Certified in Healthcare Privacy and Security (CHPS) Practice

To disclose a patient’s health information for marketing purposes, a covered entity is required to obtain a signed authorization from the patient. This requirement is in place to ensure that patients have control over their personal health information and are fully aware of how it might be used or disclosed, particularly for marketing initiatives that are not directly related to their health care. The signed authorization must include specific information regarding the type of information that will be shared and the purposes for the disclosure, ensuring transparency and respect for patient privacy rights.

In contrast, options that involve oral agreements or verbal approvals do not provide a sufficient level of assurance and accountability, as they lack the formal documentation necessary to demonstrate consent. A written notice, while important for patient information, does not serve as a legitimate way to obtain consent for marketing-related disclosures. Hence, the requirement for a signed authorization places patients in a position of authority over their health information in marketing contexts.