ABC, a Medicare Advantage plan sponsor, wants to use enrollees' information to market non-health related products. What must ABC obtain?

• A. A HIPAA-compliant authorization from the enrollee that indicates the plan may use their information for marketing purposes.
• B. Written consent from the plan administrator only.
• C. No authorization is required for marketing to enrollees.
• D. A court order to use enrollee information for marketing.

Answer: (C)

The important rule here is that using enrollees’ PHI to market something not related to health care generally requires the individual’s explicit authorization. A Medicare Advantage plan sponsor can’t just market non-health products to enrollees based on their data without a proper notice and consent that meets HIPAA’s standards.

A HIPAA-compliant authorization must come from the enrollee and should clearly describe what PHI will be used, who will receive it, the purpose of the disclosure (marketing non-health products), an expiration date or event, and the individual’s signature. It also should inform the enrollee of their right to revoke the authorization in writing (and the point at which revocation takes effect).

Therefore, rather than relying on plan administrator consent, a court order, or no authorization at all, the correct approach is to obtain a specific authorization from the enrollee. There are narrow HIPAA exceptions for certain marketing activities (such as face-to-face communications or health-related products/services offered by the plan), but those do not apply to marketing non-health-related products.