HITECH Update #5: HHS Tightens HIPAA Marketing Requirements
This post is part of our series on key aspects of the final HITECH omnibus rule issued by the U.S. Department of Health and Human Services (HHS) on January 17, 2013 (available here), and scheduled to be published in the Federal Register on January 25. Previous posts are available here. The regulations are effective March 26, 2013, but covered entities and business associates have until September 23, 2013, to comply with most new requirements.
The final HITECH omnibus rule significantly tightens the HIPAA marketing restrictions. As described below, HHS has modified the proposed approach to require authorization for almost all treatment and health care operations communications where the covered entity receives, from a third party, financial remuneration for making the communication. This change will have major implications for the design of medical messaging programs.
Background. The HIPAA Privacy Rule generally requires that a covered entity obtain prior written authorization from an individual before using that individual’s protected health information for marketing purposes. Prior to the HITECH Act, certain communications, including those related to treatment and care coordination, were excluded from the definition of marketing. But under the HITECH Act, if a covered entity or business associate receives direct or indirect payment in exchange for making certain communications (including those related to treatment and care coordination), the covered entity generally must obtain prior authorization--unless the communication qualifies for a limited exception for communications about currently prescribe drugs or biologics where the payment received is reasonable in amount.
To implement the HITECH Act marketing provisions, HHS proposed to:
- Exclude from the definition of “marketing” certain health care operations communications, except where the covered entity receives financial remuneration in exchange for the communication;
- Exclude from the definition of “marketing” communications about refill reminders or otherwise about a drug or biologic that is currently being prescribed for the individual, as long as any financial remuneration received for making the communication is reasonably related to the covered entity’s cost of making the communication; and
- Exclude from the definition of “marketing” treatment communications about health-related products or services by a health care provider to an individual, provided that if the communications are in writing and the covered entity receives financial remuneration in exchange for making them, certain notice and opt-out conditions are met.
Final Marketing Requirements. In the final HITECH omnibus rule, HHS modified the proposal to require authorization for all subsidized treatment and health care operations communications, with a narrow exception for communications about currently prescribed drugs. The final rule also retains the current exceptions to the authorization requirement for face-to-face communications and promotional gifts of nominal value.
HHS explained in the preamble that it decided to adopt this policy, instead of the proposed approach, because it concluded that the difficulty of distinguishing between treatment communications and health care operations communications could place covered entities at risk of violating the HIPAA marketing requirements.
Financial Remuneration: The final omnibus rule adopts the proposed definition of “financial remuneration,” which is “direct or indirect payment from or on behalf of a third party whose product or service is being described.” The term does not include payment for treatment of an individual or non-financial or in-kind benefits. HHS also clarified in the preamble that, where a business associate or subcontractor receives financial remuneration in exchange for making a marketing communication, that communication also requires prior authorization from the individual.
Authorizations for Marketing: Under the revised 45 C.F.R. § 164.508(a)(3), a covered entity must obtain a valid authorization from the individual before using or disclosing protected health information for marketing communications that involve financial remuneration. The authorization must disclose the fact that the covered entity (or business associate or subcontractor, if applicable) is receiving remuneration from a third party.
Authorization Exceptions: HHS specifically stated in the preamble that the final rule does not modify the existing exceptions to the authorization requirement for face-to-face marketing communications or promotional gifts of nominal value provided by the covered entity. HHS offered the following example: Authorization is not required if a health care provider, in a face-to-face conversation with an individual, verbally or by handing a written pamphlet to the individual, recommends “that the individual take a specific alternative medication, even if the provider is otherwise paid by a third party to make such communications.”
Communications About Currently Prescribed Drugs: The final omnibus rule adopts the proposed exception for a communication made to provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, provided that any financial remuneration received by the covered entity for making the communication is reasonably related to the covered entity’s cost of making the communication.
HHS clarified in the preamble that this exception includes communications regarding:
- the generic equivalent of a drug being prescribed to an individual
- adherence communications encouraging individuals to take their prescribed medications
- all aspects of a drug delivery system (including, for example, an insulin pump) for a self-administered drug or biologic that has been prescribed for an individual.
HHS also stated that it intends to issue future guidance on other communications that fall within this exception.
With respect to the limit on financial remuneration, HHS clarified that “permissible costs for which a covered entity may receive remuneration under this exception are those which cover only the costs of labor, supplies, and postage to make the communication.” This does not include any profit or payment for other costs. But HHS also pointed out that refill reminders provided to patients in face-to-face encounters at the pharmacy would be permitted under section 164.508(a)(3)(i)(A) and would not require authorization or be subject to the limit on financial remuneration.
Other Exempt Communications: In addition to the exceptions described above, HHS clarified in the preamble that the following communications are exempt from the marketing requirements:
- communications promoting health in general, which do not promote a product or service from a particular provider
- communications about government and government-sponsored programs, such as Medicare, Medicaid, or the State Children’s Health Insurance Program.
Conclusion. Covered entities that have designed medical messaging or other marketing programs to comply with HHS’s proposed HITECH rule would benefit from re-examining those programs under the final omnibus rule’s stricter standards.