How may authorization to use enrollees' information for non-health products be obtained?

• A. By signing a paper consent form in the mail
• B. By email consent
• C. By directing to a website with an electronic signature valid under law
• D. By phone call confirmation

Answer: (C)

Authorization to use enrollees’ information for non-health products must be a written, signed permission. Obtaining that authorization through a website where the enrollee provides an electronic signature is valid under the law because electronic signatures can create a verifiable, auditable record and, when the process includes all required elements (who, what, for what purpose, expiration, revocation rights, and date), it meets HIPAA-style standards for a legally binding signature. This approach is also efficient and scalable for both the issuer and the enrollee.

Other methods—like informal email consent or a phone confirmation—don’t provide the same written, verifiable record and may fail to meet the specific requirements for a compliant authorization, making them less suitable as the sole means of authorization for using PHI for non-health products. Paper consent mailed in can be valid, but electronic consent via a compliant website is the modern, robust option that ensures proper documentation and ease of verification.