Which statement about marketing non-health products to enrollees must follow HIPAA Privacy Rules?

• A. HIPAA Privacy Rules do not apply to marketing.
• B. HIPAA Privacy Rules require explicit written consent in every case.
• C. HIPAA Privacy Rules apply only to electronic records.
• D. Marketing non-health products must follow HIPAA Privacy Rules.

Answer: (D)

The main idea here is that protected health information (PHI) is safeguarded by the HIPAA Privacy Rule, and its use for marketing activities is controlled, regardless of what product is being marketed. When a health plan or its business associates use PHI to target or tailor marketing to enrollees—even if the product being marketed is not health-related—that use or disclosure must comply with HIPAA. In practice, that means you can’t simply market non-health products to enrollees based on their PHI without proper authorization or unless an allowed exception applies; PHI is treated with privacy protections across all formats, not just electronic records. The rule also covers how PHI can be used by business associates, and it isn’t limited to one specific form of record or to a blanket written-consent requirement in every situation. This is why marketing non-health products must follow HIPAA Privacy Rules.