Federal privacy law has evolved considerably since the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule first went into effect in 2003. Modifications enacted earlier this year by the HIPAA/HITECH Final Rule1 make it particularly crucial for covered entities and pharmaceutical manufacturers to consider the business implications of the regulation. This article summarizes the current federal HIPAA/HITECH Act law and guidance on marketing communications and discusses what a pharmaceutical manufacturer may and may not do, in light of the new law and guidance, to promote a drug.2

The HIPAA Privacy Rule generally requires an individual’s written authorization before the person’s protected health information (PHI) can be used for marketing communications. Historically, the U.S. Department of Health and Human Services (HHS) has drawn a distinction between “treatment” communications and “marketing,” with the latter requiring either patient authorization or an opt-out instruction. Prior to the HITECH Act, three types of communications were excluded from the definition of marketing: 1) communications describing a health-related product or service (or payment for such a product or service) provided by or included in the covered entity’s plan of benefits; 2) communications made for the treatment of the individual; and 3) communications for case management, care coordination or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual.3

The HITECH Act was signed into law in 2009 as part of the American Recovery and Reinvestment Act. The HITECH Act narrowed the range of permitted communications by declaring that a communication “about a product or service . . . that encourages recipients of the communication to purchase or use the product or service shall not be considered a health care operation” if the covered entity receives direct or indirect payment in exchange for making the communication.4 The statute outlined limited exceptions, but the result of the provision is that payments to covered entities (such as pharmacies) to provide these particular types of communications to patients on behalf of a pharmaceutical company would be considered marketing. The HITECH Act did not, however, state whether some remunerated communications nevertheless might be considered “treatment,” and thus, excluded from marketing.

HHS’ subsequent rulemaking in the Final Rule attempts to clear up this ambiguity by defining “marketing” broadly as any communication “about a product or service that encourages recipients of the communication to purchase or use the product or service,” with limited exceptions for refill reminders and certain treatment and health care operations purposes.5 Notably, if the covered entity receives any financial remuneration in exchange for making the treatment-related or health care operations-related communication, the communication is considered marketing. This represents a marked departure from past law and guidance. Additionally, the opt-out requirement was dropped. “Financial remuneration” is defined to mean direct or indirect payment from or on behalf of a third party whose product or service is being marketed, and does not include non-

financial or in-kind benefits. Therefore, such communications for which the covered entity does not receive financial remuneration are not prohibited. As noted above, the definition of marketing in the Final Rule did retain a limited exception for refill reminders and other communications about a drug that is currently being prescribed for the individual.6 These communications will not be considered marketing only if the financial remuneration is “reasonably related” to the covered entity’s cost of providing the communication.7 HHS further clarified this exception in a subsequent guidance document (discussed below).

The Final Rule contains two additional exceptions that will be of interest to pharmaceutical manufacturers. First, authorization is not required for a subsidized marketing communication in the form of a “promotional gift of nominal value.” Second, the Final Rule retains the exception allowing for face-to-face marketing communications without authorization. Under the exception, a covered entity can receive remuneration for communicating with an individual about a specific product without the need to obtain written authorization in such a face-to-face encounter. Telephone, mail, and e-mail communications are not covered under the exception.

On September 11, 2013, HHS announced that it would not enforce the Final Rule’s restriction on financially remunerated prescription refill reminders until November 7, 2013, forty-five days after the general HITECH compliance date of September 23, 2013. On September 19, 2013, HHS released an informal yet important publication titled “The HIPAA Privacy Rule and Refill Reminders and Other Communications about a Drug or Biologic Currently Being Prescribed for the Individual” (the Guidance).8 The Guidance further illuminates two key questions in connection with the refill reminder exception: 1) when is a communication about a drug or biologic that is “currently being prescribed”; and 2) when does a communication involve financial remuneration, and if so, when is the cost reasonably related to the covered entity’s cost in making the communication?

The Guidance clarifies that the following types of communications fall within the exception for refill reminders about a currently prescribed drug or biologic:

  • Refill reminders;
  • Communications about generic equivalents of a drug being prescribed;
  • Communications about a recently lapsed prescription (one that has lapsed within the last 90 calendar days);
  • Adherence communications encouraging individuals to take prescribed medicines as directed; and
  • Where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system.

In contrast, the following types of communications do not fall within the refill reminder exception:

  • Communications about specific new formulations of a currently prescribed medicine (however, communications that refer only generally to a new formulation of a currently prescribed drug, without naming it, are permitted);
  • Communications about specific adjunctive drugs related to the currently prescribed medicine; and
  • Communications encouraging an individual to switch from a prescribed medicine to an alternative medicine.

The Guidance also addresses prior ambiguities around the second question outlined above. The following types of communication fall within the exception for remuneration that is reasonably related to the covered entity’s cost of providing the communication:

  • Communication does not involve remuneration;
  • Communication involves only non-financial or in-kind remuneration, such as supplies, computers, or other materials;
  • Communication involves only payment from a party other than the third party (or other than on behalf of the third party) whose product or service is being described in the communication, such as payment from a health plan;
  • Remuneration involves payments to the covered entity by a pharmaceutical manufacturer or other third party whose product is being described that cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials, and supplies, as well as capital and overhead costs; and
  • Remuneration involves payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.

Any other type of communication involving financial remuneration not described above would not fall within the exception. Finally, the Guidance provides specific examples of communications that would be within or outside the refill reminder exception. Given the ambiguities in the law and HHS’ recent efforts to provide further clarification, it would be prudent for pharmaceutical manufacturers and covered entities to now re-examine marketing practices to ensure they are in compliance with HHS’ most recent interpretation of the Privacy Rule.