MARKETING USES OF INFORMATION.

(a) A covered entity must obtain clear and unambiguous permission in written or electronic form to use or disclose protected health information for any marketing communication, except if the communication is:

(1) in the form of a face-to-face communication made by a covered entity to an individual;

(2) in the form of a promotional gift of nominal value provided by the covered entity;

(3) necessary for administration of a patient assistance program or other prescription drug savings or discount program; or

(4) made at the oral request of the individual.

(b) If a covered entity uses or discloses protected health information to send a written marketing communication through the mail, the communication must be sent in an envelope showing only the names and addresses of sender and recipient and must:

(1) state the name and toll-free number of the entity sending the marketing communication; and

(2) explain the recipient's right to have the recipient's name removed from the sender's mailing list.

(c) A person who receives a request under Subsection (b)(2) to remove a person's name from a mailing list shall remove the person's name not later than the 45th day after the date the person receives the request.

(d) A marketing communication made at the oral request of the individual under Subsection (a)(4) may be made only if clear and unambiguous oral permission for the use or disclosure of the protected health information is obtained. The marketing communication must be limited to the scope of the oral permission and any further marketing communication must comply with the requirements of this section.