This month, the U.S. Department of Health and Human Services (“HHS”) issued guidance waiving enforcement of certain provisions of the Health Insurance Portability and Accountability Act (“HIPAA”) in response to the COVID-19 nationwide public health emergency.
Continue Reading HHS Relaxes Enforcement of Certain HIPAA Provisions Amidst COVID-19 Nationwide Public Health Emergency
Legislation Seeks to Regulate Privacy and Security of Wearables and Genetic Testing Kits
Last week, Senators Amy Klobuchar (D-MN) and Lisa Murkowski (R-AK) introduced the Protecting Personal Health Data Act (S. 1842), which would provide new privacy and security rules from the Department of Health and Human Services (“HHS”) for technologies that collect personal health data, such as wearable fitness trackers, social-media sites focused on health data or conditions, and direct-to-consumer genetic testing services, among other technologies. Specifically, the legislation would direct the HHS Secretary to issue regulations relating to the privacy and security of health-related consumer devices, services, applications, and software. These new regulations will also cover a new category of personal health data that is otherwise not protected health information under HIPAA.
Continue Reading Legislation Seeks to Regulate Privacy and Security of Wearables and Genetic Testing Kits
HHS Releases Voluntary Cybersecurity Guidance
Hospitals and other health care organizations are attractive targets for cyber-attacks, in part because their databases contain medical records and other sensitive information. Breaches of this information could have very serious implications for patients. Moreover, electronics connected to a health care facility’s network keep people alive, distribute medicines, and monitor vital signs. As a result, disruption to the operations of health care facilities could pose a very real risk to health and safety. Such risks are becoming more than theoretical. For instance, the WannaCry attack disrupted a third of the United Kingdom’s Health Service organizations by cancelling appointments and disturbing operations.
In recognition of the imperative for cybersecurity in the health care sector, in late December 2018 the Department of Health and Human Services (“HHS”) released voluntary cybersecurity guidance, titled “Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,” (“HHS Cybersecurity Guidance”). The HHS Cybersecurity Guidance is intended to shepherd healthcare organizations through the process of planning for and implementing cybersecurity controls. It was authored by the Health Sector Coordinating Council, comprised of more than 150 cybersecurity and healthcare experts from government and industry, and was required by Section 405(d) of the Cybersecurity Act of 2015.
Continue Reading HHS Releases Voluntary Cybersecurity Guidance
Draft House Cures Legislation Would Amend Federal Privacy Laws (Third Post in a Series)
As we discussed in two prior posts (here and here), the April 29, 2015, draft House 21st Century Cures bill would make several changes to federal health privacy law. This post focuses on provisions that would relax limitations on payment for PHI disclosed for research purposes and that would expand the purposes for which covered entities may disclose PHI to FDA-regulated entities without individual authorization. We also discuss several provisions included in a prior draft of the Cures bill that have been excluded from the April 29 draft.
Continue Reading Draft House Cures Legislation Would Amend Federal Privacy Laws (Third Post in a Series)
Draft House Cures Legislation Would Amend Federal Privacy Laws (Second Post in a Series)
As we discussed in a prior post, the April 29, 2015, draft House 21st Century Cures bill would make several changes to federal health privacy law. This post focuses on provisions that would allow remote access to PHI for purposes preparatory to research and that would permit individuals to make a one-time authorization of the use and disclosure of their PHI for research purposes.
Continue Reading Draft House Cures Legislation Would Amend Federal Privacy Laws (Second Post in a Series)
Draft House Cures Legislation Would Amend Federal Privacy Laws (First Post in a Series)
On April 29, 2015, the U.S. House Energy and Commerce Committee released a revised discussion draft of the 21st Century Cures Act (“Cures”). The Cures bill would make several changes to existing federal privacy regulations promulgated under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. These changes would primarily affect the use and disclosure of protected health information (PHI) for “research purposes.” This post discusses a provision that would expand covered entities’ ability to use or disclose PHI for research purposes without authorization from the subject individual. Future posts will discuss provisions that would allow remote access to PHI for certain research purposes; allow a one-time authorization of the use and disclosure of PHI for research; eliminate limitations on remuneration for PHI disclosed for research purposes; and allow disclosure of PHI to FDA-regulated entities for research purposes such as comparative effectiveness analysis.
