HIPAA Training for Hospital Foundation Fundraising Teams: What You Need to Know

Hospital fundraising can support patient care, research, and community programs, but using protected health information (PHI) for fundraising is subject to specific limits under the HIPAA Privacy Rule. Your team should know which information may be used, when it may be shared with a foundation, and how to manage patients’ opt-out requests.

These requirements apply to fundraising for the covered entity’s own benefit. They do not give a hospital or foundation general permission to use patient records for donor prospecting or unrelated charitable campaigns.

What PHI may hospital foundations use for fundraising?

For fundraising on a covered entity’s behalf, the HIPAA Privacy Rule allows the covered entity to use, or disclose to a business associate or institutionally related foundation, a limited set of PHI without individual authorization. The permitted categories are demographic information—including name, address, other contact information, age, gender, and date of birth—dates of health care provided, department of service, treating physician, outcome information, and health insurance status. See 45 CFR § 164.514(f).

This permission does not include unrestricted access to a medical record. Diagnosis details, clinical notes, and other information outside the listed categories should not be used for fundraising under this exception. If the fundraising activity falls outside the exception, the hospital generally needs a valid individual authorization unless another Privacy Rule permission applies.

When may a hospital disclose PHI to an institutionally related foundation?

A hospital may disclose the permitted fundraising information to an institutionally related foundation when the fundraising is for the hospital’s own benefit and the foundation meets the applicable criteria. HHS’s explanation of the rule describes such a foundation as a nonprofit charitable foundation that qualifies under section 501(c)(3) and whose charter explicitly links its charitable purpose to the covered entity. A general-purpose charity that might give money to a hospital does not qualify on that basis alone. See the HHS final-rule discussion of institutionally related foundations.

Before transferring information, confirm the foundation’s status and relationship to the hospital, the fundraising purpose, the specific fields to be shared, and the arrangements for safeguarding and using the information. Do not assume that an organization qualifies simply because it supports health-related causes.

How must the Notice of Privacy Practices explain fundraising?

If the hospital intends to use or disclose PHI for fundraising under this permission, its Notice of Privacy Practices (NPP) must separately tell individuals that the covered entity may contact them to raise funds and that they have the right to opt out. The requirement appears in 45 CFR § 164.520(b)(1)(iii)(A).

Keep the notice consistent with actual practices. Fundraising materials must also provide the required opt-out opportunity; an explanation in the NPP does not replace the opportunity that must accompany each fundraising communication. If the hospital intends to use or disclose records subject to 42 CFR Part 2 for fundraising, the NPP rule includes a separate requirement to offer a clear and conspicuous opportunity to opt out before fundraising communications are made.

How should teams provide and honor fundraising opt-outs?

Each fundraising communication using this HIPAA permission must include a clear and conspicuous way for the recipient to stop future fundraising communications. The method cannot impose an undue burden or more than a nominal cost. The hospital must not send further fundraising communications covered by this provision to someone who has opted out. See 45 CFR § 164.514(f)(2).

Make the process easy to use—for example, offer a simple reply option or a clear contact method—and promptly share opt-out requests with the teams and vendors involved in fundraising. Maintain a reliable suppression process so an individual’s choice is respected across applicable communication channels. The regulation permits, but does not require, a method for an individual to opt back in.

How does the minimum necessary standard apply to fundraising?

Fundraising for the covered entity’s benefit is a health care operations activity, and the minimum necessary standard requires covered entities to make reasonable efforts to use, disclose, and request only the PHI needed for the purpose. The fundraising provision’s list of permitted information sets an additional boundary: access to one listed category does not mean every record containing that category is appropriate for a campaign. See the HHS summary of the HIPAA Privacy Rule and 45 CFR § 164.514(f).

Define which fields are needed for each fundraising purpose, use role-based access, and avoid exporting entire records when a limited data set of permitted fields will do. The standard does not require the use of every category allowed by the rule; teams should use only what is reasonably needed.

When is individual authorization required?

For fundraising, the exception applies only when the covered entity uses or discloses the listed categories for raising funds for its own benefit and meets the accompanying requirements, including the NPP and opt-out rules. If a proposed use or disclosure falls outside that permission—for example, it involves PHI beyond the permitted categories or fundraising for another organization’s independent benefit—the hospital generally must obtain a valid individual authorization unless a different Privacy Rule permission applies.

A valid HIPAA authorization is distinct from a general consent or a fundraising opt-out. Review the proposed purpose, information, recipient, and communication with the hospital’s privacy officer before proceeding, and use the applicable requirements in 45 CFR § 164.508 when authorization is required.

How should workforce access to fundraising PHI be limited?

Give fundraising PHI only to workforce members whose duties require it, and limit their access to the information and systems needed for those duties. The Privacy Rule requires role-based policies and procedures for internal access, and the Security Rule requires workforce security measures for electronic PHI. See the HHS minimum-necessary guidance and 45 CFR § 164.308.

Training should cover the hospital’s policies, the permitted fundraising data, proper handling of opt-outs, and how to report mistakes or suspected disclosures. HIPAA requires training appropriate to workforce members’ functions, training for new workforce members within a reasonable period, and training when relevant policies materially change; it also requires documentation that training was provided. The rule does not establish a universal annual training or certificate-renewal schedule. A completion certificate can document training, but it does not by itself establish organizational HIPAA compliance. See 45 CFR § 164.530(b).

In short, hospital foundation fundraising teams should use only PHI permitted for fundraising on the covered entity’s behalf, confirm that a foundation qualifies before sharing information, provide and honor opt-outs, and restrict workforce access to what is needed. Training should reflect your organization’s policies and the actual responsibilities of each role.

FAQs.

Can a hospital foundation use patient information for fundraising without authorization?

It may use information disclosed by the hospital for fundraising on the covered entity’s own behalf when the foundation qualifies as institutionally related and the use follows HIPAA’s limits. Without authorization, the fundraising permission covers only the listed PHI categories and is subject to the NPP and opt-out requirements.

Which PHI may be used for hospital fundraising?

The permitted categories are demographic information, dates of health care provided, department of service, treating physician, outcome information, and health insurance status. The hospital should not treat this list as permission to access or use an entire patient record.

Can a patient opt out of fundraising communications?

Yes. Each fundraising communication covered by this permission must provide a clear and conspicuous opportunity to opt out, using a method that does not impose an undue burden or more than a nominal cost. The covered entity may not send further fundraising communications under this permission after the individual opts out.

Can treatment or payment be affected by a fundraising opt-out?

No. A covered entity may not condition treatment or payment on an individual’s choice about receiving fundraising communications.