Hospital fundraising and HIPAA: data and opt-outs

A hospital foundation, a nonprofit health system or a community clinic with a development office will at some point want to write to former patients. The HIPAA Privacy Rule allows it, within limits. Those limits are narrow and specific: a short list of patient information, a statement in the notice of privacy practices, an opt-out in every appeal and a list that actually honors the opt-outs. A fundraising appeal is not a marketing email or a newsletter, and it follows its own rule.

This guide goes deeper on the fundraising rule than our other guides. Our HIPAA marketing rules guide explains where fundraising ends and marketing begins, the hospital marketing compliance guide maps the wider rules for hospital teams, and the direct mail guide covers envelopes, mailing vendors and printed newsletters. Here we cover what counts as a fundraising communication, which patient information an appeal may use, the notice statement, how to design the opt-out, phone and email appeals, patient stories, donation pages and event receipts.

This is general information, not legal advice. Sources cited were checked on October 29, 2026: 45 CFR 160.103, 164.501, 164.502, 164.508, 164.514(f) and 164.520 on eCFR, the HHS final rule of January 25, 2013 (78 FR 5566, fundraising discussion at 78 FR 5618 to 5622), and 26 U.S.C. 170 and 6115. State charitable solicitation and privacy laws may add requirements. Have your privacy officer and counsel review your own program.

First question: is HIPAA involved at all?

The fundraising rule at 45 CFR 164.514(f) applies to HIPAA covered entities, such as a health care provider who transmits any health information in electronic form in connection with a transaction covered by the HIPAA rules (45 CFR 160.103), and to the business associates and institutionally related foundations they share patient information with. If your organization is not a covered entity, these rules may not apply in the same way; our HIPAA marketing rules guide starts with that question. Ask counsel if you are unsure.

The second question is whether the appeal uses patient information at all. The 2013 final rule says the notice and opt-out requirements apply only where the covered entity is using or disclosing protected health information to target the fundraising communication. It gives an example: if a covered entity uses a public directory to mail fundraising communications to all residents in a particular geographic service area, the notice and opt-out requirements are not applicable (78 FR 5622). An appeal to a purchased community list, to past donors who gave through a public event or to your own staff is a different exercise from an appeal to people pulled out of the patient system. Keep the lists and their sources separate, so you always know which rules apply to which name.

What counts as a fundraising communication

The 2013 final rule describes a fundraising communication as a communication to an individual, made by a covered entity, an institutionally related foundation or a business associate on behalf of the covered entity, for the purpose of raising funds for the covered entity (78 FR 5620 to 5621). It quotes the Department’s earlier statement that permissible fundraising activities “include appeals for money, sponsorship of events, etc.” and “do not include royalties or remittances for the sale of products of third parties (except auctions, rummage sales, etc.)”.

Two limits follow from that wording. First, the rule covers raising funds for the covered entity itself. 45 CFR 164.514(f)(1) permits uses and disclosures “for the purpose of raising funds for its own benefit”, and 45 CFR 164.501 lists “fundraising for the benefit of the covered entity” among health care operations. An appeal on behalf of an unrelated charity, even a worthy one, is outside this rule. Second, a letter that promotes a service, a new clinic or a screening program is not fundraising because a foundation sent it. Whether it is marketing is a separate question under 45 CFR 164.501 and 164.508(a)(3), covered in our HIPAA marketing rules guide.

The patient information an appeal may use

Under 45 CFR 164.514(f)(1), a covered entity may use, or disclose to a business associate or to an institutionally related foundation, the following protected health information for its own fundraising without an authorization:

Demographic information, including name, address, other contact information, age, gender and date of birth.
Dates of health care provided to the individual.
Department of service information. The 2013 final rule says this includes information about the general department of treatment, such as cardiology, oncology or pediatrics (78 FR 5622).
Treating physician.
Outcome information. The final rule says this includes information regarding the death of the patient or any sub-optimal result of treatment or services.
Health insurance status.

The list is the whole permission. Diagnosis is not on it. The 2013 preamble records that commenters asked for diagnosis, medical record numbers and other identifiers to be added (78 FR 5620), and the final rule added department of service, treating physician and outcome information, not diagnosis. Under 45 CFR 164.508(a)(1), a covered entity may not use or disclose protected health information without a valid authorization except as otherwise permitted, so a segment built on a diagnosis, a procedure or a medication falls outside the fundraising permission unless the patient signed an authorization.

