HIPAA compliance question

[hea.hipaa]

Not sure if I'm in the right place here... but it's worth a shot. I work in a large Ophthalmology practice that has a facial aesthetics department (Botox, etc). We are having an event to highlight special pricing on some products and would like to email patients that have been involved in our facial aesthetic department to announce the event. We can leave out specific pricing, so it would really just be to announce this event and would mention the products involved in the special pricing.

Does this type of email marketing require an authorization?

[toomuchbaloney]

Why not just send the announcement to all customers/clients/patients of the larger practice?

I am not certain that it is a HIPAA violation but it doesn't sound that ethical to me.

As an aside, what is the connection to Ophthalmology?

[Here.I.Stand, BSN, RN]

First I would check your policy on communicating via e-mail. If it is allowed, I would just send the e-mail to every clinic pt to avoid singling anyone out.

[KelRN215, BSN, RN]

Send the email to yourself and share it with patients by BCCing them on the email. If you have the clients' email addresses, presumably they provided this information to you. You are not sharing their information with anyone. You are making an announcement about an event sent to one's private email. I get post-cards from the Cancer hospital where I do my brain tumor follow-up and, since they're post-cards, my mailman can very clearly deduce that I am a Neuro-Onc patient from them. They say things on them like "You are invited to our annual meeting for Brain Tumor patients". If that's ok, certainly a private email is. Just make it an email about the event, nothing about "Dear Clients" or anything. That way if Suzy and her husband share an email and he doesn't know she's been spending his money on having work done, he might just think this is a spam email.

[nurseprnRN, BSN, RN]

Authorization from whom? You might want to clear it c your risk management office, though, just to CYA.

If your patients have signed a form authorizing you to contact them by email (called opt-in), and given you their email addresses, then you can send the kind of emails you mention. Be dead certain sure you BCC them, though, because releasing their emails to the known universe is a bad thing.