HIPAA Audit Readiness Guide for Health System Foundation Fundraising Offices

A fundraising office can prepare for a HIPAA audit by showing that its use and disclosure of protected health information (PHI) fit the fundraising provisions, that individuals receive a workable opt-out, and that access to electronic PHI is appropriately controlled. This guide focuses on fundraising for a covered health system’s own benefit; other laws and stricter organizational policies may also apply.

What fundraising PHI may a covered entity use or disclose without authorization?

Under the HIPAA Privacy Rule fundraising provisions, a covered entity may use or disclose certain PHI for fundraising for its own benefit without an individual’s authorization. The permitted categories are demographic information—including name, address, other contact information, age, sex, and date of birth—dates of health care, department of service, treating physician, outcome information, and health insurance status. The rule permits disclosure to a business associate or an institutionally related foundation, subject to the fundraising requirements. See 45 CFR § 164.514(f).

Do not treat this list as permission to send a full medical record or to include any information that might help target a donor. For example, diagnosis and detailed clinical notes are not among the listed fundraising categories. If a proposed use or disclosure goes beyond the permitted categories, pause and consult the privacy officer about whether another HIPAA permission or a valid authorization applies.

How should disclosures to an institutionally related foundation be documented?

First, confirm that the recipient qualifies as an institutionally related foundation under HIPAA’s definition. The definition addresses a foundation maintained by a covered health care provider, or by an institution related to one, whose charter or bylaws provide for supporting the provider. Retain governance records that establish the relationship, such as the relevant charter or bylaws and documentation identifying the legal entities involved. See 45 CFR § 164.501.

Keep a clear record of the fundraising purpose, the PHI categories disclosed, the recipient, and the process used to prepare and transfer the data. These are practical audit-readiness records; HIPAA does not prescribe a single disclosure-log format for every fundraising office. If the foundation separately performs business associate services for the covered entity, assess that role and any applicable business associate agreement rather than assuming that foundation status alone resolves the issue.

Does the notice of privacy practices describe fundraising uses and disclosures?

If the covered entity uses or discloses PHI for fundraising under this provision, its notice of privacy practices (NPP) must include a separate statement that it may contact the individual to raise funds for the covered entity and that the individual has a right to opt out. Check that the statement appears in the current notice and accurately describes the health system’s practice. The Privacy Rule also requires the notice to be revised when a material change to the stated privacy practices occurs. See 45 CFR § 164.520(b)(1)(iii)(A) and (b)(3).

There are additional requirements for covered entities that create or maintain records subject to 42 CFR Part 2. In that situation, review the applicable NPP requirements and the requirement to provide a clear and conspicuous opportunity to opt out before using or disclosing those records for fundraising. See 45 CFR § 164.520(b)(1)(iii)(E) and HHS guidance on Part 2.

How can fundraising communications provide a clear and accessible opt-out?

Each fundraising communication made under this provision must give the individual a clear and conspicuous opportunity to elect not to receive further fundraising communications. The method cannot impose an undue burden or more than a nominal cost. Make the choice easy to find and explain plainly how to use it; as an accessibility practice, consider whether individuals can act on the option through the communication channel or another practical method.

Maintain a process to capture and apply opt-out requests across the fundraising systems and channels used by the covered entity. Do not send further fundraising communications under this provision to individuals who opted out. The covered entity may offer a way to opt back in, but it may not condition treatment or payment on an individual’s choice about fundraising communications. See 45 CFR § 164.514(f)(2).

What records should a fundraising office prepare for a HIPAA audit?