Outcome information has a stated purpose. The final rule says the Department intends it to be used to screen and eliminate from fundraising solicitations those individuals experiencing a sub-optimum outcome, and to be disclosed to a business associate or institutionally related foundation only where that screening is done by those parties (78 FR 5622). In practice, outcome data is there to keep appeals away from families who lost someone or had a bad result, not to write warmer letters to people who did well.

The minimum necessary standard still applies. The final rule says a covered entity must apply 45 CFR 164.502(b) to ensure that only the minimum amount of protected health information necessary is used or disclosed. If your foundation only needs names, addresses and a department to run a cardiology appeal, send only those fields.

The statement in your notice of privacy practices

No appeal may use patient information until the notice is right. 45 CFR 164.514(f)(2)(i) says a covered entity may not use or disclose protected health information for fundraising unless the statement required by 164.520(b)(1)(iii)(A) is in its notice of privacy practices. That statement must inform patients that the covered entity may contact them to raise funds for the covered entity and that they have a right to opt out of receiving such communications.

Check the notice that is actually posted on your website and handed out at registration, not a draft in a shared folder. If you are adding fundraising to an organization that did not do it before, the notice has to change first. Our website privacy policy guide explains how the notice of privacy practices and a website privacy policy differ.

Substance use disorder records have an extra step. Under 45 CFR 164.520(b)(1)(iii)(E), if a covered entity that creates or maintains records subject to 42 CFR part 2 intends to use or disclose those records for fundraising for its own benefit, the individual must first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications. In other words, the opportunity to opt out has to come before the first appeal, not with it. Our guide to addiction treatment marketing covers the wider rules for these programs.

The opt-out in every appeal

45 CFR 164.514(f)(2)(ii) requires that each fundraising communication give the individual a clear and conspicuous opportunity to elect not to receive any further fundraising communications, and that the method not cause an undue burden or more than a nominal cost. The 2013 final rule explains what that means in practice (78 FR 5621):

Simple methods. Covered entities “should consider the use of a toll-free phone number, an email address, or similar opt out mechanisms” that are simple, quick and inexpensive. A local phone number can be acceptable where appropriate.
No letters. The Department continues to consider requiring individuals to write and send a letter to be an undue burden. A pre-printed, pre-paid postcard is an appropriate alternative.
More than one method is fine. Covered entities may offer several methods, or a single method that is reasonably accessible to all individuals wishing to opt out.
Your choice of scope. The opt-out may apply to all future fundraising communications or to a specific campaign, or you may offer both, but the communication should clearly inform individuals of their options and any consequences of opting out.
All channels. If an individual opts out, the opt-out is effective for all forms of fundraising communications, and the individual must be removed from all such lists, mail and email alike.

Clear and conspicuous means the opt-out is easy to find. A line in light gray type under the signature, or a link that leads to a page asking the donor to log in, works against that. Put the opt-out where a reader looking for it would look, in the same type size as the body text, and say what it does in plain words, for example that it stops future fundraising letters, calls and emails from the foundation.

Two more rules close the loop. 45 CFR 164.514(f)(2)(iii) says a covered entity may not condition treatment or payment on the individual’s choice about fundraising communications, so no registration form, portal or consent packet should make an opt-out look like it affects care. And 164.514(f)(2)(iv) says a covered entity may not make fundraising communications to an individual who has opted out. The final rule notes that this replaced an older “reasonable efforts” standard, and says covered entities choosing to send fundraising communications must have data management systems and processes in place to timely track and flag those who opted out (78 FR 5621).

Opting back in

Under 164.514(f)(2)(v), a covered entity may give someone who opted out a way to opt back in. The final rule leaves the method to the covered entity and gives an example: a phone number in a routine newsletter to all patients that individuals can call to be put on a fundraising list. It also says an opt-out should not automatically lapse after a period of time, and that a donation from someone who opted out does not, absent a separate election to opt back in, automatically add them back onto the fundraising list (78 FR 5621). If a former patient who opted out sends a gift, thank them and record the gift, but keep the opt-out flag in place unless they ask to be added back.

