The Essential HIPAA Compliance Guide for Hospital Foundation Fundraising Offices

HIPAA Compliance in Fundraising

Hospital foundations can fundraise effectively while complying with the HIPAA Privacy Rule. The rule allows a covered entity or its institutionally related foundation to use or disclose limited Protected Health Information (PHI) to support fundraising for the benefit of the hospital, provided you follow strict safeguards.

Your core duties are to: limit PHI to what HIPAA expressly permits for fundraising, honor the Minimum Necessary Standard, include a clear and conspicuous opt-out in every fundraising communication, promptly honor opt-outs across all channels, and ensure workforce and vendor accountability through training, access controls, and agreements.

Think of compliance as an operating model: define permissible data, control data flows from hospital to foundation, standardize fundraising communications language, centralize preferences and suppression lists, and audit regularly. Done well, you protect patient trust and sustain philanthropy.

Permissible PHI for Fundraising

Without patient authorization, you may use or disclose only the following PHI for fundraising for the benefit of the covered entity:

• Basic demographic and contact information (for example, name, address, phone, email).
• Dates of health care provided (such as admission or discharge dates, or the month/year of a visit).
• Department of service (e.g., cardiology, pediatrics) but not diagnosis or treatment details.
• Treating physician’s name.
• General outcome information (for example, overall improvement or if the individual died), not clinical specifics.
• Health insurance status (e.g., insured/uninsured).

Examples of what you may not use without Patient Authorization include diagnosis (e.g., breast cancer), procedure details (e.g., mastectomy), lab results, images, clinical notes, medications, or any narrative about an individual’s care. Avoid inferences that reveal a diagnosis; for instance, “oncology—breast clinic” can imply condition-specific information and should be excluded unless you have authorization.

Practical tip: configure your CRM to accept only the permitted fields, suppress free-text, and log provenance so you can prove that outreach lists contain only allowed PHI.

Authorization Requirements

You must obtain a valid Patient Authorization before using or disclosing PHI for fundraising beyond the permitted set. Authorization is required when you:

• Reference or use diagnosis, procedures, test results, images, or detailed treatment information.
• Use patient stories, testimonials, names with clinical context, or photos that identify someone as a patient.
• Target by a sensitive program (for example, mental health, substance use disorder, HIV, reproductive health) or by condition.
• Share PHI with parties not covered by HIPAA’s specific fundraising allowance.

A valid authorization must clearly describe what PHI will be used, by whom, for what purpose, to whom it will be disclosed, include an expiration date or event, inform the individual of the right to revoke, and be signed and dated. Remember: an opt-out from fundraising communications is not the same as an authorization; you still need explicit authorization to use condition-specific PHI.

Coordination of Fundraising Activities

Data governance and list building

• Create a standardized data extract from the hospital that includes only permissible elements (contact information, dates, department of service, treating physician, outcome, insurance status).
• Exclude “sensitive departments” by default if they could disclose a condition, unless the individual has given Patient Authorization.
• Use a single preference center and suppression list to capture and honor opt-outs across mail, email, phone, and digital ads.

Workflow and controls

• Route all grateful patient programs through privacy review; document the lawful basis for each campaign.
• Embed approval checkpoints: data export by hospital privacy, receipt and validation by the foundation, and pre-send compliance review of fundraising communications.
• Train development staff annually on permissible PHI, Minimum Necessary Standard, and how to respond to privacy complaints.

Patient experience safeguards

• Make the opt-out simple and cost-free; confirm preferences in writing or by email.
• Do not condition treatment, payment, or benefits on a decision to receive or decline fundraising communications.
• Coordinate timing with patient relations to avoid outreach that could appear coercive.

Business Associate Agreements

Third parties that create, receive, maintain, or transmit PHI to support your fundraising are business associates and require a Business Associate Agreement (BAA). Common examples include mail houses handling PHI-based lists, fundraising CRMs that store hospital-derived PHI, wealth screening or analytics firms using PHI fields, and digital agencies executing targeted campaigns from PHI-derived audiences.

