Healthcare
The Final Rule - entitled Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules - includes significant changes to the proposed regulations governing marketing activities. Under the Final Rule, written communications that are subsidized by a third party to encourage the use of that third party’s product or service generally require specific authorization, with no exception for treatment communications.
Background
Pre-HITECH, the Privacy Rule allowed Covered Entities to make health-related communications to individuals, even if the Covered Entities were paid to do so by a third party. So, for example, a pharmacy could send a mailer to all of its patients taking Drug A to encourage those individuals to use Drug B instead, where the pharmacy was paid by the manufacturer of Drug B to make the communication. Such communications, if health-related, were generally considered health care operations under the Privacy Rule, and so no authorization was required.
Section 13406(a) of HITECH Act limited the health-related communications that could be considered health care operations and, therefore be excepted from the definition of marketing to the extent the Covered Entity received direct or indirect payment in exchange for making the communications. The HITECH Act requires that where a Covered Entity receives payment, the Covered Entity must obtain authorization prior to making such a communication, or prior to its Business Associate making such a communication. The HITECH Act includes an exception for a communication that describes a drug or biologic that is currently being prescribed to the individual, so long as any payment received by the Covered Entity for making the communication is reasonable in amount.
In the Proposed Rule published on July 14, 2010, HHS proposed provisions to implement the new restrictions on marketing communications from the HITECH Act, but proposed to exclude from the definition of marketing any communication by a health care provider about a health-related product or service for treatment purposes, including communications about case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers or settings of care, provided the communications were in writing and, if the Covered Entity received remuneration, the Covered Entity provided the individual with notice and an opportunity to opt out.
Big Changes in the Final Rule
The Final Rule significantly modifies the Proposed Rule’s approach by requiring that a Covered Entity obtain authorization for all treatment and health care operations communications where the Covered Entity receives financial remuneration for making the communication from a third party whose product or service is being marketed in the communication. So, there is no exception for treatment communications in the Final Rule. Any communication about a product or service that encourages the recipient of the communication to use or purchase the product or service is marketing, and the Covered Entity must receive an authorization if the Covered Entity receives financial remuneration for making the communication from the third party that makes or sells the product or service.
What is Financial Remuneration?
The Final Rule adopts the proposed definition of “financial remuneration,” which means “direct or indirect payment from or on behalf of a third party whose product or service is being described.” Direct or indirect payment does not include any payment for treatment of an individual. HHS clarifies that “direct” payment means financial remuneration that flows from the third party whose product or service is being described directly to the Covered Entity, whereas “indirect” payment means financial remuneration that flows from an entity on behalf of the third party whose product or service is being described to the Covered Entity.
HHS also explains that financial remuneration does not include non-financial benefits, such as in-kind benefits provided to the Covered Entity in exchange for making a communication about a product or service. Rather, financial remuneration is payment made in exchange for the communication. Further, HHS emphasizes that the financial remuneration must be for the purpose of making the communication. So, if a third party provides payment to a Covered Entity to implement a disease management program, the Covered Entity could provide individuals with communications about the program without obtaining authorization so long as the communications are about the Covered Entity’s program itself and not to encourage individuals to use or purchase the third party’s product or service.
Requirements for Marketing Authorizations
Covered Entities must obtain an authorization from an individual before using or disclosing his or her PHI for marketing, and the authorization must disclose the fact that the Covered Entity is receiving financial remuneration from a third party. The scope of the authorization need not be limited only to subsidized communications related to a single product or service, or to the products or services of one third party, but rather may apply more broadly to subsidized communications generally, so long as the authorization adequately describes the intended purposes of the requested uses and disclosures (i.e., the scope of the authorization).
Revisions to Notice of Privacy Practices
The Final Rule requires that Covered Entities modify their Notice of Privacy Practices to include a statement that uses and disclosures of PHI for marketing require authorization. Also, in the preamble, HHS explains that a Covered Entity’s Notice of Privacy Practice no longer is required to include a statement that the Covered Entity may contact the individual to provide appointment reminders or information about treatment alternatives or other health-related benefits and services that may be of interest to the individual. Where the sending of such communications involves financial remuneration, the individual will be notified through the authorization.
Face-to-Face Communications Not Marketing
HHS makes it clear in the preamble to the Final Rule that there has been no change in the ability of a Covered Entity to make a face-to-face communication, and to provide a promotional item of nominal value, that encourage the patient to use a product or service, even if the Covered Entity receives financial remuneration in exchange for the communication. So, a manufacturer can provide a physician with pamphlets about the manufacturer’s product, and the physician can distribute those pamphlets when meeting with patients in his or her office without an authorization, even if the physician is paid by the manufacturer to make the communication. The same communication over the phone or by mail would require an authorization.
Exception for Refill Reminders
The Final Rule maintains the stand-alone exception to the authorization requirement for refill reminders. HHS also clarifies that it considers communications about a generic equivalent of a drug currently being prescribed to an individual, as well as adherence communications encouraging individuals to take their prescribed medications as directed, to fall within the scope of this exception. Additionally, where an individual is prescribed a self-administered drug or biologic, communications regarding all aspects of a drug delivery system including, for example, an insulin pump, fall within the exception. In order to qualify for the exception, the financial remuneration must be reasonable in amount, meaning it must be reasonably related to the Covered Entity’s cost of making the communication. Permissible costs for which a Covered Entity may receive remuneration under this exception are only the costs of labor, supplies, and postage. Where financial remuneration received generates a profit or includes payments for other costs, it is not considered “reasonable in amount” and an authorization would be required. So, a pharmacy can only receive an amount that covers the cost of drafting, printing and mailing the refill reminder. HHS confirms, consistent with the discussion above regarding face-to-face communications, that if the pharmacist provides a refill reminder to a patient face-to-face, then no authorization is required even if the pharmacy receives financial remuneration.
Other Exceptions
Communications promoting health generally and that do not promote a specific product or service, such as communications regarding a healthy diet or encouraging routine diagnostic testing, are not marketing. Also, communications about government programs, or government sponsored programs, are not marketing.
Effective Date
The Final Rule is effective March 26, 2013. Covered Entities, Business Associates and Subcontractors will have 180 days beyond the effective date to come into compliance, which 180 days expire on September 23, 2013.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
