Law / United States / 
New Hampshire
Medical records: authorization for marketing and fundraising uses of protected health information, notice of unauthorized disclosure, and civil action
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Breach notice
- Audit expectation
- none
As of .
What it requires
- If you are a health care provider or a business associate of one, obtain an authorization for any use or disclosure of protected health information for marketing, meeting the Health Insurance Portability and Accountability Act (HIPAA) authorization specifications for marketing (RSA 332-I:4, I).
- For fundraising uses of protected health information, give each intended recipient a clear and conspicuous opportunity to elect not to receive fundraising communications, and treat an election as a revocation of authorization (RSA 332-I:4, II).
- Do not disclose protected health information used for marketing or fundraising by voice mail, an unattended facsimile, or other methods of communication that are not secure (RSA 332-I:4, III).
- Promptly notify in writing the individuals whose protected health information was disclosed when a use or disclosure is allowed under federal law but not permitted by RSA 332-I:4; a business associate bears the cost of notice for its own disclosures (RSA 332-I:5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Statutory damages
RSA 332-I:6: an aggrieved individual who brings a civil action under RSA 332-I:4 or 332-I:5 and succeeds shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees.
- As of
- Currency
- USD
- Per person minimum
- 1,000
What this law does
A health care provider, or a business associate of the provider, shall obtain an authorization for any use or disclosure of protected health information for marketing. For use or disclosure of protected health information for fundraising, a provider or business associate shall, in a clear and conspicuous manner, provide an opportunity for any intended recipient of fundraising communications to elect not to receive them.
Protected health information disclosed for marketing or fundraising shall not be disclosed by voice mail, an unattended facsimile, or other methods of communication that are not secure. When a provider or business associate uses or discloses protected health information in a way federal law allows but RSA 332-I:4 does not permit, the provider shall promptly notify in writing the individuals whose information was disclosed.
An aggrieved individual may bring a civil action under RSA 332-I:4 or RSA 332-I:5 and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees. The sections took effect on .
When LexLint raises it
When your app profile says your app handles health records or sends automated outreach.