An institutionally related foundation may receive the permitted PHI directly from the covered entity for fundraising without a BAA; however, put a written data-sharing arrangement in place to memorialize scope, safeguards, and roles. If the foundation engages vendors who will access PHI, execute BAAs with those vendors (and, where appropriate, with the covered entity) so obligations and breach notification lines are clear.

What every BAA should address

• Permitted uses/disclosures limited to fundraising services for the benefit of the hospital.
• Safeguards (administrative, physical, and technical), access controls, and encryption at rest and in transit.
• Subcontractor flow-down obligations for any downstream service providers.
• Breach and security incident reporting timelines and cooperation requirements.
• Return or destruction of PHI at contract end and audit rights during the term.

If you share only the foundation’s independent donor records that are not derived from PHI, a BAA may not be required; reassess if any field indicates patient status or originates from hospital PHI, in which case treat it as PHI.

Minimum Necessary Standard

The Minimum Necessary Standard requires you to limit PHI used or disclosed for fundraising to what is reasonably necessary for the purpose. In practice, this means:

• Share only the specific fields your campaign needs (e.g., mailing address and service date range), not the entire extract.
• Apply time windows (for example, discharges in the last 6–12 months) and remove duplicate or stale records.
• Mask or generalize where possible (e.g., “surgical services” instead of a highly specific subclinic) unless you have Patient Authorization.
• Restrict staff access on a need-to-know basis and log all exports, imports, and suppressions.

Review lists before every send, verify that opt-outs are excluded, and document the Minimum Necessary rationale in the campaign record.

Fundraising Policy Compliance

A strong policy translates HIPAA requirements into daily practice. Your policy should define permissible PHI, outline the Minimum Necessary Standard, specify approval workflows, prescribe required language for fundraising communications (including a simple opt-out), and set roles for the privacy officer, development leadership, and IT.

Operational checklist

• Data map of sources, fields, transfers, retention, and deletion schedules.
• Template opt-out notices and scripts for phone, mail, and email.
• Central preference management and cross-channel suppression syncing.
• BAA inventory and vendor risk assessments before any PHI access.
• Annual staff training, plus spot audits of campaigns and complaint handling.
• Incident response plan covering misdirected mail, email errors, or data leakage.

Conclusion

HIPAA allows effective, respectful philanthropy when you use only permitted PHI, obtain Patient Authorization for anything more, honor the Minimum Necessary Standard, include and enforce easy opt-outs in all fundraising communications, and hold vendors to strong safeguards through a Business Associate Agreement. With clear governance and disciplined execution, your foundation can inspire giving while protecting patient trust.

FAQs

What PHI can be used for hospital foundation fundraising without patient authorization?

You may use basic demographics and contact details, dates of health care provided, department of service, treating physician, general outcome information, and insurance status. Do not use diagnosis, procedures, test results, or clinical notes without Patient Authorization.

How must fundraising activities be coordinated under HIPAA?

Establish a privacy-reviewed data extract with only permitted fields, manage a single preference and suppression system, include a clear opt-out in every fundraising communication, train staff, and run pre-send compliance checks. Coordinate timing and messaging with patient relations to avoid any perception of coercion.

When is patient authorization required for using PHI in fundraising?

Authorization is required when you use or disclose PHI beyond the permitted set—such as diagnosis, procedure details, clinical narratives, images, or condition-based targeting—or when featuring identifiable patient stories or photos. The authorization must be explicit, written, and revocable.

What are the requirements for third-party vendors accessing PHI for fundraising?

Vendors that handle PHI must sign a Business Associate Agreement specifying permitted uses, safeguards, subcontractor flow-downs, breach reporting, and PHI return or destruction. If a separate foundation receives permitted PHI, memorialize data sharing and ensure any downstream vendors with PHI access also execute BAAs and meet security expectations.