On September 19, 2013, the U.S. Department of Health and Human Services (HHS) released guidance clarifying a key exception to the HIPAA Privacy Rule. Under the Privacy Rule, an individual must provide written authorization before his or her protected health information (PHI) may be used or disclosed to make a “marketing” communication – i.e., a communication about a product or service that encourages the individual to purchase or use that product or service. However, communications to a patient about a drug or biologic currently prescribed to the patient, and refill reminders in particular, do not fall within the definition of “marketing.” This exclusion is commonly referred to as the “refill reminder exception.”

According to the guidance, two issues are central to whether a communication falls within the refill reminder exception: first, whether it is about a currently prescribed drug or biologic, and second, whether it involves financial remuneration. The guidance defines financial remuneration as payment to a HIPAA covered entity or business associate from or on behalf of a third party whose product or service is being described. As long as the financial remuneration is “reasonable” -- that is, reasonably related to the covered entity’s cost of making the communication -- the reminder will fall within the exception.

The HHS guidance advises that communications about “generic equivalents of a drug being prescribed, adherence communications encouraging individuals to take prescribed medicines as directed, and communications about prescriptions that have lapsed within the last 90 calendar days” fall within the exception, as will communications regarding all aspects of a drug delivery system when an individual is prescribed a self-administered drug (such as communications to a diabetic patient regarding an insulin pump), as long as the financial remuneration is reasonable.

On the other hand, communications about new formulations of a currently prescribed medicine or communications that encourage an individual to switch from a prescribed medicine to an alternative therapy could fall outside the exception, depending on the circumstances. 

The compliance date for the new guidance is November 7, 2013.  For more information on the increased protections for individuals’ PHI under HIPAA and the HITECH Act, see “HIPAA Final Rule Compliance Deadline Approaches.”