New Refill Reminder Guidance a Win for Patients and Pharmacies
According to new guidance issued yesterday by the Department of Health and Human Services’ (HHS) Office for Civil Rights, pharmaceutical companies may outsource the operation of their prescription refill reminder or medication adherence programs – and pay third parties for such services. And yes, they can do this and still meet HIPAA’s “refill reminder” exception to the patient authorization requirement for marketing communications. Though this may sound complicated, it’s reason to celebrate, as it’s a win for both patients and pharmacies. Refill reminder programs serve important public health purposes, yet they also can be costly to conduct. This guidance makes them far more likely to be employed.
The new guidance was issued to address concerns raised over the last few months by a number of consumer advocates and health care stakeholders, including CDT. Some background: the HIPAA Omnibus Rule released by HHS in January 2013 strengthened the HIPAA Privacy Rule’s marketing provisions in important ways, including requiring that patients authorize use of their protected health information (PHI) in communications that are paid for by the manufacturer of the product or service being promoted in the communication. However, CDT and others felt that the accompanying HHS guidance too narrowly interpreted the important statutory exception for prescription refill reminders.
Specifically, HHS wrote in the Omnibus Rule that any financial remuneration received by a pharmacy for conducting a refill reminder program that covered anything other than the pharmacy’s cost of “drafting, printing, and mailing the refill reminders” would trigger the authorization requirement. Costs were deemed to include only those of “labor, supplies, and postage to make the communication.” We worried that such a strict interpretation of what constituted “reasonable costs” had the very real potential to limit interest in or make financially impossible participation in sponsored “refill reminder” programs, to the direct detriment of patients.
Fortunately, HHS agreed, and it has now expanded and clarified the scope of what permissible remuneration entails. The new guidance makes explicit that the following falls within the scope of the refill reminder exception: “Remuneration [that] involves payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.”
This language strikes an important and effective balance by acknowledging that refill reminder programs often are carried out by business associate third parties, and that while these parties do require and deserve payment for their services, such payment must be reasonable.
HHS should be commended not only for the content, but for the precision, thoughtfulness and clarity of this guidance. In addition to laying out bullet points detailing what types of communications and remuneration fall within and out of the refill reminder statutory exception, the Department also offers specific examples of permitted communications and provides a list of “Frequently Asked Questions.”
Importantly, HHS also made clear that the refill reminder provisions of the HIPAA Omnibus Rule will not be enforced until November 7. The extra time for compliance, along with the new guidance, should effectively put the “refill reminder exception” issue – which even gave rise to a recent legal challenge – to rest.
