What are the Texas Medical Records Privacy Act Marketing Rules?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Note: Compliancy Group cannot advise prospects or clients as to whether HB 300 applies to them. This issue is a question of law, and clients and prospects should consult a qualified attorney before proceeding.

The Texas Medical Records Privacy Act (TMRPA) contains rules on how PHI may be used for marketing purposes.

TMRPA-covered entities must, in general, obtain clear and unambiguous permission (which can be in written or electronic form) to disclose PHI for any marketing communication.

TMRPA-covered entities need not obtain this permission, if the marketing communication is:

(1)  in the form of a face-to-face communication made by a covered entity to an individual;

(2)  in the form of a promotional gift of nominal value provided by the covered entity;

(3)  necessary for administration of a patient assistance program or other prescription drug savings or discount program;  or

(4)  made at the oral request of the individual.

TMRPA-covered entities may use or disclose PHI to send written marketing communications through the mail. TMRPA-covered entities are required to implement certain safeguards before mailing. The communication must be sent in an envelope that shows only the names and addresses of the sender and the recipient. In addition, the communication to be sent in the envelope must contain certain required content. This content must:

(1)  state the name and toll-free number of the entity sending the marketing communication;  and

(2)  explain the recipient's right to have the recipient's name removed from the sender's mailing list.

HB 300-covered entities must provide individuals with written marketing communication opt-out rights. If a person receives a request from an individual to have that individual's name removed from a mailing list, the person must remove the name, not later than the 45th day after the person receives the request. that their name be removed from a mailing list,

As noted above, marketing communications made at the oral request of an individual do not require clear and unambiguous permission in written or electronic form. However, marketing communications made at the oral request of an individual do require clear and unambiguous verbal permission for PHI use or disclosure. Marketing communications for which verbal permission is required must be limited to the scope of the verbal permission.

Note: The rule on marketing was passed as part of the original TMRPA in 2001. When HB 300 amended the TMRPA in 2011, the marketing rule was retained.