

4.1.5. Activities performed by a business associate for or on behalf of an ECU Health Care Component if the payment is for the business associate's performance of such activities to the extent such fees are Reasonable Cost-Based Fees, in compliance with a fee schedule provided by State law, or otherwise expressly permitted by other applicable law;

4.1.6. Providing an access or an accounting of disclosures to an individual to the extent such fees are Reasonable Cost-Based Fees, in compliance with a fee schedule provided by State law, or otherwise expressly permitted by other law;

4.1.7. As required by law; and

4.1.8. As otherwise permitted under HIPAA.

5. Procedure

5.1. ECU Health Care Components must obtain an authorization for the Sale of PHI.

5.2. If an ECU Health Care Component requires the use or disclosure of PHI that will result in the Sale of PHI, please contact the ECU HIPAA Privacy Office by calling 252-744-5200 or by email at healthcareprivacy@ecu.edu.

5.2.1. An ECU authorization form must be obtained for the Sale of PHI. The authorization must state that the disclosure will result in remuneration to the ECU Health Care Component and the individual who signs the authorization must receive a copy of the authorization.

5.3. Individuals will not be coerced to authorize the disclosure, use, or sale of PHI for any purpose.