HIPAA does not prescribe a single fundraising audit binder. Prepare records that let reviewers trace the process from the legal basis for fundraising through data selection, communication, opt-out handling, and security. Depending on the health system’s practices, useful records include:

• The current and prior NPPs, with evidence of the applicable fundraising language.
• Written privacy policies and procedures for fundraising data use, disclosure, and opt-out processing.
• Documentation supporting the foundation’s institutional relationship and identifying the recipient entity.
• Data specifications, sample extracts, and approvals showing which permitted PHI categories were included and why.
• Sample fundraising communications showing the opt-out language and method available to recipients.
• Opt-out request records, suppression-list controls, and testing or review showing that opt-outs are applied.
• Role-based access approvals, relevant access reviews or logs, and vendor or system documentation for fundraising tools.
• The applicable security risk analysis, risk-management records, and incident documentation for systems handling electronic PHI.

HIPAA requires covered entities to document specified privacy policies and actions and retain required documentation for six years from creation or from the date it was last in effect, whichever is later. That retention rule applies to required documentation; it is not a blanket instruction that every fundraising record must be kept for the same period. Check 45 CFR § 164.530(j) and applicable organizational and other legal retention requirements.

How should the minimum necessary standard guide fundraising data access?

For fundraising uses and disclosures, apply the minimum necessary standard: make reasonable efforts to limit PHI to what is needed for the intended purpose. The fact that a data element appears in the fundraising list does not mean every fundraiser needs access to it or that it belongs in every campaign. See HHS guidance on the minimum necessary requirement.

Define access by job role. For example, a staff member preparing an approved mailing list may need access to contact information and selected fundraising fields, while other staff may need only aggregate campaign results. Document which roles can access which categories of information, limit exports and shared files, and review access when duties change. The standard is flexible, but it requires reasonable limits—not unrestricted access to the medical record.

How does the security risk analysis address electronic PHI used in fundraising?

The HIPAA Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI (ePHI). Include fundraising systems and workflows in the analysis when the covered entity or its business associates create, receive, maintain, or transmit ePHI through them. Map relevant data flows, such as extracts from health-system systems, fundraising databases, vendor integrations, user access, and transfers to the foundation. See HHS guidance on Security Rule risk analysis and 45 CFR § 164.308(a)(1)(ii)(A).

Assess risks such as excessive permissions, misdirected exports, unsecured transfer methods, compromised accounts, and vendor access. Document identified risks, safeguards, and follow-up actions. The analysis should reflect the actual systems and operations; it is not enough to assess only the main health-record system while overlooking fundraising databases or data exchanges that handle ePHI. If a related foundation is not acting as a business associate, determine where the covered entity’s and any business associate’s security responsibilities apply, and document the disclosure and transfer controls accordingly.

In summary, audit readiness depends on using only the PHI permitted for fundraising, confirming the foundation relationship, making the opt-out effective, limiting staff access, and accounting for ePHI in the security risk analysis. Keep the supporting policies and evidence organized so the health system can demonstrate how those controls work in practice.

FAQs

What PHI may a health system use for fundraising without an individual’s authorization?

For fundraising for its own benefit, a covered entity may use demographic information, dates of health care, department of service, treating physician, outcome information, and health insurance status, subject to the HIPAA fundraising requirements. The permitted categories are listed in 45 CFR § 164.514(f)(1).

Can a health system share permitted fundraising PHI with its related foundation?

Yes, the Privacy Rule permits disclosure of the listed fundraising PHI to an institutionally related foundation for fundraising for the covered entity’s own benefit, if the requirements are met. Confirm that the foundation qualifies under the HIPAA definition and limit the disclosure to the permitted information needed for the purpose. See 45 CFR § 164.501 and 45 CFR § 164.514(f).

What must a fundraising communication include to meet HIPAA opt-out requirements?

Each communication must provide a clear and conspicuous opportunity to elect not to receive further fundraising communications. The opt-out method may not impose an undue burden or more than a nominal cost, and the covered entity must honor the election for future communications under this provision. See 45 CFR § 164.514(f)(2).

Can treatment or payment be affected by an individual’s fundraising opt-out?

No. A covered entity may not condition treatment or payment on an individual’s choice about whether to receive fundraising communications. See 45 CFR § 164.514(f)(2)(iii).