A vendor offers to buy the hospital’s patient contact list for a marketing campaign without patient authorization or another valid HIPAA permission. What should HIM leadership do?
Select an answer to reveal the explanation.
Short Explanation
Patient lists aren’t inventory for the marketing clearance rack. No authorization, no valid permission—no sale. That’s a hard stop, not a pricing discussion.
Full Explanation
HIPAA restricts uses and disclosures of PHI, and selling patient lists for marketing without a valid authorization or other permitted pathway is impermissible. HITECH-era enforcement increased penalties and scrutiny for such violations. HIM leaders must refuse unauthorized commercial disclosures.