A business may not request medical information for marketing purposes unless the business discloses the marketing purpose, and gains the consent of the data subject or the subject's authorized representative prior to obtaining the medical information. The section also lays out requirements for the formatting, readability of written consent forms.
