Prompted by litigation filed by Adheris[1] as well as concerns raised by consumer advocates and health care stakeholders regarding the viability of prescription refill reminder programs under HIPAA’s stricter marketing prohibitions, on September 19, 2013, OCR issued additional guidance regarding the scope of HIPAA’s refill reminder exception. Notably, OCR also delayed enforcement on this issue until November 7, 2013.
The Final Omnibus HIPAA Rule finalized HITECH’s limitations on the use and disclosure of PHI for marketing purposes. With limited exceptions, HIPAA requires an individual’s written authorization before his or her PHI can be used or disclosed for marketing. HIPAA defines marketing to mean communications that are paid for by the manufacturer of the product or service being promoted in the communication. 45 C.F.R. § 164.501.
Refill reminders, which were expressly excluded from HIPAA’s definition of “marketing,” have been defined as reminders or other communications about a drug or biologic that is currently being prescribed for the individual, provided that financial remuneration received by the covered entity in exchange for making the communication, if any, is reasonably related to the covered entity’s cost of making the communication. See 45 CFR 164.501. Financial remuneration means payment to a covered entity (or business associate, if applicable) from or on behalf of a third party whose product or service is being described. Financial remuneration does not include non-financial or in-kind benefits. 78 Federal Register at 5596.
Thus, there is a two-step analysis in determining whether a communication falls within the refill reminder exception to marketing:
- Is the communication about a currently prescribed drug or biologic
- Does the communication involve financial remuneration, and if so, is the financial remuneration “reasonably related” to the cost of making the communication?
Notwithstanding this refill reminder exception to HIPAA’s marketing definition, concerns arose following issuance of the Final Omnibus HIPAA Rule in January 2013 that HHS commentary on the refill reminder exception had construed it too narrowly, and thus would render refill reminder programs financially untenable to the detriment of patients. In its commentary, HHS had stated that any financial remuneration received by a covered entity for conducting a refill reminder program that covered anything other than the cost of “drafting, printing and mailing refill reminders” could trigger HIPAA’s authorization requirement. 78 Federal Register at 5597.
The guidance issued by OCR on September 19, 2013, however, expands and clarifies the scope of the refill reminder exception, and specifically authorizes covered entities to outsource their prescription refill reminder and medication adherence programs to third parties, and to pay them for these services. Below is a summary of the guidance which OCR has issued related to each of these aspects of the exception:
- Is the Communication about a Currently Prescribed Drug or Biologic?
WITHIN EXCEPTION
- Refill reminders.
- Communications about generic equivalents of a drug being prescribed.
- Communications about a recently lapsed prescription (one that has lapsed within the last 90 calendar days).
- Adherence communications encouraging individuals to take prescribed medicines as directed.
- Where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system.
NOT WITHIN EXCEPTION
- Communications about specific new formulations of a currently prescribed medicine.
- Communications about specific adjunctive drugs related to the currently prescribed medicine.
- Communications encouraging an individual to switch from a prescribed medicine to an alternative medicine.
- Does the Communication Involve Financial Remuneration, and If So, Is It Reasonable?
WITHIN EXCEPTION
- Communication does not involve remuneration.
- Communication involves only non-financial or in-kind remuneration, such as supplies, computers, or other materials.
- Communication involves only payment from a party other than the third party (or other than on behalf of the third party) whose product or service is being described in the communication, such as payment from a health plan.
- Remuneration involves payments to the covered entity by a pharmaceutical manufacturer or other third party whose product is being described that cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials, and supplies, as well as capital and overhead costs.
- Remuneration involves payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.
NOT WITHIN EXCEPTION
- Communication involves financial remuneration other than as described above.
In addition to this framework, HHS also provided specific examples of permitted communications and thoughtful answers to a list of “Frequently Asked Questions.” This guidance (as well as the delayed enforcement date) should put the refill reminder exception concerns to rest, as well as ensure that these programs – many which have a very positive impact on patient care – will continue.
