On April 30, 2018, a Massachusetts jury convicted a gynecologist of disclosing her patients’ protected health information (PHI) to a drug company sales representative in violation of the Health Insurance Portability and Accountability Act (HIPAA). The HIPAA violation was discovered as part of an investigation by the federal government into drug maker Warner Chilcott’s financial relationships with physicians.
The jury found the physician guilty of violating HIPAA by disclosing PHI to the drug maker’s representative so that the drug maker could target specific patients for expensive drugs. Prosecutors claimed that the physician allowed the company’s sales representatives access to patient information protected by HIPAA to select patients to receive specific Warner Chilcott drugs and to engage in the prior authorization process.
It was also alleged that in 2014, when agents of the Office of the Inspector General (OIG) presented at the physician’s office to ask about her relationship with the drug maker’s representatives, the physician told the investigators that the sales representative had helped her prepare prior authorizations but did not have access to confidential patient information and that Warner Chilcott paid her to comment on clinical research. The jury concluded that the physician lied to investigators and convicted her of tampering with the investigation.
This case serves as a cautionary tale for physicians when approached by anyone, particularly industry representatives, seeking information about their patients and their practice. Although, HIPAA has been in effect for over 20 years, criminal prosecutions for HIPAA violations have only begun to occur recently. Both healthcare and pharmacy providers have begun to experience the full force of the criminal sanctions incorporated into HIPAA. Covered entities must be hyper-vigilant when disclosing PHI to any third-party, and a robust HIPAA compliance plan, combined with legal counsel that is well versed in HIPAA, is the best safeguard against running afoul of HIPAA. The federal government has stepped up enforcement of HIPAA and, as this case demonstrates, is willing to utilize HIPAA’s criminal sanctions.
This case is also significant as it addresses a drug company’s involvement in the prior authorization process with patients’ insurance companies. Pharmacy benefit managers (PBM) have ratcheted down their formularies for expensive brand drugs in an effort to drive patients to less expensive generic drugs. One tool the PBMs employ is the prior authorization process, which requires physicians to clinically justify the brand drug over the generic. Drug manufacturers and pharmacies often desire to assist physicians in the prior authorization process, to lift some of the burden off the physician, so that expensive brand drugs can be dispensed. Physicians, drug manufacturers, and pharmacies must be extremely careful when collaborating in the prior authorization process, and any arrangement involving the prior authorization process must be carefully crafted to ensure compliance with applicable federal and state law.
Providers of all disciplines should have a robust HIPAA compliance plan, and appropriate legal advice, when disclosing PHI. Frier Levitt’s 30+ healthcare attorneys are well-versed in all aspects of HIPAA and regulatory law and provide guidance to the pharmaceutical industry on properly constructed prior authorization arrangements. Contact Frier Levitt today to speak to an attorney.
