Skip to Content

Privacy & Data

CDT Requests Clarification to HIPAA Marketing Guidance

The HIPAA Omnibus Rule released by HHS in January strengthened the HIPAA Privacy Rule’s marketing provisions in important ways, including requiring that patients authorize use of their protected health information (PHI) in communications that are paid for by the manufacturer of the product or service being promoted in the communication. However, we believe some of the accompanying HHS guidance too narrowly interprets an important statutory exception to this authorization requirement for paid communications using PHI: prescription refill reminders.

However, Congress (in HITECH) enacted an important exception to this authorization requirement: refill reminders do not require prior authorization as long as the amount of manufacturer sponsorship is “reasonable in amount.” Unfortunately, HHS guidance on what constitutes “reasonable in amount” may jeopardize refill reminder programs. Last month, CVS Caremark announced that it would suspend operating its own refill reminder program.

CDT submitted a letter Wednesday to the Department of Health and Human Services asking it to clarify its guidance related to such programs. In the guidance, HHS defined “reasonable in amount” so narrowly as to potentially eliminate the incentive to conduct them. For health conditions where adherence to a medication regimen is critical, refill reminder programs are an important tool to achieving better outcomes and reducing costs.

Specifically, CDT asked OCR to clarify that: (1) entering into a business associate agreement with a third party in order to carry out a refill reminder program – a common practice among pharmacies – does not automatically trigger a patient authorization requirement; and (2) “reasonable in amount” payment for refill reminder programs includes all reasonable direct and indirect costs related to them.

These clarifications would make the regulatory language regarding the refill reminder exception more consistent with other public health exceptions to the patient authorization requirement, such as the sale of PHI for research purposes. They also would bring HHS in line with Congress’ original intent in drafting the refill reminder exception in the HITECH Act, which is to promote and encourage these important medication adherence and patient education programs.