Cybersecurity in the Health Sector
The health sector is under siege with cybersecurity threats. Some of the largest announced cyber attacks in U.S. history have targeted organizations in the health industry. Regulators have...
02 May 2016HHS Issues New Guidance, Delays Enforcement on “Refill Reminders” Under HIPAA
On September 19, the Department of Health and Human Services issued new guidance on the “refill reminder” requirements under HIPAA. The new final HIPAA regulations, most of which go into effect on September 23, 2013, limit the remuneration that a covered entity may receive in exchange for making communications to patients about a drug or biologic currently prescribed to that patient. While generally the Privacy Rule restricts covered entities from receiving remuneration for making marketing communications, there is an exception for these “refill reminder” and similar communications, provided that remuneration is “reasonably related” to the covered entity’s cost of making the communication. The new guidance provides a number of clarifications about these communications. In particular, HHS has clarified and expanded the scope of the costs that may be considered “reasonably related” to include capital and overhead costs, in addition to the previously allowed labor, postage and supplies.
Other clarifications include:
- Covered entities may receive remuneration under the “reasonably related” test for communications about lapsed prescriptions, provided that the script has lapsed in the past 90 days;
- Communications about new formulations of a drug are not considered to be communications about a drug or biologic currently prescribed for the patient;
- A covered entity may use a business associate to engage in such communications, provided that the compensation to the business associate is limited to fair market value for its services;
- Covered entities that choose to obtain authorizations from patients rather than following the “reasonably related” rules may obtain such authorizations from existing patients to whom it is making communications at the earlier of (1) at the time the patient next fills a prescription, or (2) September 23, 2013; and
- Pharmaceutical manufacturer-funded costs for communications that are required by an FDA Risk Evaluation and Mitigation Strategy (REMS) are not considered marketing and thus not restricted under the HIPAA marketing rules.
HHS also announced that it will not enforce the restrictions on these communications until November 7, 2013.
HHS also issued new guidance delaying the enforcement date for notices of privacy practices for CLIA certified clinical laboratories, and issued new guidance on HIPAA requirements related to student immunizations and use of protected health information for decedents.
