HIPAA/HITECH Final Rule – Clarification and Guidance Sought on Refill Reminder Programs

The HIPAA Omnibus Rule released by HHS in January strengthened the HIPAA Privacy Rule’s marketing provisions in important ways, including requiring that patients authorize use of their protected health information (PHI) in communications that are paid for by the manufacturer of the product or service being promoted in the communication. However, some of the accompanying HHS guidance too narrowly interprets an important statutory exception to this authorization requirement for paid communications using PHI: prescription refill reminders. CDT submitted a letter to HHS asking the agency to clarify its guidance in order to promote, rather than potentially discourage, these important medication adherence and patient education programs.