News & Resources

Publications & Media

Navigating HIPAA’s Marketing Refill Reminder Exception

Health Law Update Kerry L. Moskol

Just in time for the Omnibus HIPAA Final Rule compliance date, the Department of Health and Human Services ("HHS") issued guidance yesterday on the marketing exception for communications made to provide refills reminders or otherwise communicate about a drug or biologic currently being prescribed for an individual (the "refill reminder exception"). The guidance provides specific examples of the types of communications that do and do not fit under this particular marketing exception.[1] 

Perhaps most importantly, HHS has given covered entities additional time to obtain any necessary patient authorizations for patients currently enrolled in specialty pharmacy programs. HHS stated covered entities will not be in violation of the marketing provisions if they fail to obtain authorization for all patients currently enrolled in specialty pharmacy programs that receive pharmaceutical manufacturer-funded communications prior to September 23, 2013, the Omnibus HIPAA Final Rule compliance date, "provided the patients from whom authorizations have not been obtained have not opted out or declined to receive such communications and the patients' authorizations are obtained at the next time their prescriptions are renewed, but no later than September 23, 2014." Accordingly, pharmacies should implement procedures to ensure any required authorizations are obtained from patients currently enrolled in these specialty pharmacy programs the next time the patient renews his or her prescription.

Marketing Communications Under HIPAA

HIPAA generally requires a covered entity to obtain patient authorization for any use or disclosure of PHI for marketing.[2] Marketing is defined as a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, subject to certain exceptions.[3] The refill reminder exception excludes from the definition of marketing communications made to provide refills reminders or otherwise communicate about a drug or biologic currently being prescribed for the individual, if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication.[4] Financial remuneration is defined as direct or indirect payment from or on behalf of a third party whose product or service is being described, but not does include any payment for treatment of an individual.[5]

HHS' guidance on the refill reminder exception addressed each part of the exception in turn.

Step 1: Is the communication about a currently prescribed drug or biologic?

HHS provided several examples of communications that are within the exception and that fall outside the exception. Included in the exception are refill reminders, communications about generic equivalents, adherence communications, and communications regarding all aspects of a drug delivery system when the individual is prescribed a self-administered drug (e.g. communications regarding an insulin pump for a patient prescribed insulin). Importantly, HHS included communications about a prescription that has lapsed in the last 90 calendar days on the list of permitted communications. Accordingly, prescriptions that have lapsed for more than 90 calendar days are no longer considered "currently prescribed drugs or biologics."

Communications not included in the exception include communications about specific new formulations of a currently prescribed drug, adjunctive drugs that may be used in conjunction with currently prescribed drugs to treat the underlying condition or a side effect of a currently prescribed drug, and communications encouraging a switch to an alternative drug.

Step 2: Is any financial remuneration reasonably related to the covered entity's cost of making the communication?

HHS provided an exclusive list of when financial remuneration is reasonably related to the covered entity's cost of making the communication. Accordingly, this list should be carefully reviewed to determine if any remuneration received fits within the list. Included on the list are communications that do not involve remuneration, involve only non-financial or in-kind remuneration (supplies, computers, or other materials), or where the only payment is from a party other than the third party (or other than on behalf of that third party) whose product or service is being described in the communication, such as payment from a health plan. Also included are payments to a covered entity by a manufacturer or other third party whose product is being described that cover reasonable costs related to the communication, including labor, materials, supplies, and capital and overhead costs. Payments to business associates to assist a covered entity in making the excepted communications are permissible if no greater than the fair market value of the business associate's services.

If the marketing communication about a drug or biologic does not fit within the refill reminder exception as described above, patient authorization will be required to make the communication unless the communication falls within another exception to marketing or is a face-to-face communication.

HHS also provided reminders that:

  • General communications regarding the availability of drugs different than those currently prescribed to an individual may fall within the treatment exception to marketing, if the covered entity does not receive financial remuneration in exchange for making the communication.

  • Communications about government programs or government-sponsored programs (e.g., Medicare, Medicaid) and government-mandated communications (e.g., communications required by a Risk Evaluation and Mitigation Strategy ("REMS")) are not considered "marketing."

For more information, please contact Kerry Moskol at (608) 283-2609 / kerry.moskol@quarles.com or your Quarles & Brady attorney.

 
[1] U.S. Department of Health and Human Services, The HIPAA Privacy Rule and Refill Reminders and Other Communications About a Drug or Biologic Currently Being Prescribed for the Individual, Sept. 19, 2013, http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/marketingrefillreminder.html.
[2] 45 C.F.R. § 164.508(a)(3). Patient authorization is not required if the communication is in the form of a face-to-face communication made by a covered entity to an individual or a promotional gift of nominal value provided by the covered entity.
[3] Id. § 164.501.
[4] Id. (emphasis added).
[5] Id.