HIPAA Fundraising Restrictions (45 CFR 164.514(f))
Covered entities may use limited PHI categories for their own fundraising but must include a clear opt-out mechanism in each communication and honor opt-outs going forward.
Primary source
45 CFR 164.514(f) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514#p-164.514(f)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.514(f)) lets a covered entity (or a business associate or institutionally related foundation acting on its behalf) use a defined set of PHI categories for its own fundraising without individual authorization: demographic information (name, address, contact, age, gender, date of birth), dates of service, department of service, treating physician, outcome information, and health insurance status.
Each fundraising communication must include a clear, conspicuous, easy-to-implement opt-out from future communications. Opt-outs must be honored, and the entity may not condition treatment, payment, enrollment, or eligibility for benefits on receipt of fundraising materials. The Notice of Privacy Practices must disclose the fundraising use.
Disclosure of fundraising PHI beyond the listed categories — or to entities other than a business associate / related foundation — requires authorization under 164.508. Many small practices outsource fundraising to a vendor without a business associate agreement in place, which is the most common enforcement exposure.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Authorization Requirements (45 CFR 164.508)Required elements and statements for a valid HIPAA authorization, plus the prohibition on combining authorizations with other documents in most circumstances.
- RegulationHIPAA Marketing Restrictions (45 CFR 164.508(a)(3))Most communications encouraging an individual to purchase or use a product or service require a HIPAA-compliant authorization, with narrow exceptions for face-to-face communications and promotional gifts of nominal value.
- RegulationHIPAA Notice of Privacy Practices (45 CFR 164.520)Covered entities must provide a Notice of Privacy Practices describing how PHI may be used and disclosed and the individual's rights, with specific delivery and posting requirements.
- RegulationHIPAA De-Identification Standard (45 CFR 164.514(a)-(b))Two methods for de-identifying PHI so that it is no longer subject to the Privacy Rule: the Safe Harbor method removing 18 identifier categories, and the Expert Determination method.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.