Continue Reading Draft House Cures Legislation Would Amend Federal Privacy Laws (First Post in a Series)
HHS Issues Guidance on Refill Reminders under HIPAA
On September 19, HHS released additional guidance on the “refill reminder exception” in HIPAA, which allows — in some circumstances — paid communications regarding a drug or biologic currently prescribed to a patient.
Background
In January 2013, HHS finalized new restrictions on marketing as part of the final omnibus rule implementing changes to HIPAA under the HITECH Act. The new rules modified how and when covered entities and business associates may receive financial remuneration from a third party for making communications about a drug or biologic currently prescribed to an individual (i.e., “the refill reminder exception” to the marketing prohibition). We previously discussed the new restrictions here. In short, the new rules prohibit any financial remuneration above and beyond what is reasonable. HHS indicated that reasonable remuneration would include the costs of labor, supplies, and postage to make the communication. These restrictions appeared to prohibit a covered entity or business associate from generating a profit to make these subsidized communications.
As we discussed earlier, these new restrictions were challenged in a lawsuit filed earlier this month by Adheris, Inc.. Since the filing of the complaint, HHS announced that it would promulgate additional guidance on the refill reminder exception.
HHS Guidance
The new guidance describes both the scope of communications that fall within the exception and what third party payments are considered “reasonable” under the statute and regulations for making such communications.
What communications are included in the exception?
HHS explains that the following communications are permitted under the exception:
- Refill reminders.
- Communications about generic equivalents of a drug being prescribed.
- Communications about a recently lapsed prescription (one that has lapsed within the last 90 calendar days).
- Adherence communications encouraging individuals to take prescribed medicines as directed.
- Where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system.
Continue Reading HHS Issues Guidance on Refill Reminders under HIPAA
HHS to Issue Guidance on HIPAA Marketing Restrictions
In a court filing on September 11, 2013, attorneys for the U.S. Department of Health and Human Services (HHS) announced that HHS intends to issue further guidance on certain new marketing restrictions under HIPAA, finalized last January as part of the final HITECH omnibus rule, and to delay enforcement of those new marketing restrictions until
HITECH Update #5: HHS Tightens HIPAA Marketing Requirements
This post is part of our series on key aspects of the final HITECH omnibus rule issued by the U.S. Department of Health and Human Services (HHS) on January 17, 2013 (available here), and scheduled to be published in the Federal Register on January 25. Previous posts are available here. The regulations are effective March 26, 2013, but covered entities and business associates have until September 23, 2013, to comply with most new requirements.
The final HITECH omnibus rule significantly tightens the HIPAA marketing restrictions. As described below, HHS has modified the proposed approach to require authorization for almost all treatment and health care operations communications where the covered entity receives, from a third party, financial remuneration for making the communication. This change will have major implications for the design of medical messaging programs.
Background. The HIPAA Privacy Rule generally requires that a covered entity obtain prior written authorization from an individual before using that individual’s protected health information for marketing purposes. Prior to the HITECH Act, certain communications, including those related to treatment and care coordination, were excluded from the definition of marketing. But under the HITECH Act, if a covered entity or business associate receives direct or indirect payment in exchange for making certain communications (including those related to treatment and care coordination), the covered entity generally must obtain prior authorization–unless the communication qualifies for a limited exception for communications about currently prescribe drugs or biologics where the payment received is reasonable in amount.
Continue Reading HITECH Update #5: HHS Tightens HIPAA Marketing Requirements
Supreme Court Justices Seem Skeptical of Vermont Law Restricting Use of Prescriber-Identifiable Data
The U.S. Supreme Court heard oral argument last week in Sorrell v. IMS Health, Inc. As described in our earlier post, the case involves a constitutional challenge to a Vermont law prohibiting the use or sale of doctors’ identifying information in prescription records—i.e., prescriber-identifiable data—without the doctor’s express consent.
The key legal issue, as