HHS Issues Proposed HIPAA/HITECH Rule
July 9, 2010On July 8, 2010, the Office for Civil Rights of the U.S. Department of Health and Human Services announced the issuance of its long-awaited proposed rule (in prepublication form) relating to the modification to the HIPAA Privacy, Security and Enforcement Rules under the HITECH Act (see our previous post here). While much of the proposed rule may not be of interest to our readers, several provisions are of great interest.
As we noted in our prior blogpost, prior to the HITECH Act, pharmaceutical companies could pay pharmacies to communicate with their patients for the purpose of either reminding patients to refill their prescription (“refill reminders”), or to recommend switching to alternative therapies (“switch communications”). Such communications were considered “health care operations” and therefore did not require a written authorization from the patient. The HITECH Act changed the definition of “health care operations” such that paid switch communications were no longer considered “health care operations” and thus required an authorization.
Surprisingly, the HITECH Act did not directly address whether paid switch communications might remain treatment communications which do not require an authorization, as per the FAQ referenced in our prior blogpost. This omission created confusion – could Congress have left open an exception so big as to render the prohibition on paid switch communications a nullity?
Apparently so, according to HHS. The preamble to the proposed rule notes that “it is unclear how Congress intended these provisions to apply to treatment communications between a health care provider and a patient. Specifically, it is unclear whether Congress intended to restrict only those subsidized communications about products and services that are less essential to an individual’s health care (i.e., those classified as health care operations) or all subsidized communications about products or services, including treatment communications.” Thus, while paid switch communications that used to be considered health care operations now require patient authorization prior to making the communications, paid switch communications that are to be considered treatment related require only that (1) the covered entity’s Notice of Privacy Practices includes a statement informing patients that the health care provider may send the paid switch communications and the individual has the right to opt out of receiving such communication, and (2) that the communication itself disclose the financial payment and the ability to opt out. HHS has asked for comment on whether patients should be afforded the ability to opt out prospectively.
Sounds confusing? Let’s soldier on. HHS explains that the difference between a switch communication that is health care operations and one that is treatment depends on whether the communication is based on population (that is, made to all patients) which would be marketing if subsidized by the third party whose product or service is recommended or health care operations if unsubsidized, or whether it is based on the treatment needs of an individual, such as a letter to all pregnant patients recommending a particular birthing center (their example). Similarly, payment to a pharmacy to recommend that all patients on a particular drug be switched to another drug would, apparently, be a treatment communication and would only require disclosure of the remuneration plus the opt out option (assuming the Notice of Privacy Practices has the required language). While this is welcome news to pharmaceutical companies who often use these communications to get the word out about their products to patients, privacy activists are likely to argue for inclusion of such communications in the definition of marketing, which would require an authorization. Indeed, HHS recognized the difficulty in their position, and has asked for comments on the proposal, including whether to permit all treatment communications without restriction on whether they are paid for, or whether to require an authorization for all paid switch communications, even if it is for treatment.
Interestingly, HHS asked for comment on whether to expand the HITECH Act exception that permits communications about the drug a patient is currently prescribed (e.g., refill reminders) to be deemed health care operations so that exception includes generic alternatives or new formulations of the drug. This is puzzling, since under the proposed rule, such communications could in any event be considered treatment because they are for the treatment of an individual and are not population based. We can expect that the marketing/treatment distinction will receive numerous comments.
Far less controversial, and very welcome to companies sponsoring clinical trials, is a provision that would permit compound authorizations; that is, an authorization permitting a covered entity to use protected health information for more than one purpose, if both (or all) purposes relate to the same research project. Thus, a single authorization could be used for a clinical study as well as for specimen collection for a central repository. Currently, compound authorizations are prohibited, which increases the burden on clinical trial sites when obtaining consent and authorization from subjects for the research project. Moreover, HHS has also requested comment on whether (and how) an authorization could be used to permit future unspecified research studies using the subject’s protected health information. This would greatly simplify the ability of sponsors and institutions to use collected information and data in future studies.
Last, but not least, HHS announced that it is providing a grace period of 180 days from the publication of the final rule for covered entities to come into compliance with the changes, notwithstanding that some of the HITECH Act provisions, including the marketing provision discussed above, went into effect on February 18, 2010.
Comments are due 60 days after date of publication in the Federal Register, which is expected to be on July 14.