Holiday Cards to Patients: What HIPAA Says, and What It Does Not

I publish greeting cards. I am not a lawyer and not a privacy officer. What follows is the rule text with the citation attached, so you can take it to whoever handles HIPAA for your practice. I am writing it because the answers going around on whether a practice may send patients a holiday card are confident in both directions and sourced in neither.

The short answer: HHS has not said

I looked through the Department of Health and Human Services' guidance and FAQs for anything on holiday or greeting cards to patients and found nothing. Anyone telling you HHS has blessed them, or banned them, is telling you something HHS has not said.

What does exist is the rule on marketing, the rules on what you do with a patient list and who you hand it to, and an enforcement case about envelopes. Those cover most of it. State law can be stricter, and substance-use treatment programs have a separate federal rule of their own, so check with your privacy officer if either applies to you.

The marketing rule is not where a card gets into trouble

The Privacy Rule defines marketing, at 45 CFR 164.501, as a communication about a product or service that "encourages recipients of the communication to purchase or use" it. Using patient information for marketing generally requires the patient's written authorization, under 45 CFR 164.508(a)(3), with exceptions for face-to-face communications and promotional gifts of nominal value. HHS's own FAQ on promotional gifts uses pens and notepads as examples.

The same definition then carves a good deal out. A provider communicating for treatment, or describing a health-related product or service that the practice itself provides, is generally not marketing under the rule, unless somebody else is paying the practice to send the message. And when HHS finalized the current version of these rules in 2013, it said in the preamble that communications promoting health in general, and not promoting a product or service from a particular provider, are not marketing either.

A card that says "Happy holidays from all of us at the practice" promotes nothing. My reading, and it is a reading of the rule rather than an HHS ruling, is that a plain greeting sits well outside the definition.

I would still leave the sales lines out, for a different reason. "Time to book your annual visit" and "Ask us about our new service" turn a greeting into a mailer, and a mailer is the version that goes straight in the recycling. The card is worth more for being the one thing from you all year that does not want anything.

The list is the part to be careful with

A name and address on their own are not necessarily protected health information. HHS's de-identification guidance explains that they become PHI once they are linked to the fact that someone was treated at a particular practice. A list titled "our patients" is exactly that link.

So treat the mailing list as PHI, because it is. Two things follow.

Use the minimum. The minimum necessary standard, 45 CFR 164.502(b), asks you to limit PHI to what the purpose needs. A card needs a name and an address. Strip everything else out of the file before it goes anywhere, including dates of service, provider names and any code or column that hints at why the person is your patient.

Get an agreement before a vendor touches it. A company that addresses or mails envelopes from your patient list receives and keeps PHI on your behalf. Under the definition at 45 CFR 160.103, that ordinarily makes it a business associate, and the rule requires a written business associate agreement before you hand over the file. Your privacy officer will know whether you already have one in place and what it needs to say.

If you would rather the list never leave your office, that is easy to arrange. We ship the imprinted cards and envelopes to your front desk, and your staff addresses them in house.

The envelope is the part people forget

In 2020 Aetna paid $1,000,000 to settle three HIPAA breaches with HHS. In one of them, the words "HIV medication" could be read through the window of the envelope. In another, a mailing carried the name and logo of an atrial fibrillation research study on the outside of the envelope.

Neither of those was a holiday card. Both were about what a stranger could read without opening anything, and that is the lesson for yours.

• Watch the return address. If your practice name reveals a specialty that patients might not want a mail carrier or a family member to see, use a neutral name or just the street address.
• No windows. A plain envelope shows the name, the address and nothing else.
• No postcards. HHS's guidance says that when a patient asks for mail in a closed envelope rather than a postcard, that request is reasonable and should be accommodated. Skip the question and use the envelope.

Gifts are a different rule

If you are tucking a small gift in with the card, that falls under a separate rule. The HHS Office of Inspector General's guidance on gifts to Medicare and Medicaid patients defines nominal value as no more than $15 per item or $75 a year per patient, and never cash or a cash equivalent. That is an inducement rule enforced by the Inspector General, not a Privacy Rule issue, and it is worth a question to your compliance person before anything besides the card goes in the envelope.

The short version

A plain greeting, signed, with no health information and no sales line inside it. A list stripped to names and addresses, handled in house or by a vendor under a business associate agreement. An envelope that says nothing about why the person is your patient.

Take the citations above to whoever handles compliance for your practice. The designs we pick for practices, warm without hinting at why anyone is a patient, are on our page for healthcare practices.