No pre-solicitation notice required, with one exception

The final rule does not require covered entities to send a separate opt-out notice before the first fundraising communication, because the notice of privacy practices and the opt-out in the first appeal give individuals the chance to opt out (78 FR 5622). The exception is substance use disorder records covered by 42 CFR part 2, described above, where 164.520(b)(1)(iii)(E) asks for the opportunity to opt out first.

Phone, email and text appeals

The opt-out rule is not limited to letters. The final rule says fundraising communications can take many forms, including communications made over the phone, and that callers must clearly inform individuals that they have a right to opt out of further solicitations; the rule text says each fundraising communication “made” rather than “sent” for that reason (78 FR 5622). A phone script for a fundraising call should include the opt-out early, and the caller needs a way to record it the same day. Our phone script guide shows how we structure scripts in general.

Email and text appeals need the same opt-out, and an opt-out received by email has to reach the mail list and the call list too. If an outside platform sends appeals using patient information, it is handling protected health information on your behalf; our email marketing guide explains how to think about email platforms and patient lists. Other laws on calls, texts and email may also apply, so have counsel review the channel as well as the content.

Grateful patient stories and named physicians

Treating physician is on the permitted list, so an appeal may go to patients of a particular physician, and a letter may be signed by that physician. That is different from telling the story of a particular patient. 45 CFR 164.514(f)(1) allows a covered entity to use the listed information, or disclose it to a business associate or an institutionally related foundation. It does not cover publishing a patient’s name, photo or story in an appeal, an annual report, a donor wall or a gala video. Those need a signed authorization under 45 CFR 164.508, and our guides to patient photo and video consent and patient testimonials describe the process.

Thank-you messages need the same care. A donor list that names patients, or a thank-you letter that mentions the reason for a stay, discloses more than the fundraising rule allows unless the patient agreed to it in writing. Agree with the foundation in advance on what may appear in donor recognition and how a patient-donor can choose to give anonymously.

Donation pages and online giving

A donation page is a website, and the same tracking questions apply. A visitor who arrives from an appeal sent to cardiology patients is, by that route, a cardiology patient. Keep advertising and analytics tags that send visitor data to third parties off pages reached from patient-targeted appeals unless your privacy officer has cleared them. Our guide to tracking pixels on practice websites explains the risks, and our medical website design page describes how we build forms and pages.

Keep the donation page plain and honest. Say who receives the gift (the hospital, the foundation or a named fund), what the gift supports in general terms you can stand behind and how donors can contact the development office. Do not ask for health information on a donation form; it is not needed to give.

Event tickets and gift receipts

Galas, golf days and benefit dinners raise a tax point that is easy to miss. Under 26 U.S.C. 6115, if an organization described in 26 U.S.C. 170(c) (other than government entities) receives a quid pro quo contribution in excess of $75, meaning a payment made partly as a contribution and partly for goods or services, it must provide a written statement that tells the donor the deductible amount is limited to the excess over the value of the goods or services, and gives a good faith estimate of that value. Separately, under 26 U.S.C. 170(f)(8), no deduction is allowed for a contribution of $250 or more unless the donor has a contemporaneous written acknowledgment from the organization that includes the amount of cash and a description of any other property, whether goods or services were provided and a description and good faith estimate of their value. Your finance team or tax adviser should own the wording; marketing should make sure event pages and receipts leave room for it.

Event invitations sent to patients by name are fundraising communications and need the opt-out. If the event also includes a free screening for attendees, the screening part is a health service, and our guide to health fair and screening event marketing covers that side.

When a business offers to sponsor a foundation event or to put its name on a room or program, the tax line between acknowledgment and advertising, and the referral questions, are in our guide to sponsorships and naming rights.

Working with a foundation or an outside vendor

45 CFR 164.514(f)(1) names two recipients for disclosures of fundraising data: a business associate and an institutionally related foundation. A direct mail house, a calling vendor or a donor database provider that receives patient-derived lists on your behalf is a business associate, and the written agreement should cover the fundraising work. Agree on these points in writing before the first file moves:

Fields. Which of the six permitted categories go to the foundation or vendor, and nothing else.
Outcome screening. Who removes deceased patients and patients with a sub-optimal outcome, and when, before each mailing or call list.
Opt-outs. One shared suppression list, how fast a new opt-out reaches every channel, and who checks it before each send.
Use limits. Patient-derived data is used only for the covered entity’s own fundraising, not shared, rented or used for other charities.
Records. Where the list lives, who can see it and how it is returned or destroyed when the work ends.

