HIPAA Marketing Restrictions (45 CFR 164.508(a)(3))
Most communications encouraging an individual to purchase or use a product or service require a HIPAA-compliant authorization, with narrow exceptions for face-to-face communications and promotional gifts of nominal value.
Primary source
45 CFR 164.508(a)(3) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508#p-164.508(a)(3)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.508(a)(3)(3)) requires written authorization for any communication that meets the Privacy Rule definition of "marketing" at 164.501. The default rule: any communication encouraging the individual to purchase or use a product or service, where the covered entity receives financial remuneration from the third party whose product is being promoted, is marketing and requires authorization.
Exceptions: face-to-face communications by a covered entity with an individual; promotional gifts of nominal value; and communications about the entity's own products and services, treatment, case management, or alternative treatments — provided no third-party financial remuneration is involved. HITECH narrowed the carve-outs by removing the "health-related products" exemption and requiring remuneration disclosure on the authorization.
Practical impact for small practices: vendor-funded patient communications, marketing emails for medications, and similar campaigns generally require a specific authorization that names the remunerated relationship.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Authorization Requirements (45 CFR 164.508)Required elements and statements for a valid HIPAA authorization, plus the prohibition on combining authorizations with other documents in most circumstances.
- RegulationHIPAA Fundraising Restrictions (45 CFR 164.514(f))Covered entities may use limited PHI categories for their own fundraising but must include a clear opt-out mechanism in each communication and honor opt-outs going forward.
- RegulationHIPAA Treatment, Payment, and Operations (45 CFR 164.506)Covered entities may use and disclose PHI for treatment, payment, and health care operations without authorization, subject to limits and notice requirements.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
- ComplianceHIPAA Subpoena Response: Court Order vs Administrative Subpoena (45 CFR § 164.512)Court order, civil subpoena, grand-jury subpoena, DEA administrative demand — each triggers a different HIPAA response path. Identify the type before you produce a single record.
- ComplianceColorado Privacy Act for Medical Practices: Where It Stacks on HIPAAColorado Privacy Act (C.R.S. § 6-1-1301 et seq.) vs HIPAA: narrow health-data carve-out, AG-only enforcement, $20k per-violation cap, and CRS § 6-1-716 30-day breach window.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.