This post was written by Brad M. Rostolsky, Jennifer L. Pike and Nancy E. Bonifant
The Department of Health & Human Services (HHS) released on September 19, 2013 guidance on financially remunerated prescription refill reminders.
Under the currently enforced Privacy Rule, covered entities must obtain an individual’s valid authorization prior to using and disclosing the individual’s protected health information for “marketing” purposes – which includes communications about a product or service that encourages the recipients of the communication to purchase or use the product or service. This requirement, however, includes a significant exception for communications that also meet the definition of “treatment” or “health care operations” communications, including prescription refill reminders, even where a third party subsidizes the covered entity’s communication.
Under the Privacy Rule, determining whether a communication falls within the refill reminder exception depends on (1) whether the communication is about a currently prescribed drug or biologic, and (2) whether the communication involves financial remuneration and, if it does, whether the financial remuneration is reasonably related to the covered entity’s cost of making the communication. HHS now provides guidance on each of these aspects of the refill reminder exception.
Among other points, HHS makes the following notable determinations:
- Communications about specific formulations of a currently prescribed medicine do not fall within the refill reminder exception
- When remuneration involves payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications - which exceed the fair market value of the business associate’s services - the communication does not fall within the refill reminder exception
The release of the guidance follows an announcement September 11, 2013, that HHS has decided not to enforce the restrictions on financially remunerated prescription refill reminders until November 7, 2013, 45 days after the general HITECH compliance date of September 23, 2013. HHS’ decision to delay enforcement came on the heels of a lawsuit filed by Adheris, Inc., a Massachusetts company that provides prescription refill reminders. The lawsuit challenges the constitutionality of the HITECH Final Rule’s restrictions on remunerated prescription refill reminders.
Reed Smith’s HIPAA practice is in the process of conducting a full review of the guidance and will release additional analysis shortly.