An eyecare survey should offer clear notice, specific written permission, strict data limits, and secure storage. It should also explain who can see your answers and how breaches are reported. That means protection for information that links your eyes, vision, diagnosis, or care to your identity. Clinic surveys and independent paid panels follow different rules, so check who is asking before you share.
Official resources:
- Read the official guidance from FTC — Use this primary source to verify the official guidance.
- Explore the official data from FTC — Use this primary source to review the underlying data.
Table of Contents
- Does HIPAA cover this survey?
- What should permission say?
- How should it limit and secure your data?
- What if a paid panel runs it?
Does HIPAA cover this survey?
The strongest protection applies when your eye doctor or health plan runs the survey. The HHS Office for Civil Rights states the HIPAA Privacy Rule protects identifiable eye-health information held by those providers, plans, and clearinghouses, with safeguards and limits on use and disclosure Summary of the HIPAA Privacy Rule. That rule does not cover every online panel. When it does apply, you should receive a Notice of Privacy Practices from a provider with a direct treatment relationship.
HHS says that notice must explain your rights, how to complain to HHS, and whom to contact. The provider must then act consistently with it. Before you start, ask who controls the survey data. If it is your clinic, look for that notice and keep a copy.
What should permission say?
Survey use beyond treatment, payment, operations, or other permitted disclosures needs your valid authorization. HHS requires that authorization to describe the information, the parties, the purpose, an expiration date or event, and your signature.
Look for these details before you agree: A short blanket statement is not enough. Do not answer health questions until each blank is filled and you understand the purpose.
- what eye-health information will be used
- who will receive it and why
- when permission ends and how to cancel
How should it limit and secure your data?
HHS requires covered groups and their vendors to use only the smallest amount of information needed for the purpose. A vision-satisfaction survey does not need your full medical record or Social Security number. HHS also requires administrative, physical, and technical safeguards for electronic health information.
Those include risk review, access controls, encryption, audit checks, and staff training, so the survey platform should use those controls. Ask whether outside vendors sign a written business-associate agreement. HHS permits sharing with a vendor working for the practice only with that contract. It limits uses, requires safeguards, and covers return or destruction.
What if a paid panel runs it?
Many paid research panels are not your provider and do not fall under HIPAA. HHS still offers two paths to remove survey data from HIPAA. One is expert review finding very small re-identification risk. The other is removal of 18 identifier types with no known ability to re-identify. For non-HIPAA health apps and record vendors, the Federal Trade Commission requires notice after unauthorized disclosure of identifiable health information Complying with the Health Breach Notification Rule.
Notice goes to users, the FTC, and sometimes the media. Save the privacy contact and breach-notice policy before you enroll. Watch advertising trackers closely. The Federal Trade Commission barred GoodRx from sharing health data for ads and imposed a $1.5M penalty over pixel and ad-tech disclosures without consent FTC action against GoodRx. Decline eyecare surveys that load ad trackers before you give clear express consent for advertising use.
