This is the second in our series on provisions of the HHS proposed rule implementing the HITECH Act that, if included in the final rule, are likely to have the greatest impact on the business operations of pharmaceutical and other life sciences companies.  We previously covered HHS’s proposed treatment of refill reminders and other communications about currently prescribed drugs.  HHS has indicated that the final rule will be issued in March.

Today, we will look at the new requirements contained in the HHS proposed rule issued last July for what HHS is calling “remunerated treatment communications.” 

Remunerated Treatment Communications

The HIPAA Privacy Rule generally requires that a covered entity obtain prior written authorization from an individual before using that individual’s protected health information for marketing purposes.  Prior to the HITECH Act, certain communications, including those related to treatment and care coordination, were excluded from the definition of marketing.  But under the HITECH Act, if a covered entity or business associate is compensated by a third party for making certain communications (including those related to treatment and care coordination), the covered entity generally must obtain prior authorization.  As we previously reported, the HITECH Act contains one limited exception for communications about currently-prescribed drugs.

The proposed rule contains a new exception to the definition of marketing for written remunerated treatment communications.  These are communications made for “treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual.”  To qualify for this exception, however, if the communication is in writing and the health care provider receives financial remuneration in exchange for making the communication, two requirements must be met:

• The covered health care provider must include a specific statement in its notice of privacy practices about the fact that the health care provider may send treatment communications for which it receives financial remuneration, and the individual has the right to opt-out of receiving such communications; and
• The communication must disclose the fact that the covered health care provider is receiving financial remuneration in exchange for making the communication and must provide the individual with a clear and conspicuous opportunity to elect not to receive any further such communication—and the opt-out method cannot be burdensome or more than a nominal cost. 

Related issues to be on the watch for in the final rule include:  Is financial remuneration the only type of compensation that triggers the authorization requirement?  Will the final rule retain the distinction between compensated treatment communications and other types of compensated communications?  What level of generality or specificity is appropriate in the notice and opt-out?  (For example, if a patient elects to opt out of future communications, will it be clear to the patient whether he is opting out of future communications from that covered entity or future communications about that product or service?)