What constitutes valid authorization to use enrollees' information for non-health marketing?

• A. A verbal consent from the beneficiary over the phone
• B. An email indicating consent
• C. Authorization may be obtained via a website with an electronic signature valid under applicable law
• D. Consent is not required for non-health marketing

Answer: (C)

The key idea here is what counts as a valid written authorization to use enrollees’ PHI for marketing that isn’t health-related. HIPAA requires a written authorization for most disclosures of PHI for marketing. An electronic signature on a website can satisfy that written requirement if it complies with applicable law (such as ESIGN/UETA) and HIPAA rules, because it creates a verifiable, auditable record of consent.

Such an authorization should clearly describe what PHI will be used, who will receive it, the purpose of the use or disclosure, any expiration or expiry, and the individual’s right to revoke. A website that captures an electronic signature provides a durable, enforceable form of consent that meets these elements.

Verbal consent over the phone isn’t a written authorization, so it isn’t sufficient on its own. An email indicating consent may not meet the necessary formalities and required elements unless it functions as a fully compliant written authorization. And consent is not optional for non-health marketing; without a proper written authorization, the disclosure would not be allowed.