As we previously reported, the Office for Civil Rights within the Department of Health and Human Services (HHS) has indicated that the final rule implementing changes to the HIPAA regulations under the HITECH Act will be issued in March. The proposed rule, released last July, contains sweeping changes to the privacy, security, and enforcement rules promulgated under HIPAA. In this and four subsequent blog posts, we will explore aspects of the proposed rule relating to marketing, clinical research, and the sale of protected health information. These changes, if included in the final rule, are likely to have the greatest impact on the business operations of pharmaceutical and other life sciences companies. (Although generally not regulated under HIPAA directly, such companies often have arrangements with entities that are covered entities or business associates under HIPAA.)
Communications About Currently Prescribed Drugs
The first topic we will address is HHS’s proposed treatment of refill reminders and other communications about currently prescribed drugs. The HIPAA Privacy Rule generally requires that a covered entity obtain prior written authorization from an individual before using that individual’s protected health information for marketing purposes. Prior to the HITECH Act, certain communications, including those related to treatment and care coordination, were excluded from the definition of marketing. But under the HITECH Act, if a covered entity or business associate is compensated by a third party for making certain communications (including those related to treatment and care coordination), the covered entity generally must obtain prior authorization.
The HITECH Act contains one limited exception. Prior authorization is not required if:
- the communication describes only a drug or biologic for which the recipient of the communication has a current prescription; and
- the compensation received by the covered entity is payment of a reasonable amount (as defined by the Secretary of HHS).
Consistent with the HITECH Act, HHS’s proposed rule also excludes from the definition of “marketing,” those communications made to “provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication.”
HHS specifically solicited comments on the scope of this exception. In the final rule, HHS is expected to clarify whether communications about drugs related to the drug currently being prescribed will fall within this exception and to define what constitutes a related drug. HHS has indicated that it might consider messages about new formulations of the same drug or even generic alternatives to fall within the exception. Likewise, HHS is expected to clarify the types and amounts of compensation that will be considered reasonable for purposes of the exception. HHS’s final regulation in these areas will be important in the design of future medical messaging programs.