Blog: Chronicle of Data Protection | 20 September 2013

HHS Issues New Guidance, Delays Enforcement on “Refill Reminders” Under HIPAA

On September 19, the Department of Health and Human Services issued new guidance on the “refill reminder” requirements under HIPAA.  The new final HIPAA regulations, most of which go into effect on September 23, 2013, limit the remuneration that a covered entity may receive in exchange for making communications to patients about a drug or biologic currently prescribed to that patient.  While generally the Privacy Rule restricts covered entities from receiving remuneration for making marketing communications, there is an exception for these “refill reminder” and similar communications, provided that remuneration is “reasonably related” to the covered entity’s cost of making the communication.  The new guidance provides a number of clarifications about these communications.  In particular, HHS has clarified and expanded the scope of the costs that may be considered “reasonably related” to include capital and overhead costs, in addition to the previously allowed labor, postage and supplies.

Other clarifications include:

• Covered entities may receive remuneration under the “reasonably related” test for communications about lapsed prescriptions, provided that the script has lapsed in the past 90 days;
• Communications about new formulations of a drug are not considered to be communications about a drug or biologic currently prescribed for the patient;
• A covered entity may use a business associate to engage in such communications, provided that the compensation to the business associate is limited to fair market value for its services;
• Covered entities that choose to obtain authorizations from patients rather than following the “reasonably related” rules may obtain such authorizations from existing patients to whom it is making communications at the earlier of (1) at the time the patient next fills a prescription, or (2) September 23, 2013; and
• Pharmaceutical manufacturer-funded costs for communications that are required by an FDA Risk Evaluation and Mitigation Strategy (REMS) are not considered marketing and thus not restricted under the HIPAA marketing rules.