OCR Clarifies Scope of HIPAA Prescription Refill Reminder Exception

In response to recent litigation as well as concerns from the health care industry and privacy advocates, the Office for Civil Rights (OCR) has published guidance regarding the scope of the refill reminder exception under the HIPAA Omnibus Rule. Specifically, OCR has made clear that third party providers of refill reminder services may be paid “fair market value” for their services.


The HIPAA Privacy Rule, as modified by the HIPAA Omnibus Rule, generally requires individuals to authorize uses or disclosures of their protected health information for marketing purposes. For example, a pharmacy cannot compile a list of customers on high blood pressure medication in order to target products of interest to those customers. Often, however, targeted communications can be useful for patients, so HIPAA contains exceptions, such as an exception for refill reminders and other communications about a drug or biologic currently prescribed for the individual. When a third party – like a pharmaceutical company – pays for such a communication, the HIPAA Omnibus Rule requires that the payment be reasonably related to the cost of the communication, or the costs of labor, materials, postage and other out of pocket costs. This limitation caused concern for vendors of prescription refill reminder services who were left with the choice of either breaking even on their services or violating the law by making a profit. The payment limitation prompted a lawsuit by Adheris, Inc.challenging the scope of the HIPAA Omnibus Rule on a constitutional basis and seeking to enjoin its enforcement.

OCR’s Clarification

Through guidance and FAQs published today, OCR has made clear that permissible reasonable costs for a vendor’s provision of refill reminder or other adherence communications includes the fair market value of the service. Note, however, that subsidized marketing communications made by a pharmacy or health care provider directly are still limited to the actual costs of making the communication. Regulated entities of all kinds should review the guidance and related FAQs and structure their outreach programs accordingly.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Mintz Levin - Health Law & Policy Matters | Attorney Advertising

Written by:


Mintz Levin - Health Law & Policy Matters on:

Popular Topics
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.