Q&A: Providing patient information to marketing departments

Q: I work at a continuing care retirement community (CCRC). The marketing department and resource development staff want a daily census so they can visit donors, would-be donors, or possible candidates for buying in to our community. Is this acceptable? It seems to go beyond the minimum necessary standard.

A: The marketing department can be provided access to census data if that is not prohibited by state law and state licensing requirements. This includes marketing the CCRC to possible candidates. The only setting within a CCRC where this would be prohibited would be the skilled nursing facility (SNF) component of the CCRC because the SNF is likely a CE. A CCRC in and of itself is not a CE, and, therefore, only the CE setting is required to comply with HIPAA.

Editor's note: This question was answered by Chris Apgar, CISSP. Apgar is president of Apgar & Associates, LLC, in Portland, Oregon.This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Editor Nicole Votta at nvotta@hcpro.com.