September 19, 2013, the US Department of Health and Human Services (HHS) released guidance on the changes effectuated by the Omnibus Final Rule to the exception to the authorization requirement under the HIPAA Privacy Rule for certain marketing communications to patients regarding prescribed drugs and biologics. The guidance provides several helpful FAQs for providers and extends the compliance date to November 7, 2013, for restrictions on refill reminders and other communications involving prescribed drugs or biologics.
Marketing activities under the Privacy Rule require patient authorization for the use of protected health information (PHI) . The definition of “marketing” expressly excludes refill reminders and communications to patients about drugs or biologics currently prescribed, provided that if the covered entity receives financial remuneration, the remuneration is reasonably related to the cost of providing that communication. Financial remuneration is defined as payment to the covered entity (or business associate) by a third party for the cost of the communication on behalf of a third party. Similarly, the sole purpose for the payment must be for the communication that encourages patients to buy the third party’s product or service.
Significantly, the guidance enables covered entities to make payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate. This clarification enables companies such as Adheris, Inc., which filed a complaint seeking injunctive and declaratory relief on September 5, 2013, to prohibit HHS from enforcing the new Omnibus Rule restrictions on what it calls its content and speaker-based protected First Amendment speech. Adheris’s business model consists of sending reminders to customers of participating pharmacies to refill their existing prescriptions before their refills are due, to encourage customers to adhere to their prescribed treatment regimens and to educate them about medication safety.
Following are key observations regarding the HHS guidance:
- The guidance expands the marketing exception to allow communications regarding generic equivalents of a prescribed drug, lapsed prescriptions within a 90-day period, patient reminders to take prescribed medicines as directed and all aspects of drug delivery systems in the case of a self-administered drug. It also provides that information about new formulations, alternative therapies and adjunctive drugs related to a currently prescribed drug do not fall within the exception.
- The guidance explicitly excludes face-to-face communications at the pharmacy or other setting. However, such communications are still permissible because the Privacy Rule does not require patient authorization for face-to-face communications by a covered entity to an individual for treatment, health care operations or other marketing purposes. The refill reminder marketing exception does, however, apply to mail, e-mail and telephone communications.
- The exception specifically encompasses a pharmacy’s administration of a medication adherence program, including the mailing of refill reminders and prescription program adherence communications. Similarly, the exception permits a pharmacy to mail to its diabetic patients information about their self-administered diabetic pumps. In both cases, these communications are only permitted if the pharmacy’s financial remuneration covers the pharmacy’s reasonable direct and indirect costs of the program. However, if the pharmacy hires a business associate to administer the medication adherence program, then the business associate can be paid fair market value for its services by the pharmacy or a pharmaceutical manufacturer.
- Covered entities should seek authorizations from all new patients prior to sending such patients communications regarding drugs or biologics that qualify as marketing. However, for existing patients, HHS indicated that the Office of Civil Rights (OCR) will allow covered entities to obtain authorization for marketing communications when the covered entities renew such patients’ prescriptions, provided that authorizations are received from all patients receiving marketing communications by September 23, 2014.
- The Secretary also extended the compliance period for restrictions on refill reminders and other drug or biologic communications for a period of 45 days following the compliance date of September 23, 2013 until November 7, 2013.
If you have any questions regarding the guidance, please do not hesitate to contact the authors.