The HIPAA Privacy Regulations have long required covered entities to seek a patient authorization in order to use or disclose protected health information ("PHI") for marketing purposes. However, the Office for Civil Rights made it clear in its Q and A on its website that pharmacies were allowed to provide refill reminders to patients without an authorization as this was generally considered to be part of "Treatment" and a covered entity can use or disclose PHI for treatment purposes.
Many of the drug companies have developed refill reminder programs with retail pharmacies to help assure that their drugs are being adhered to. Generally, the drug companies or a company on their behalf, paid the pharmacy for providing the refill reminders. These refill reminder programs have become an important revenue source for pharmacies. However, a question remained as to whether it was "marketing" when a pharmacy receives remuneration for sending these refill reminder letters to patients.
The HITECH Act, enacted in 2009 to amend certain HIPAA provisions, provides that, with limited exceptions, a covered entity could not, directly or indirectly, receive remuneration in exchange for PHI without a valid authorization. However, the HITECH Act also states that a communication which would otherwise be marketing could be a "health care operation", "if such communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication", and the communication is made by the covered entity pursuant to a signed authorization or by a business associate pursuant to a business associate agreement. It is not clear why Congress required an authorization if the covered entity provided the communication, but not if the communication is made by the business associate.
There was a further requirement in the HITECH Act that the remuneration be "reasonable in amount" as described by the Secretary in regulations. The 2013 amendments to the HIPAA Privacy Regulations included a change to the definition of "Marketing" which provided further direction on what the term "reasonable in amount" meant:
(2) Marketing does not include a communication made:
(i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication. 45 CFR 164.501.
The payments to pharmacies under these refill reminder programs generally exceed the cost of making the communication and if remuneration is limited to the pharmacy's cost of sending a refill reminder letter, there is no economic incentive for the pharmacies to send the communications (other than possible increased drug purchases and drug regimen adherence). Adheris, Inc., a company that works with drug manufacturers to provide refill programs to pharmacies, brought suit to enjoin HHS from enforcing the above language contending that the regulation's language limiting the allowed reimbursement to "the covered entity's cost of making the communication" violated its first amendment rights. Adheris, Inc. vs. Sebelius, D.D.C., No. 1:13-cv-1342 In a recently filed joint motion, HHS has indicated that the HHS Secretary has decided “not to enforce the restrictions on remunerated refill reminders and other communications” until November 7, 2013 and plans to issue guidance on what remuneration is allowed to pharmacies by September 23, 2013. Presumably, this new rule will provide bright line guidance on when reimbursement paid to a pharmacy for refills is marketing and when it is not. Stay tuned.
