Alerts and Updates

Refill Reminder Exception to the Privacy Rule Created by the HITECH Act

September 26, 2013

The communication must be regarding a specific drug the individual is taking, and may include such information as how to administer the prescription, reminders to take the prescription or information on generic equivalents.

The passing of the Health Information Technology for Economic and Clinical Health Act (HITECH) resulted in multiple changes regarding existing protection of protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). Part of this was to limit the use of PHI for marketing purposes under what is known as the Privacy Rule. Generally, an individual's PHI may not be used or disclosed for the purpose of making a marketing communication to the individual. However, concern with ensuring effective patient treatment led to the creation of an exception known as the "Refill Reminder Exception." The Refill Reminder Exception became effective on September 23, 2013. On September 19, 2013, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released new guidance regarding this exception, which is discussed below.

The Refill Reminder Exception is intended to allow communication to individuals regarding refills or other key information about drugs or biologics currently prescribed to the individual. In order to fall within this exception, the communication must meet two requirements. First, is the communication regarding a "currently prescribed drug or biologic"? Second, does the communication involve financial remuneration to the entity issuing the reminder? If so, is the financial remuneration reasonable—that is, is the remuneration "reasonably related to the covered entity's cost of making the communication"? The reasonable remuneration limitation does not apply to non-financial or in-kind benefits, such as computers or other materials.

The communication must be regarding a specific drug the individual is taking, and may include such information as how to administer the prescription, reminders to take the prescription or information on generic equivalents. The communication may not include information about specific new formulations of the current prescription, specific adjunctive drugs related to the current prescription or encouragement to switch to an alternate medicine. A communication about recently lapsed prescriptions, within the past 90 days, is allowed as a reminder.

In order to be considered reasonable remuneration, the payment must reasonably cover the expense, direct or indirect, of sending out the communication. This may include the labor, materials, supplies, capital and overhead costs. What is often the easiest way to meet the reasonable remuneration requirement is to not have any. Otherwise, reasonable remuneration examples include: payment from a party not associated with the product or service being described in the communication, such as a health plan; payment from the entity whose product or service is being described in the communication, such as a pharmaceutical company, as long as the payment reasonably covers the expense of the communication; or a remuneration payment of up to fair market value to a business associate to carry out the communication, with the payment to the business associate being allowed to come from the entity whose product or service is being described, such as a pharmaceutical company.

For example, a pharmaceutical company may make a payment to a pharmacy for a communication to remind the patient regarding a refill, as long as the payment is a reasonable payment for the cost of sending out the communication. If a third party is sending out the communication, then the payment, whether from a pharmacy or the pharmaceutical company, must not exceed the fair market value of the services rendered.

If a covered entity seeks to obtain written authorization from its patients to make marketing communications, then only one HIPAA authorization is necessary to cover multiple prescriptions. However, the authorization must expire by a set date or event that relates to its purpose. Further, the authorization has to adequately describe the purpose or purposes for obtaining the waiver of HIPAA rights.

At this time, pharmacies that already send pharmaceutical manufacturer-funded communications to patients, such as specialty pharmacies dealing with complex treatment therapies, will not be required to obtain new authorizations to continue sending such communications. However, the pharmacy needs to obtain an authorization the next time the prescription is renewed and needs to, at a minimum, obtain an authorization no later than September 23, 2014. Further, the existing individuals receiving communications must be allowed to opt out or decline to receive communications.

Any communications about a government or government-sponsored program do not qualify as marketing and, thus, do not need to qualify for the exception. Moreover, any communications required by the U.S. Food and Drug Administration (FDA) as part of the drug going to market is not considered a marketing communication, and thus it does not need to qualify for the refill exception.

Face-to-face communications at the pharmacy or another setting are permitted under the Privacy Rule and do not need to qualify under the refill exception. This includes any material handed from the pharmacist to the individual. Face-to-face communications do not include phone calls or email, which must meet the refill exception.

For Further Information

If you have any questions about this Alert, please contact Philip H. Lebowitz, Erin M. Duffy, any member of the Health Law Practice Group or the attorney in the firm with whom you are regularly in contact.

Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.