HIPAA Compliance Guide for Disease Fund and Copay Foundations

Determine Whether HIPAA Applies to the Foundation

A disease fund or copay foundation is not automatically subject to HIPAA just because it helps people with medical costs or receives health information. HIPAA applies to covered entities—health plans, health care clearinghouses, and certain health care providers—as well as business associates that perform covered functions or services involving protected health information (PHI) on a covered entity’s behalf.

To assess whether the rules apply, review what the foundation does, whom it serves, and how it receives or uses information. A nonprofit that independently operates an assistance program generally does not become a covered entity solely because it verifies a diagnosis or pays a patient’s costs. However, it may have HIPAA obligations if it performs services involving PHI for a covered entity as a business associate.

HIPAA status is separate from other privacy responsibilities. Even when a foundation is not covered by HIPAA, contracts, state privacy laws, consumer-protection requirements, and its own privacy commitments may govern the information it handles. Document the organization’s analysis and revisit it when program operations or relationships change.

Define Covered Entity and Business Associate Roles

The HIPAA covered entity definition includes health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a standard transaction. A foundation that is not one of these entity types does not become a covered entity simply by exchanging information with a provider or insurer.

A foundation may qualify as a business associate when it performs a function or service for a covered entity that involves creating, receiving, maintaining, or transmitting PHI. The relationship depends on the work and whose behalf the foundation is acting for—not merely on whether it sees health information. For example, administering a covered entity’s assistance or payment program using patient records could create a business-associate relationship.

When a business-associate relationship exists, the parties should enter into a HIPAA business associate agreement (BAA) before PHI is shared. The agreement should define permitted uses and disclosures, require appropriate safeguards, establish breach and incident reporting procedures, address subcontractors, and specify how information will be returned or destroyed when the relationship ends. A BAA does not make an independently operated foundation a business associate if it is not actually performing covered work on the covered entity’s behalf.

Safeguard Protected Health Information

PHI is individually identifiable health information held or transmitted by a covered entity or its business associate. Depending on the context, it can include a person’s diagnosis, treatment, payment information, or identifying details linked to care. A foundation should identify what sensitive information it collects, where it is stored, who can access it, and whether each collection is necessary for the program.

For information handled under HIPAA, apply administrative, physical, and technical protected health information safeguards. Use role-based access, staff training, secure transmission and storage, appropriate authentication, access reviews, incident response procedures, and secure disposal. Limit access to staff and vendors who need the information for their assigned work.

Where HIPAA does not apply directly, adopting similar safeguards can still reduce risk and support responsible program administration. Collect only what is needed, set retention periods, train staff on confidentiality, and review vendor security practices. Keep program records separate from fundraising or marketing systems unless there is a clear, permitted basis for combining them.

Apply Permitted Uses and Disclosures

Covered entities and business associates may use or disclose PHI only as permitted by the HIPAA Privacy Rule, the applicable agreement, or another legal basis. A covered entity may generally share PHI with its business associate for the work described in a BAA. Disclosures to a foundation that is neither a business associate nor otherwise permitted recipient may require a valid patient authorization.

Before a foundation requests or receives records from a provider or health plan, clarify the purpose, the parties’ roles, and the legal basis for the disclosure. A patient’s own submission of information to a foundation is different from a covered entity disclosing PHI to that foundation. Use clear notices and consent or authorization forms where appropriate, and avoid suggesting that HIPAA itself requires a patient to share information with an independent charity.

When HIPAA permits a use or disclosure, limit the information to what is reasonably necessary for the purpose when the minimum-necessary rule applies. Document the basis for routine information flows, restrict secondary use, and establish a process for handling patient questions, corrections, or requests to withdraw an authorization where applicable.

Assess Patient Copay Transactions

HIPAA electronic transaction standards generally govern covered entities that conduct specified health care transactions electronically, such as claims, eligibility inquiries, and payment or remittance transactions. They do not generally apply to a patient acting on their own behalf when paying a copay by credit or debit card.

A foundation’s payment arrangement should be reviewed based on what it actually does. If the foundation acts on behalf of a covered entity to conduct a standard transaction, the covered entity may need to ensure the transaction follows the applicable standards. By contrast, a patient’s direct payment of a copay is not made subject to those standards merely because it involves a health care expense.

Keep payment processing and assistance eligibility processes distinct where practical. Use secure payment methods, limit financial data collection, and assess whether any vendor or intermediary handles PHI on behalf of a covered entity. The HIPAA electronic transaction standards address specified administrative exchanges; they are not a general format requirement for every payment related to medical care.

Manage Disease-Fund Eligibility and Assistance

A foundation may need information about income, insurance, diagnosis, treatment, or expected costs to determine whether an applicant meets its program criteria. A covered entity’s disclosure of PHI to an independent foundation must have an appropriate legal basis; the foundation should not assume that the patient’s need for assistance by itself authorizes a provider or plan to disclose records.

Design eligibility procedures to request only the information necessary to apply the fund’s published criteria. Explain why each item is requested, who will review it, how it will be protected, and how long it will be retained. Consider whether the applicant can provide documentation directly instead of asking a provider to send records.

Apply eligibility criteria consistently and document decisions in a way that supports review without exposing more personal information than necessary. Restrict case files to authorized staff, establish a secure process for appeals and corrections, and train staff not to reuse eligibility information for fundraising or unrelated outreach without an appropriate basis.

Establish Fundraising Privacy Safeguards

Keep assistance administration and fundraising operations separate. Information gathered to assess eligibility should not automatically be used to solicit donations, and a foundation should not treat a patient’s participation in a program as permission to disclose their diagnosis or assistance status to donors.

HIPAA’s fundraising provisions apply to covered entities and permit certain limited uses or disclosures for fundraising for the covered entity’s own benefit, subject to specific requirements. They do not create a general fundraising permission for every disease fund or copay foundation. If a covered entity uses PHI for a permitted fundraising communication, it must provide a clear, conspicuous opportunity to opt out and honor the individual’s choice.

For any outreach involving health-related information, review the foundation’s role, the source of the information, applicable authorizations and agreements, and relevant state law. Use fundraising lists that do not reveal sensitive patient details, limit access to donor and applicant data, and provide a straightforward way to manage communication preferences. These safeguards help protect applicants while supporting transparent, appropriately limited data practices.

In short, determine the foundation’s legal role before receiving PHI, formalize any business-associate relationship, limit and safeguard information, and keep patient assistance data separate from fundraising activity unless a valid basis permits its use.

FAQs

Are disease fund and copay foundations covered entities under HIPAA?

Not automatically. A foundation is a HIPAA covered entity only if it qualifies as a health plan, health care clearinghouse, or a health care provider that conducts specified electronic transactions. Providing financial assistance or handling health information alone does not make a foundation a covered entity.

When does a foundation qualify as a HIPAA business associate?

A foundation may qualify when it performs a function or service on behalf of a covered entity that involves PHI. The parties should document the relationship with a HIPAA business associate agreement before sharing PHI for that work.

Can a foundation use protected health information to determine assistance eligibility?

It may use information that an applicant provides directly under the foundation’s program procedures, subject to applicable privacy laws and commitments. If a covered entity discloses PHI to the foundation, that disclosure needs an appropriate HIPAA basis, such as a valid authorization or a qualifying business-associate arrangement.

Do HIPAA transaction standards apply to patients paying copays?

Generally, no. The standards apply to covered entities conducting specified electronic health care transactions, not to patients acting on their own behalf when paying a copay. Different requirements may apply if an organization conducts a standard transaction on behalf of a covered entity.