HIPAA Training for Grateful Patient Philanthropy Teams

Grateful patient philanthropy can connect patients and families with ways to support a health care organization, but fundraising must respect the privacy choices and dignity of every patient. The HIPAA Privacy Rule allows certain uses of protected health information (PHI) for fundraising without authorization, subject to specific limits and safeguards.

Use this guidance alongside your organization’s privacy policies and training. The rules below describe federal HIPAA requirements; your organization may impose stricter policies, and other laws may apply.

What patient information may philanthropy teams use for fundraising?

Under the HIPAA Privacy Rule fundraising provision, a covered entity may use or disclose a limited set of PHI for fundraising on its own behalf without a valid HIPAA authorization. The permitted categories include a patient’s name and contact details, age, sex and date of birth; dates of health care; department of service; treating physician; outcome information; and health insurance status. The rule allows disclosure to a business associate or an institutionally related foundation for this purpose. See 45 C.F.R. § 164.514(f).

This list does not include diagnosis information. It also does not give a team unrestricted access to a medical record. Give staff access only to the information and systems they need for their assigned work, consistent with organizational policy and applicable HIPAA requirements.

The covered entity’s notice of privacy practices must tell individuals that it may contact them to raise funds. A notice is not, by itself, permission to use PHI for purposes outside the fundraising rule. Review the organization’s current notice of privacy practices requirements and follow your employer’s approved procedures.

How should teams explain and honor fundraising opt-outs?

Each fundraising communication made under this rule must offer a clear and conspicuous way to stop future fundraising communications. The method cannot impose an undue burden or more than a nominal cost. For example, a clear reply option, email address, or phone number may provide a practical way to submit a request, depending on your organization’s process.

When someone opts out, promptly record the request in the designated system and suppress that person from future fundraising communications covered by the rule. Make the process easy to understand, train staff to route requests correctly, and check that suppression records carry through to mail, email, calling, and vendor lists. The rule allows an organization to offer a way for a person to opt back in.

Do not condition treatment or payment on a patient’s choice about receiving fundraising communications. Keep opt-out handling separate from clinical decisions and make clear that choosing not to receive appeals will not affect care or billing. These requirements are set out in 45 C.F.R. § 164.514(f)(2).

When is written authorization required to use diagnosis information?

Diagnosis information is not among the PHI categories that the fundraising provision permits an organization to use or disclose for fundraising without authorization. If a team plans to use or disclose a patient’s diagnosis for fundraising, that provision alone does not allow it. The covered entity generally needs a valid HIPAA authorization before using or disclosing PHI for a purpose not otherwise permitted by the Privacy Rule, unless another specific HIPAA permission applies. See 45 C.F.R. § 164.508.

A valid authorization must meet HIPAA’s requirements; a general expression of gratitude, a patient’s interest in philanthropy, or language in the notice of privacy practices is not a substitute. Do not infer permission from a patient’s care experience or a physician’s knowledge of the patient. Direct questions about the proposed use to your privacy officer before accessing or sharing health information.

How can staff discuss giving interests without using medical information?

Start with the person’s stated interests, not assumptions based on treatment, diagnosis, prognosis, or a clinician’s private knowledge. You can ask about the programs or community priorities they care about, listen to what they volunteer, and explain appropriate giving options without referring to medical details.

If a patient or family member expresses interest in a conversation with philanthropy, follow your organization’s approved referral process. As a privacy-conscious practice, ask the person whether they would like an introduction and share only the information needed to make it. Avoid discussing clinical details in donor notes, meeting invitations, or prospect briefings unless an authorized and permitted basis applies.

What HIPAA safeguards should teams use when handling fundraising data?

Protect fundraising data as sensitive information when it contains PHI. Use organization-approved systems, keep access limited to assigned roles, verify recipients before sending messages, and avoid placing patient details in personal email, unapproved spreadsheets, or other unsecured tools. Follow your employer’s rules for retaining, correcting, sharing, and securely disposing of data.

Email encryption is an important safeguard to consider when sending electronic PHI. Under the Security Rule, encryption is an addressable implementation specification: the covered entity or business associate must assess whether it is reasonable and appropriate, implement it when appropriate, or document its decision and use an appropriate alternative when applicable. The rule also requires safeguards for access control and transmission security. See 45 C.F.R. § 164.312 and HHS guidance on encryption under the Security Rule.

Training should explain what staff may access, how to recognize and route an opt-out, where to report a suspected disclosure, and which communication channels are approved. Follow employer-specific privacy and security policies; a training completion certificate does not establish that an organization is HIPAA compliant.

How should physicians and development staff coordinate patient outreach?

Coordinate through an approved process that protects the patient’s choice and keeps clinical care separate from fundraising. Physicians and care teams should not use their clinical relationship to pressure a patient to give or signal that a gift would affect care. Development staff should not ask clinicians to disclose diagnoses, treatment details, or other information outside the permitted fundraising categories.

When a patient initiates a philanthropic conversation or agrees to an introduction, staff can follow the organization’s referral procedure and discuss giving interests without requesting access to the medical record. If a proposed outreach depends on clinical information, pause and consult the privacy officer before proceeding.

What limits apply to external service providers and state laws?

A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity may be a business associate. Before sharing PHI with a business associate for fundraising services, the covered entity generally needs a written business associate agreement that limits permitted uses and disclosures and requires appropriate safeguards. A vendor that does not handle PHI generally does not need a business associate agreement solely because it provides fundraising services. See HHS guidance on business associates and business associate agreements.

An institutionally related foundation may receive PHI under the fundraising provision, but do not assume that every foundation or fundraising vendor has the same HIPAA status. Confirm the organization’s relationship, the intended data use, and the appropriate agreement or other legal basis with privacy or legal staff before sharing information.

State privacy laws may provide stronger protections than HIPAA, and certain records may be subject to additional federal rules. For example, federal regulations recognize an exception to HIPAA preemption for state privacy provisions that are more stringent, as described in 45 C.F.R. § 160.203. Records protected by 42 C.F.R. Part 2 may also have separate fundraising protections; HHS states that the applicable final rule’s requirements were to be followed by February 16, 2026, in its Part 2 final rule fact sheet.

In practice, safe grateful patient philanthropy relies on using only permitted information, making opt-outs easy and effective, protecting fundraising data, and checking with privacy staff when a proposed use falls outside the approved process.

FAQs

Can philanthropy teams use patient contact information for fundraising without authorization?

Generally, yes. The HIPAA Privacy Rule permits a covered entity to use or disclose certain listed information—including name and contact details—for fundraising on its own behalf without authorization, provided it follows the rule’s requirements, including applicable notice of privacy practices requirements and opt-out requirements. Confirm that your organization’s use and the recipient are covered by the rule.

Can a patient’s treatment or payment depend on their fundraising choice?

No. A covered entity may not condition treatment or payment on whether a person chooses to receive fundraising communications. A patient’s opt-out must not affect care or payment decisions.

Does discussing a patient’s giving interests require access to diagnosis information?

No. Staff can discuss the patient’s stated interests and explain giving options without accessing or using diagnosis information. The fundraising provision does not include diagnoses among the PHI categories permitted for fundraising without authorization.

When does a fundraising service provider need a business associate agreement?

A provider generally needs a business associate agreement when it performs services on behalf of a covered entity that involve creating, receiving, maintaining, or transmitting PHI. A vendor that handles no PHI generally does not need one solely to provide fundraising services. Have privacy or legal staff assess the vendor’s role and access before data is shared.