HHS Issues Guidance on Permitted Remuneration for Prescription Refill Reminders in the Absence of Patient Authorization

by Baker Donelson

On September 19, the Health and Human Services Department (HHS) issued guidance on the effect of the January 25, 2013 Final Rule provision about remuneration related to prescription refill reminders and medication adherence programs in the absence of a patient's authorization. This guidance came the day before mandatory compliance with Omnibus Rule changes.

Previously the marketing rules and their exceptions to HIPAA had been interpreted to prohibit covered entities and their business associates from profiting  by providing patients with refill reminders. The guidance clarifies that patient consent is not required prior to refill reminders or medication adherence programs if payments are received from pharmaceutical companies.

On the primary issue of remuneration, HHS has now taken the position that business associates may be subsidized for the "fair market value" of their refill reminder and medication adherence programs, while covered entities may only receive "reasonable direct and indirect costs" related to such programs. HHS explains that an analysis of a refill reminder and medication adherence program is a twofold inquiry: 1) Is the communication about a currently prescribed drug or biologic; and 2) Does the communication involve financial remuneration, and if so, is it reasonable. The guidance provides:

  • Payments to a covered entity by a pharmaceutical manufacturer or other third party whose product is being described may only cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials and supplies, as well as capital and overhead costs. Without patient authorization, only direct and indirect costs are allowed.
  • Payments to a business associate up to the fair market value of assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications is permissible. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.
  • Communications that involve only non-financial or in-kind remuneration, such as supplies, computers or other materials, are permissible.
  • Communications about new formulations of or adjunctive drugs to currently prescribed medications are not allowed.
  • Communications encouraging an individual to switch to an alternative medicine are not allowed.
  • Communications regarding refills of currently prescribed medications, generic equivalents of currently prescribed medications, and prescriptions that have lapsed in the last 90 days are allowed.
  • Where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system are permissible.

As part of the guidance, HHS published a series of informative FAQS that illustrate the scope of the refill reminder exception, which provide significant clarification. The guidance also confirms that pharmaceutical manufacturer-funded communications to patients concerning a prescribed drug are not considered marketing under the Privacy Rule if required by a Risk Evaluation and Mitigation Strategy (REMS). The pertinent FAQ provides that if the FDA determines that a drug can only be approved with additional measures beyond labeling to mitigate risk, and one of those measures is patient communications, then such communications are not marketing, even if the communication is funded by the drug manufacturer. Consequently, a covered entity may use or disclose an individual's protected health information without the individual's authorization to send the individual educational or other information concerning a prescribed drug that is required by a REMS, even if the communication is funded by the drug manufacturer.

Refill reminder programs had become an area of concern after the Final Rule was published, spurring litigation over what was ostensibly an outright prohibition on any profits from reminder programs without an authorization from a patient. In early September 2013, Adheris, Inc., a subsidiary of inVentive Health, brought suit for a declaratory judgment and injunctive relief in the D.C. Federal District Court against HHS, seeking relief from the Final Rule, alleging the provision put impermissible content and speaker based restraints on its protected First Amendment right to free speech, jeopardizing its $49 million refill reminder program. 1 HHS issued the guidance as a part of settling the dispute.

Historically, covered entities and business associates were not required to obtain a patient's authorization for communications made in connection with prescription refill programs. Refill communications have been considered "treatment" communications, not marketing, even if the communications were subsidized by a third party, such as a pharmaceutical company.

The Omnibus Rule provides that a patient's authorization is required for refill reminders unless the financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication. HHS has clarified that the "reasonably related" requirement only allows for "the costs of labor, supplies, and postage to make the communication. Where the financial remuneration a covered entity receives in exchange for making the communication generates a profit or includes payment for other costs, such financial remuneration would run afoul of the Act's 'reasonable in amount' language."

The September 19 guidance will allow prescription refill reminder programs run by business associates, such as Adheris' programs, to remain in place.  However, under the guidance, doctors, pharmacies and their business associates may have constraints on their ability to derive profit from refill reminder programs, as remuneration to covered entities is limited to direct and indirect expenses.

The ongoing restrictions on remuneration on refill reminder programs established by the covered entities (without any pharmaceutical input) may be challenged as an impermissible First Amendment restriction, similar to the claims brought by Adheris in its lawsuit against HHS. The argument springs from the 2011 Supreme Court decision, Sorrell v. IMS Health, Inc., in which the high Court struck down a Vermont law that restricted the sale, disclosure and use of pharmacy records that revealed the prescribing practices of individual doctors, holding that "[s]peech in aid of pharmaceutical marketing. . . is a form of expression protected by the Free Speech Clause of the First Amendment." Sorrell v. IMS Health Inc., 131 S. Ct. 2653, 2659 (2011). 2

While the guidance offers significant clarification, and allows for business associates to continue refill reminder programs for the fair market value of the services, the permissible compensation for refill reminder programs will likely be a continuing area of flux in the law. It is almost certain that the limitations on remuneration for covered entities for refill reminders will be challenged in the courts, as it is not clear if the permissible remuneration of "reasonable direct and indirect costs" allows for any profit for covered entities. While the guidance clarifies that business associates may be compensated by pharmaceutical manufacturers for the "fair market value" of the refill reminder services, it is unclear what will constitute fair market value.

Based on the new guidance, we recommend manufacturers, covered entities and their business associates operating refill reminder or medication adherence programs evaluate and document their costs in operating such programs and price such services accordingly. Such documentation should further be well represented in their HIPAA policies and procedures.

1 Prescription refill reminder programs are prevalent in the pharmaceutical industry, and have been shown to increase drug therapy adherence, improve patient outcome, and decrease public spending on health care. Adheris' Complaint alleged that failure to follow drug therapy regimens cost up to $290 billion in avoidable medical costs a year and lead to an estimated 89,000 premature deaths from hypertension alone. Adheris also alleged that patients in its refill reminder program are 2-7% more likely to remain compliant with their prescribed drug therapy.

 2 The Vermont law at issue in Sorrell targeted a practice called "detailing" in which pharmacies sold information about physician prescribing practices to "data miners" who would analyze the data and sell the reports to pharmaceutical companies. Id. at 2659. The pharmaceutical companies then used the data in marketing to individual physicians. Id. In practice, pharmaceutical companies used the data mining report to primarily market their brand names drugs. Id. at 2662. Because the "detailing" practice is costly, the practice was not used to market generic drugs, which prompted the Vermont legislature's actions. Id. Vermont enacted a statute prohibiting pharmacies, among others, from selling or exchanging for value, any prescriber-identifiable information, without the consent of the prescriber. Id. at 2660. In striking down the law, the high Court found that Vermont's law contained content restrictions on marketing speech and speaker-based restriction on pharmaceutical manufacturers. Id. at 2663.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Baker Donelson | Attorney Advertising

Written by:

Baker Donelson

Baker Donelson on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.