
HIPAA treats paid third-party access to patient records as marketing. Without a separate signed authorization, it can carry criminal penalties.
There is one way doctors can be more transparent to their patients about their relationships with pharmaceutical companies.