Illustration: fixing a hospital foundation’s year-end appeal

Illustration. A nonprofit community hospital’s foundation plans a year-end letter to patients discharged in the last two years. The draft file from the hospital includes diagnosis codes so the foundation can write separate letters for heart patients and cancer patients. The opt-out reads “To be removed, write to the Foundation Office” in small type. The donor database has a separate email list that does not share the mail list’s opt-outs. The letter tells the story of a named former patient who sent a thank-you card.

Notice. The privacy officer confirms the posted notice of privacy practices includes the fundraising statement required by 164.520(b)(1)(iii)(A).
Fields. The diagnosis codes come out. The hospital sends department of service instead, which lets the foundation write a cardiology letter and an oncology letter within 164.514(f)(1).
Outcome screen. The hospital removes deceased patients and patients with a sub-optimal outcome before the file goes to the foundation.
Opt-out. The letter now offers a phone number and an email address in body-size type, says the opt-out covers all future fundraising mail, calls and email, and the foundation merges the suppression lists.
Story. The named patient’s story stays only if the patient signs an authorization under 164.508. Otherwise the letter describes the cardiology unit’s work in general terms.
Receipts. The finance team reviews the gift acknowledgment template against 26 U.S.C. 170(f)(8).

Checklist before an appeal goes out

Confirm the appeal raises funds for your own organization, not another charity, and does not promote a service.
Know which names came from patient records and which came from public or donor-only sources.
Check that the posted notice of privacy practices includes the fundraising statement.
Use only the six permitted categories of patient information, and only the fields you need.
Screen out deceased patients and those with a sub-optimal outcome before each send.
Put a clear and conspicuous opt-out in every letter, email, text and call script, with a method that is not a written letter.
Run every name against one suppression list that covers all channels.
Keep opt-outs in place after a gift unless the person asks to opt back in.
Get a signed authorization before naming or showing a patient in any appeal, report or event.
For part 2 substance use disorder records, give the opportunity to opt out before the first appeal.
Keep third-party tracking off donation pages reached from patient-targeted appeals unless cleared.
Have finance review event pages and receipts against 26 U.S.C. 6115 and 170(f)(8).

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices and health organizations. For a fundraising program, that can mean a donation page without third-party ad tags, an opt-out page and phone line that are easy to find, call scripts with the opt-out up front and a clear split between fundraising, marketing and patient communications on your website. We do not sell or rent patient or donor lists. Our work is built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

Can a hospital foundation write to former patients without an authorization?

Yes, within limits. Under 45 CFR 164.514(f), a covered entity may use, or disclose to a business associate or an institutionally related foundation, demographic information, dates of care, department of service, treating physician, outcome information and health insurance status for its own fundraising, provided the notice of privacy practices includes the fundraising statement and every appeal includes an opt-out.

Can we target an appeal by diagnosis?

Not under the fundraising permission. Diagnosis is not among the categories listed in 45 CFR 164.514(f)(1). The 2013 final rule added department of service, treating physician and outcome information, so a cardiology or oncology appeal can use the department instead.

What opt-out method is acceptable?

One that is clear and conspicuous and does not cause an undue burden or more than a nominal cost. The 2013 final rule suggests a toll-free number, an email address or similar methods, says a pre-printed, pre-paid postcard is acceptable and says requiring a written letter is an undue burden.

Does an opt-out from mail also stop emails and calls?

Yes. The 2013 final rule says that if an individual opts out of future fundraising communications, the opt-out is effective for all forms of fundraising communications and the individual must be removed from all such lists.

If someone who opted out sends a donation, can we put them back on the list?

Not automatically. The 2013 final rule says a donation does not, absent a separate election to opt back in, add the individual back onto the fundraising list. You may offer a way to opt back in under 164.514(f)(2)(v).

Do the rules apply to a community-wide mailing?

Not if no patient information is used to target it. The 2013 final rule gives the example of mailing to all residents of a service area from a public directory, where the notice and opt-out requirements are not applicable.

Sources

More in Facilities, care services and pharmacy

Hospital and health nonprofit fundraising appeals: HIPAA data limits, opt-outs and donor lists