HHS plans to issue an amendment to the CLIA regulations “in coming months,” according to Rachel Seeger, spokeswoman for the OCR, an arm of HHS that is the primary federal enforcement agency for the HIPAA privacy and security rule. Rather than forcing labs to revise the notices to comply with the omnibus rule timeline, and then redo them when the CLIA-specific changes are made, the OCR opted to delay enforcement until the new CLIA-specific rule is released.
Another newly released document allows pharmaceutical companies more latitude to pay for refill notices mailed to patients that also serve as marketing for their products. A provision of the new privacy rule generally limits the use of patient information for marketing without their consent, but has an exception for refill reminders and other drug or biologics currently being prescribed to patients.
Under current practices, providers and other HIPAA-covered entities may send such refill reminders to their patients, or hire outside “business associates” to send the reminders on their behalf. For doing so, providers can be paid by third parties, such as pharmaceutical companies or their marketing representatives. By one insider estimate, as many as 100 million of these mailed messages are sent out each year. Typically, drugmakers fund these refill reminder programs, which are operated by pharmacies for their products using patient information kept by the pharmacies.
How much they could be paid became an issue after passage of the American Recovery and Reinvestment Act of 2009, which included several more stringent privacy provisions for health information, including one that that said third-party payments for these refill reminder programs must be limited to payments that are “reasonable in amount.”
Congress left it to HHS to define what was reasonable. In the omnibus final rule it issued in January, HHS said the payments must be “reasonably related to the covered entity's (e.g., pharmacy's) cost of making the communication.” The preamble to that rule said if a payment “generates a profit or includes payment of other costs, such as financial remuneration, would run afoul of the act's 'reasonable in amount' language.”
That language was challenged this summer by the Florham Park, N.J.-based Specialty Pharmacy Association of America, or SPAARx, which claims 3,500 members including specialty pharmacies, pharmacy manufacturers, payers and others organizations. In a letter to Susan McAndrew, deputy director for health information technology at the Office for Civil Rights, it complained HHS “is limiting remuneration to the specific direct cost” of the communication, such as drafting, printing and mailing, and that “does not fairly recognize the additional expenses of clinicians and staff that deliver therapy management traditionally telephonically.”
SPAARx asked instead that HHS use a standard of “fair-market value” of the service to determine whether it meets the congressional limit of “reasonable in amount.” SPAARx pointed out that fair-market value is used by HHS in anti-kickback enforcement.
In its guidance, the Office for Civil Rights appears to have attempted to split the baby.
To HIPAA-covered entities, such as providers, payments by “a pharmaceutical manufacturer or other third party whose product is being described in the communication” may cover “only the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials and supplies, as well as capital and overhead costs.”
But when the covered entity uses a business associate, “to assist in carrying out a refill reminder or medication adherence program, or to make other excepted communications,” the guidance says “the business associate may be paid by the third party (either directly or through the covered entity) only up to the fair market value of its services.”
“We got lots of mail on this issue, including from Congress, so we took another cut at what would be a reasonable amount that would allow these types of communications to continue,” McAndrew said. “Back in the day it was just a refill reminder, but now they've going into these much more elaborate compliance reminder programs. So, in looking at weighting equities, we decided that for these business associates to allow them fair market value. With covered entities, we did go back to a more typical cost-based standard, although we did broaden the types of costs.”
Other guides were issued by OCR on the privacy of information about student immunizations and on the handling of healthcare information for people who have died.
Follow Joseph Conn on Twitter: @MHJConn
