Hospice and/or Hospital Foundations - BAA or not?

  • 1.  Hospice and/or Hospital Foundations - BAA or not?

    Posted 08-17-2020 01:39 PM

    Hi - I have been approached by the VP of fundraising for our hospice who wishes to approach caregivers of hospice patients who have left positive messages for fundraising purposes.  They would be obtaining the information from patient records, and the hospice foundation that does fundraising is a separate entity from hospice and it has been asked if the fundraising VP can access this PHI or would a BAA be needed?  I haven't seen this type of requirement for any type of foundation - hospice, hospital or otherwise - but now I am starting to wonder if this truly is needed.  If not, is there something I can point to that shows the foundation is not a BAA or at least part of the organization?  The LLC is the tricky part.

    Thank you for any assistance

    Lance Smith
    Privacy Officer
    St. Peter's Health Partners
    East Greenbush,NY

  • 2.  RE: Hospice and/or Hospital Foundations - BAA or not?

    Posted 08-18-2020 10:49 AM
    Hi Lance,

    Admittedly, fundraising isn't an area I'm too familiar with. However, based on what I think I know, assuming your VP of fundraising is part of your Covered Entity, your VP of fundraising would be permitted, under HIPAA, to use specified types of PHI for fundraising purposes. Do I understand correctly, in your scenario, that while your VP of fundraising may use PHI to acquire the caregiver names, he/she wouldn't necessarily need to disclose the same PHI to the foundation; he/she would simply be providing the caregiver names? More specifically, can the VP of fundraising give the foundation caregiver names without disclosing PHI?

    Anthony Ambrose, MBA, CHC, CHPC
    Compliance Officer
    Service Access and Management, Inc.
    Lewisburg, PA


  • 3.  RE: Hospice and/or Hospital Foundations - BAA or not?

    Posted 08-18-2020 12:43 PM
    Good morning,

    Not a lawyer, and there are certainly some complexities with this, but you may want to be careful.  This could possibly be construed as a Marketing related activity and thus you may need a signed authorization in order to conduct the outreach.

    Certainly interested to hear others thoughts!

    Aaron McCoy
    Privacy & Compliance Officer
    The Portland Clinic, LLP