What is the difference between limiting PHI for marketing and fundraising, and preventing PHI sales without authorisation?

How the two rules differ in practice

Limiting PHI for marketing and fundraising is about controlling permitted use. It asks whether the disclosure or use fits a narrower purpose and whether the necessary conditions, notices, or authorisation paths are in place. Preventing PHI sales without authorisation is about stopping a commercial transfer of PHI for value unless a valid exception or authorisation exists. One is a use restriction, the other is a prohibition on monetisation.

That distinction matters because the same dataset can be lawful for one purpose and unlawful for another. A campaign that uses PHI to target outreach may be constrained by scope, consent, or applicable policy, while a sale creates a different legal and compliance problem because value exchange changes the nature of the transaction. Under the HHS HIPAA Privacy Rule guidance, organisations need to separate authorised secondary use from prohibited disclosure for remuneration.

Where organisations get the boundary wrong

In operational terms, the mistake is treating all downstream disclosure as the same risk. Marketing and fundraising controls usually focus on purpose limitation, segmentation, and disclosure conditions. Sale restrictions require stronger transaction-level review, because the question is not just whether the recipient may receive PHI, but whether the exchange itself is barred unless it meets a specific exception. That is why privacy teams, legal counsel, and revenue teams often need different review paths.

This is also why the decision should be documented at the use-case level, not only at the dataset level. A record can be available for a narrow outreach activity in one workflow and still be off-limits for sale in another. If your workflow cannot explain why the disclosure is allowed, and under what authority, it is usually too blunt for either rule. The HIPAA overview on uses and disclosures of protected health information is useful because it frames the disclosure question around permitted purposes, not just internal convenience.

Why the difference matters for controls and review

Marketing and fundraising restrictions usually call for controls around notice, consent status, segmentation, minimum necessary handling, and channel governance. Sale prohibitions call for stricter approval gates, contractual scrutiny, and monitoring for value exchange, because the prohibited act may occur even when the disclosure otherwise looks routine. In other words, a disclosure can be operationally similar and legally very different depending on whether money, barter, or other value is involved.

For practitioners, the key control difference is that marketing and fundraising are often managed as bounded business uses, while sale restrictions are treated as a hard stop unless an exception is documented. The distinction should therefore appear in policy wording, request workflows, and audit evidence. The HIPAA Privacy Rule materials help anchor that separation between purpose-based use and value-based transfer.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.

Framework	Control / Reference	Relevance
ISO/IEC 27001:2022	A.5.12 — Classification of information	PHI handling depends on classifying sensitive health data correctly.
	A.5.15 — Access control	Disclosure limits rely on controlling who can access and use PHI.
Recommendation — Classify PHI and apply handling rules that distinguish permitted use from prohibited sale. Restrict access paths so only approved PHI uses can proceed.
GDPR	Lawfulness, fairness and transparency	The question turns on lawful purpose limits versus prohibited commercial transfer of personal data.
Recommendation — Check the lawful basis and purpose before any secondary use or transfer.
NIST SP 800-53 Rev 5	AC-3 — Access Enforcement	PHI restrictions require enforcement of who may use data for a stated purpose.
	AU-2 — Event Logging	PHI outreach and sale decisions need audit evidence of who approved what and why.
Recommendation — Enforce approved-use boundaries before PHI is disclosed or repurposed. Log PHI disclosure decisions with the stated purpose and approver.

Practitioner Guidance

What to verify: Confirm whether the proposed activity is a permitted outreach use, or whether it involves disclosure in exchange for value. That single classification should drive the review path, approval owner, and evidence you retain.

Decision rule: If the activity is marketing or fundraising, assess purpose limitation, notice, and any required opt-out or authorisation conditions; if it is a sale, treat it as a prohibited transaction unless a documented exception applies.

What good looks like: Your records should show the business purpose, the legal basis, and the approval trail in a way that an auditor can distinguish routine outreach from a monetised transfer.

Practitioner takeaway: Do not manage these as one privacy control, because the operational question is different, one governs whether PHI may be used for outreach, the other whether PHI may be transferred for value at all.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.