Since the HIPAA Privacy Rule went into effect in 2003, covered entities were permitted to send communications to patients about products and services of third parties, as long as these communications were for purposes of treatment or to recommend alternative therapies. However, in 2013, the Privacy Rule was amended to require patient authorization before sending such communications paid for by third parties. Does the current formulation of 45 CFR § 164.508(a)(3) provide a reasonable balance between privacy interests and healthcare needs? What are the arguments for and against the 2013 amendment? You may want to run a quick Internet search before formulating your responses.