The Obama Administration (HHS’s Office for Civil Rights) promulgated its new HIPAA Privacy Rule ostensibly to strengthen consumers’ medical privacy rights. The result, however, is likely to harm patients by restricting clinicians’ and pharmacists’ ability to provide them with compliance and persistence messages – so-called “refill reminders” (about currently prescribed drug therapy). In fact, as we observed when the final rule came out in January, HHS appears to have sacrificed the delivery of high-quality sponsored medical and health education for, at most, negligible enhancement of patient privacy. Those concerns are being realized as pharmacies such as CVS, citing new Privacy Rule concerns, end their long-standing sponsored refill reminder programs.
Patients’ failure to comply with clinician-prescribed therapy costs Americans $290 billion annually, results in $100 billion in annual costs for hospitalization alone, and causes 89,000 premature deaths each year. As the World Health Organization observed, “there is growing evidence to suggest that because of the alarmingly low rates of adherence, increasing the effectiveness of adherence interventions may have a far greater impact on the health of the population than any improvement in specific medical treatments.” HHS clearly recognizes the magnitude of the problem and the importance of patient compliance and persistence programs, actively promoting the communications through its other agencies – e.g., CMS (“meaningful use” and MTMP) and AHRQ (studies and promotes compliance and persistence programs).
As part of the HITECH Act, Congress (led by Senators Kennedy and Harkin) specifically enacted a statutory exception to the requirement for patient authorization for sponsored refill reminder programs. The sole limitation is that any payment going to the covered entity healthcare provider be “reasonable in amount.” 42 U.S.C. § 17936(a)(2)(A). The fundamental problem is that HHS’s final rule implementing HITECH is, in at least three separate but related respects, susceptible to restrictive interpretations that are thwarting Congress’s intent to allow these important communication programs to proceed without patient opt-in.
First, Congress granted statutory authority to HHS to define what constitutes “reasonable in amount.” HHS, in turn, required that “any financial remuneration received by the covered entity in exchange for making the communication [be] reasonably related to the covered entity’s cost in making the communication.” 45 C.F.R. § 164.501 (definition of “marketing,” ¶ (2)(i)), 78 Fed. Reg. 5566, 5696 (Jan. 25, 2013) (emphasis added). Although it lacks the force and effect of law, HHS’s preamble to its final rule suggests a highly restrictive approach to that “reasonably related” language, limiting acceptable costs to those of “labor, supplies, and postage to make the communication. . . . [and, for example,] only the pharmacy’s cost of drafting, printing, and mailing the refill reminders . . . .” 78 Fed. Reg. at 5597.
Given the importance of these vital refill reminder programs, HHS needs to promptly issue its promised guidance, 78 Fed. Reg. at 5596. HHS needs to explain that it intends the “reasonably related” limitation on the statutory exception for refill reminders to be comprehensive in nature and comprise a multitude of healthcare providers’ costs necessary to effectively provide patients with compliance and persistence messaging. Specifically, “reasonable” costs of labor, supplies, postage, drafting, printing, and mailing the communications should be deemed to include an appropriate portion of all associated expenses – e.g., pharmacy personnel, developing messaging content, managing patient records, computer hardware and software, IT infrastructure and maintenance, facility infrastructure and maintenance, utilities, printing supplies and equipment, outside accounting and legal consultants, payments (including a reasonable profit) to third-party business associates, and overhead, including rent, taxes, insurance, and employee benefits. (A reasonable estimate of the cost to produce and deliver a refill reminder message to a patient by mail is between $2.25-$2.50 for large pharmacy chains and much more for smaller chains and independents.) Without clarification, these critical compliance and persistence programs will continue to wane and completely frustrate Congress’s goal of safeguarding the public health.
Second, in an effort to define the scope of the refill reminder exception, the Department offered several important examples of what constitutes a refill reminder – i.e., generic equivalents, communications encouraging patients to take medication as prescribed, messages related to drug delivery systems (e.g., insulin pumps). A more expansive interpretation is nevertheless needed to ensure a broad interpretation of the refill reminder exception consistent with Congressional intent.
For instance, to ensure that Congress’s intent is realized, HHS needs to clarify that improved versions of existing drugs (e.g., extended release of the same active ingredient) are well within the scope of the statutory exception. Because such improved formulations typically offer advantages such as less-frequent dosing, they improve patient compliance and persistence with prescribed therapies and, therefore, squarely comport with Congressional intent underlying the statutory exception.
Likewise, even where a prescription has “expired,” chronic-use therapies are equally appropriate subjects that HHS should expressly recognize as falling within the statutory exception. Clearly, in cases of chronic-use medications, the prescriber intends for the patient to remain on therapy – such patient-directed messaging increases patients’ chances of doing just that.
Moreover, “ask your doctor” communications concerning so-called “adjunctive” therapies (i.e., those designed to treat the same underlying condition or a side effect of another current therapy) also play a key role in improving patient compliance and persistence with prescribed therapies. Because they target the same medical condition or work to alleviate side effects from existing therapies, patients naturally are more likely to remain on their medications and take them as prescribed and dispensed.
A third and final issue that needs prompt clarification concerns covered entities’ use of HIPAA business associates to assist them in administering their refill reminder programs. The preamble contains confusing language that could be read to disqualify business associates from working with the covered entity healthcare providers to deliver these important compliance and persistence messages. E.g., 78 Fed. Reg. at 5595 (“where a business associate . . . as opposed to the covered entity itself, receives financial remuneration from a third party in exchange for making a communication about a product or service, such communication requires prior authorization.”).
If taken out of context, HHS’s statement suggests that business associates could never be used for otherwise permissible messaging programs that do not require patient opt-in. This makes no sense. Clearly, covered entities such as healthcare providers are permitted to use business associates to help administer refill reminder and similar programs.
Although it is a well-accepted principle under HIPAA that a business associate cannot carry out a function using PHI that the covered entity could not do on its own, no sound reasoning supports any conclusion that would preclude the use of a business associate (e.g., a mail house) – or the making of a profit by that business associate – to deliver otherwise permissible refill reminder messages. Indeed, without the ability to use business associates to provide both operational expertise and scale, most chains would not be able to offer these programs.
Put simply, nothing in the legislative history of the HITECH Act suggests that Congress intended the statutory exception for refill reminders – in terms of scope, the use of business associates, or the “reasonable in amount” limitation – to be interpreted narrowly or in any way that would reduce the prevalence or effectiveness of compliance and persistence messaging programs. Indeed, Congress enacted the statutory exception to strengthen the legal foundation for these communications. HHS needs to clarify these issues quickly as contrary interpretations will serve only to hamper these important public health programs and lead to a rise in healthcare costs – results that Congress sought to avert as part of its efforts under HITECH.
