TITLE:

FUNDRAISING and HIPAA REQUIREMENTS

POLICY:
Columbia University Medical Center will conduct fundraising activities in accordance with city, state, and federal laws and regulations, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

PURPOSE:
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) limits the use and disclosure of a patient’s Protected Health Information (PHI) for fundraising purposes.  Columbia University Medical Center is committed to protecting the privacy of its patients and the confidentiality of their PHI as mandated by city, state, and federal laws and regulations, including HIPAA.

This policy describes when and how Columbia University Medical Center will use or disclose patient’s PHI for fundraising purposes and the procedures a patient must execute if he/she wants to opt out of being contacted for fundraising efforts.

PROCEDURE:

1. Permitted uses and disclosures of PHI for fundraising purposes
   1. Authorized fundraising staff (Office of Development) at Columbia University Medical Center may disclose Protected Health Information:
      1. to conduct fundraising efforts on behalf of Columbia University Medical Center; or
      2. to a Business Associates who is conducting fundraising activities for Columbia University Medical Center.
   2. Any Department conducting fundraising activities must receive approval from the Office of Development before any written communication is sent to a patient and must comply with this policy.
   3. Unless otherwise authorized by the patient, the patient’s PHI that is used or disclosed for fundraising purposes is limited to:
      1. the patient’s demographic information; including name, address, age, gender, insurance and dates of treatment may be disclosed.
      2. Examples of non-demographic information that may not be shared with Development staff includes; nature of a patients illness, diagnosis, and details of treatment.
   4. Patient may sign an opt-in notice at the time of registration to permit the use of their demographic information for fundraising purposes.  For additional guidance, please contact the Office of HIPAA Compliance
2. Notifying the patient – Request to Opt-out of Fundraising
   1. The Columbia University Medical Center of Notice of Privacy Practices (NOPP) includes a statement that the patient may be contacted to raise funds for Columbia University Medical Center.
      1. The Columbia University Medical Center NOPP also includes a statement that the patient may elect to opt out of being contacted in future fundraising efforts.
   2. All fundraising materials sent to a patient will include instructions on how the patient may opt out of receiving further fundraising communications from Columbia University Medical Center.
   1. The opt-out language in the materials includes the contact person at Columbia University Medical Center to whom the patient’s request to opt-out should be directed.
   2. All fundraising opt-out requests received by Columbia University Medical Center should be forwarded to the Privacy Officer at 601 West 168th Street, New York, NY  10032 apt. 22 or email to HIPAA@Columbia.edu
   3. Generally, the opt-out language is included as footer at the end of a solicitation letter.  Suggested Opt-out language is:

   “Please write to us at the name and address below if you wish to have your name removed from lists to receive fundraising requests supporting [insert institution or program name] in thefuture.”

3. Processing Opt-out Requests
   • Upon receipt of an Opt-out request, the Office of Development will remove the person’s name from all existing fundraising lists and assure that the name will not be included in any future fundraising activities.
4. Exchange of Prospect Information within the Office of Development
   • Discussions between physicians and fundraising staff regarding potential donors may not include protected health information unless specifically authorized by the patient.   These discussions may include:
     1. Organizational fundraising priorities
     2. Fundraising needs of a clinical department or physician group
     3. Contacts known to physician who may be interested in supporting organizational priorities.
5. Reasonable efforts to comply with opt-out requests
   • Columbia University Medical Center will make reasonable efforts to ensure compliance with a patient’s opt-out request.
6. Definitions
   • Protected Health Information is information about a patient, including demographic information that may identify a patient that releases to the patient that relates to the patient’s past, present or future physical or mental health condition, related health care services or payment for health care services. 

RESPONSIBILITY: Office of Development, Clinical Departments, HIPAA Privacy Officer