New Federal Privacy Rules Allow Fund Raisers to Use Patient Data to Seek Charitable Gifts

By NICOLE LEWIS

New federal regulations aimed at protecting the privacy of medical patients give nonprofit health-care organizations the right to continue using some personal information about patients to raise money.

Nonprofit groups had fought to maintain access to the information after a proposed version of the regulations, published in November 1999, threatened to block such access.

The new regulations, issued by the Department of Health and Human Services, permit health-care organizations to use a patient’s name, address, gender, age, and hospital-stay dates to make charitable appeals. In addition, health-care groups may relay that information to a “business associate,” such as a fund-raising consultant, or a fund-raising arm. The information cannot be shared with or sold to other charities or commercial organizations.

No Information on Treatment

However, information on a patient’s medical condition or treatment cannot be released to fund raisers. In addition, patients must be given an easy way to remove their names from a health-care organization’s fund-raising database.

Organizations that violate the confidentiality rules are subject to fines — and employees could face prison sentences — starting in 2002.

Under the rules proposed in 1999, patients would have had to give express permission before health-care organizations could use any personal information, including names and addresses, to raise money.

The Association of Healthcare Philanthropy, in Falls Church, Va., an organization that represents 3,000 health-care fund raisers, said its members would lose $3.5-billion in contributions if the regulations did not permit some sharing of information. That figure represents more than half of what all members raised in 1998, the last year data were available, said William McGinly, president of the organization.

The regulations were published in the December 28 issue of the Federal Register, pages 82,461-829. The full text is also available on the Department of Health and Human Services Web site, at http://www.hhs.gov, under the section called “Spotlight on Privacy of Medical Records.”