The new policy becomes effective at the end of July, DeAngelis said.
The 563-page privacy rule, released in January, highlights changes to HIPAA from the American Recovery and Reinvestment Act of 2009, including new rules on the use of patient-identifiable medical data for marketing.
The rule tightens marketing restrictions, requiring patient consent in many cases, but the ARRA contains an exemption for using PHI without consent for third-party funded marketing for prescription refills, provided the payment is “reasonable in amount.” Congress left it to HHS' secretary to define reasonable.
The regulation says payments may be “reasonably related to the covered entity's cost of making the communication.” But the preamble apparently narrows the scope even further, saying “we consider permissible costs for which a covered entity may receive remuneration under this exception are those which cover only the costs of labor, supplies and postage to make the communication.” If financial remuneration “generates a profit or includes payment for other costs, such financial remuneration would run afoul of the act's 'reasonable in amount' language.”
“The marketing definition changed and we also have that prohibition on the sale of PHI,” said Rebecca Williams, a partner with Davis Wright Tremaine. Skittishness by CVS may be related to “some uncertainly as to what may be deemed to be a reasonable amount. So this may be a gray enough area that this may not be an area they want to be in.”
The Office for Civil Rights at HHS is the privacy and security rule enforcement agency under HIPAA. It took a lead role in drafting the new privacy rule. Asked if civil rights office officials had been in discussions with CVS before the policy change, OCR spokeswoman Rachel Seeger said via e-mail: “OCR does not have information on CVS's actions,” adding it cannot comment on business decisions of HIPAA-covered entities.
The civil rights office did say the law and the rule “place further restrictions on the ability of covered entities to send communications to individuals about a third party's products or services, even if health-related. The rule generally requires individual authorizations for a covered entity to send communications to the individual that are paid for by a third party whose product or service is being described. The omnibus rule includes a statutory exception for refill reminders (and related communications such as communications about generic equivalents, drug adherence, and drug delivery systems), provided any payment received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication, including only the costs of labor, supplies, and postage to make the communication.”
According to an industry source, between 75 million and 100 million of these mailed refill notices go out across the industry each year, almost exclusively to patients with chronic diseases. A general rule of thumb is that a pharmacy might be paid $1.50 per mailed notice. Pharmacies can continue to be paid for “face-to-face” communications inside the pharmacies without consent.
CVS is not alone among pharmacy companies in its concerns about the new rule.
In a May 3 letter to Susan McAndrew, OCR's deputy director for health information privacy and security, the Food Marketing Institute, which represents grocery-based pharmacies, and the National Association of Chain Drug Stores, ask that OCR issue a clarification or “guidance” on the scope of the refill reminder provision of the rule, including what is meant by “reasonable” compensation, and whether a pharmacy can use a “third-party business associate to help implement sponsored refill reminder programs without automatically triggering a need for patient authorization.”
Underlying the current conflict are two larger contexts – patient consent and medication adherence.
First, the issues raised by CVS and the two trade groups evaporate if the pharmacies simply ask the patient and obtain his or her consent to receive prescription refill reminders or other marking materials.
“If someone signs an authorization saying market away, you can market away until they rescind that authorization,” Williams said.
Second, the two associations in their letter point to a 2012 Congressional Budget Office finding that even a 1% increase in prescription refills would produce enough drug therapy compliance to yield “millions of dollars in savings in overall Medicare costs.”
“Sponsored prescription refill reminder programs are an extremely effective tool for improving patient compliance and persistence, thereby enhancing patient health and reducing health care costs,” the groups said.
Follow Joseph Conn on Twitter: @MHJConn
