ComposableStack.AI CDP
Back to agent
Sourcesource.hhs-gov.hipaa-for-professionals-privacy-guidance-marketing-2026

Marketing — HHS.gov HIPAA Guidance

HHS Office for Civil Rights primary regulatory guidance page on the HIPAA Privacy Rule's Marketing provisions. States that, with limited exceptions (face-to-face communications and promotional gifts of nominal value), a covered entity must obtain an individual's written authorization before using or disclosing protected health information for marketing purposes. Sits alongside companion HHS pages summarizing the Privacy Rule (national standards for protecting individually identifiable health information) and the Security Rule (administrative, physical, and technical safeguards for electronic PHI).

hhs.gov — view original source
confidence 68%v1indexed Jul 28, 2026hipaa, hipaa-marketing-rule, phi, authorization, covered-entities, healthcare, privacy, cdp, regulatory, primary-source, hhs

Marketing — HHS.gov HIPAA Guidance

Fetch status: Tier 1 (hhs.gov, direct) attempted and 403-blocked. Content below is reconstructed from search-result snippets of the live page and companion HHS pages (Privacy Rule summary, Security Rule summary), not a verified full-page fetch. Treat as directionally reliable but re-verify before raising confidence above 0.68.

Marketing Rule

The HIPAA Privacy Rule gives individuals control over whether and how their protected health information (PHI) is used and disclosed for marketing purposes. With limited exceptions, the Rule requires an individual's written authorization before PHI can be used or disclosed for marketing.

Companion Rules (same HHS "for professionals" hub)

KG Relevance

Primary-source grounding for constraint.hipaa-phi-cdp-healthcare, which currently cites secondary sources only (source.hipaajournal-com.hipaa-marketing-rules-2025, source.hipaajournal-com.hipaa-privacy-rule-2026, source.chesshealthsolutions-com.2026-hipaa-rule-updates-2025). This source corroborates the written-authorization requirement those secondary sources describe but does not yet raise the constraint's confidence — see pre-write self-check and bias_note above. A successful direct fetch or Wayback capture in a future run should supersede this node's fetch_status and raise confidence.