means, to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, unless the communication is made: to provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if the financial remuneration received by the covered entity in exchange for making the communication is reasonable in relation to the covered entity’s costs of making the communication; or for the following purposes except where the covered entity receives financial remuneration in exchange for the communication to describe a health–related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication (including communications about the entities participating in a health care provider network or health plan network; replacement of, or enhancements to, a health plan; and health related products or services available only to a health plan enrollee that add value to, but are not part of, a plan of benefits); or for treatment of the individual, including case management or care coordination, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual; or for case management or care coordination, contacting of individuals with information about treatment alternatives and related functions to the extent that these activities do not fall within the definition of treatment.

A data set of protected health information that excludes all of the 16 HIPAA specified direct identifiers related to an individual or of relatives, employers, or household members of the individual, but retains geographic subdivisions larger than the postal address, elements of dates including month and day as well as other unique identifying numbers, characteristics or codes not previously listed as a direct identifier and cannot reasonably be used to identify an individual. Limited data sets may only be used for research, public health or for health care operations; and only in conjunction with a data use agreement .

FAQs Archive

Q: Manifestation or Manifested

means that an individual has been or could reasonably be diagnosed with a given disease, disorder, or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved. A given disease, disorder or condition is no manifested if the diagnosis is based principally on genetic information.

Q: Legally Authorized Representative

A person authorized either by state law or by court appointment to make decisions, including decisions related to health care, on behalf of another person, including someone who is authorized under applicable law to consent on behalf of a prospective subject to the subject’s participation in the procedure involved in the research.

Q: IT Security Incident (‘Incident’)

is any activity that harms or represents a serious threat to the whole or part of an organizations computer, telephone and network–based resources such that there is an absence of service, inhibition of functioning systems, including unauthorized changes to hardware, firmware, software or data, unauthorized exposure, change or deletion of PHI , or a crime or natural disaster that destroys access to or control of these resources. Routine detection and remediation of a ‘virus’, ‘malware’ or similar issue that has little impact on the day–to–day business of the organization is not considered an Incident.