All covered entities (“Covered Entities”), including pharmacies must comply with changes to HIPAA enacted on January 17, 2013. Health and Human Services (“HHS”) issued a final rule (the “Final Rule”) implementing some of the most sweeping changes to HIPAA since its inception in the 1990’s with most of the provisions taking effect on September 23, 2013.
One of the changes to HIPAA enacted in the Final Rule involves significantly greater restrictions on the use of protected health information (“PHI”) for marketing purposes. On September 19, 2013, HSS issued guidance related to the use of PHI by pharmacies to remind patients about refills. The “Refill Reminder Exception” provides a specific exception to the Final Rule that allows pharmacies to use PHI in circumstances that would otherwise constitute prohibited marketing activities.
The Privacy Rule expressly excludes from the definition of “marketing” refill reminders or other communications about a drug or biologic that is currently being prescribed for an individual, provided that financial remuneration received by the Pharmacy in exchange for making the communication, if any, is reasonably related to the pharmacy’s cost of making the communication.
There are two components to determining whether a communication falls within the Refill Reminder Exception to marketing. The first is whether the communication is about a currently prescribed drug or biologic. The second is whether the communication involves financial remuneration and if it does, whether the financial remuneration is reasonably related to the covered entity’s cost of making the communication.
1. Is the Communication about a Currently Prescribed Drug or Biologic?
WITHIN THE REFILL REMINDER EXCEPTION
• Refill reminders.
• Communications about generic equivalents of a drug being prescribed.
• Communications about a recently lapsed prescription (one that has lapsed within the last 90 calendar days).
• Adherence communications encouraging individuals to take prescribed medicines as directed.
• Where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system.
NOT WITHIN THE REFILL REMINDER EXCEPTION
• Communications about specific new formulations of a currently prescribed medicine.
• Communications about specific adjunctive drugs related to the currently prescribed medicine.
• Communications encouraging an individual to switch from a prescribed medicine to an alternative medicine.
2. Does the Communication Involve Financial Remuneration, and If So, Is It Reasonable?
WITHIN THE REFILL REMINDER EXCEPTION
• Communication does not involve remuneration.
• Communication involves only non-financial or in-kind remuneration, such as supplies, computers, or other materials.
• Communication involves only payment from a party other than the third party (or other than on behalf of the third party) whose product or service is being described in the communication, such as payment from a health plan.
• Remuneration involves payments to the covered entity by a pharmaceutical manufacturer or other third party whose product is being described that cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials, and supplies, as well as capital and overhead costs.
• Remuneration involves payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.
NOT WITHIN THE REFILL REMINDER EXCEPTION
• Communication involves financial remuneration other than as described above.
Examples of Permitted Communications that comport with the Refill Reminder Exception
• A pharmacy administers a medication adherence program that involves mailing refill reminders and adherence communications to patients about their currently prescribed drugs even though the pharmacy receives financial remuneration from the pharmaceutical manufacturers, provided the financial remuneration covers only the pharmacy’s reasonable direct and indirect costs associated with the program.
• A pharmacy mails its diabetic patients information concerning the diabetic pumps used to administer their insulin even though the pharmacy is paid by the manufacturer of the pumps, provided the payment covers only the reasonable direct and indirect costs associated with the communications.
• A pharmacy hires a business associate to assist in administering a medication adherence program that involves mailing adherence communications to patients about their currently prescribed drugs, even though the business associate is paid by the pharmaceutical manufacturers, provided the payment does not exceed the fair market value of the business associate’s services.
Communications Not Falling Within the Refill Reminder Exception
Communications about drugs or biologics not falling within the refill reminder exception for one or more reasons described above are still permitted under the Privacy Rule if:
• The communications are made face-to-face at the pharmacy or other setting. Face-to-face communications do not include communications by telephone or sent by mail or e-mail.
• Written authorization has been obtained from the individual to make the communications.
• The communications fall within another exception to the definition of marketing and do not involve financial remuneration.
If you have additional questions about the Refill Reminder Exception or need any guidance on HIPAA please contact us.
