HIPAA Fundraising Issues for Hospice

As one hospice director put it, "The holidays are just around the corner and 'Gift of Light' fundraising trees will be going up in shopping malls all over the nation. On these trees will be the names of individuals being memorialized by friends and loved ones. As you know, these names are selected by persons outside the hospice organizations which sponsor the fundraiser. The names, some former patients with hospices and some not, are displayed for all to remember and honor. I would like to know if regulators and enforcers have determined whether or not the fundraising activity described above violates HIPAA and the privacy rules."

This question raises a number of important fundraising issues for hospices, such as: Does the name of an individual donor in a hospice facility constitute PHI? How about a donor's name in a newsletter? Or a quilt hung in the reception area of a hospice that contains the names of memorialized individuals? Several of these uses fall within the gray areas of the HIPAA Privacy Rule. This article provides general guidance on handling these and other common fundraising and memorial activities. It is important to remember that each hospice will need to carefully examine their activities to determine whether they are permissible under the HIPAA Privacy Rule.

1. Is it permissible to list the names of individuals memorialized or honored as part of a "Light up a Life" or other community fundraising activity?

To the extent a hospice solicits beyond its own current and former patients, the listing of memorialized or honored individuals likely would not be considered a disclosure of protected health information ("PHI"). The HIPAA Privacy Rule only protects PHI, which is defined as health information in any form or medium that is created or received by a health care provider and relates to: (a) the past, present or future physical or mental health or condition of an individual; (b) the provision of health care to an individual; or (c) the payment of health care to an individual. 45 C.F.R. 160.103. Unless limited to a hospice’s current or former patients, a listing of honored or memorialized individuals does not meet the definition of PHI, because the names alone do not reveal anything about the health or provision of health care to the individuals.

A hospice will want to make certain that it is soliciting contributions from the broader community, and if possible state these efforts in its promotional material. For example, the hospice could note that it accepts contributions and memorials from the entire community.

2. Is it permissible to list donors in a hospice newsletter?

Listing donors in a newsletter, without the name of the person being memorialized, is not governed by the HIPAA Privacy Rule, as a donor's name does not constitute PHI. However, it advisable for reasons unrelated to HIPAA to ask donors whether they wish their donation to be public.

As discussed above, it is also likely permissible for a hospice to publish the name of the person a donor is memorializing or honoring to the extent the publication does not imply that the person being honored was a hospice patient. Additionally, a hospice will want to avoid including why the individual is being honored (e.g., for her courageous battle against breast cancer), as this information may be considered PHI. Please note that if a hospice plans to disclose PHI in a newsletter (for example, a photo of a hospice patient or a letter written to the hospice disclosing details of the care given to a specific individual) it must obtain an authorization from the individual who is the subject of the information or, if the individual is deceased, the individual's personal representative.

3. Is it permissible to publicly recognize hospice patients (e.g., on quilts or other public displays within the hospice)?

If the quilt or other public display only includes the names of hospice patients, then the authorization of the hospice patient, or after the patient's death, the personal representative (e.g., executor) would be required.

4. Is it permissible to read patient names at memorial services?

A hospice will likely need an authorization to read the names of patients it has served, as the reading would be considered a release of PHI. While there is an argument that the release is part of "health operations," the HIPAA Privacy Rule does not clearly identify the practice as such. The practice may be conducted without an authorization if the honored individuals include both patients and non-patients and the hospice does not separately identify the hospice patients. Also, some hospices hold memorial services at which those present may read the names of remembered individuals. In this case, the reading is likely permissible because an individual, rather than the hospice, which is the entity subject to the HIPAA Privacy Rule, is making the disclosure.

*********************************************************HIPAA continues to be a "work in progress." Hospices with specific questions and fact situations are encouraged to consult with their legal counsel, as even slight factual variations may change the answers to any of the above questions. Federal and state privacy laws and regulations are complex and interpretive guidance will continue to be issued over the next several years.