Although HIPAA-compliant sponsored “refill reminders” have always been legally permissible for a host of treatments under California’s Confidentiality of Medical Information Act (CMIA), Cal. Civ. Code §§ 56-56.37, the state finally came right out and said so. California’s Office of Health Information Integrity (CalOHII), just published its long-awaited State Health Information Policy Manual (“Manual” or “SHIPM”), expressly recognizing that “refill reminders” do not require patient authorization in California. See Manual at 35-36 (section 2.2.7. (Marketing)).
CalOHII is the state agency charged with ensuring the safe movement of electronic health records to support better health and outcomes for Californians. Its Manual principally seeks to harmonize the CMIA with the federal HIPAA Privacy Rule: “SHIPM is an important tool that helps CalOHII fulfill its responsibility for providing statewide leadership, coordination, direction, and oversight of the Health Insurance Portability and Accountability Act (HIPAA) implementation and compliance, including the setting of statewide policy.” Manual, Introductory Letter from Elaine Scordakis, MS, Assistant Director, CalOHII, to SHIPM User (“Scordakis Letter”), at unnumbered p. 2.
Specifically, the Manual’s Marketing Policy expressly states that:
The following . . . do not require an authorization: . . . Refill reminders, or other communications about a drug or biologic currently being prescribed to a patient. Federal law permits state entities to receive payment for these communications as long as the amounts received are reasonably related to the cost of creating the communication and include only the costs of labor, supplies, and postage to make the communication.
Manual at 36. In recognizing this broad exception to the definition of “marketing,” it also includes numerous useful examples of acceptable sponsored “refill reminders” and other adherence- and compliance-focused communications:
Examples [of refill reminders] include, but are not limited to:
a. A pharmacy emails a patient of the need to refill their prescription
b. A pharmacy sends a letter to a patient that the patient is running out of refills and to see their provider for renewal
c. A pharmacy calls a patient to inform them medication is available for pickup.
Id. As CalOHII makes clear, however, that is certainly not an exhaustive list. Rather, the Manual appears to build on the authority contained in the CMIA to extend benefits of sponsored “refill reminders” and other adherence and compliance communications that are permissible across the country pursuant to the HITECH Act, the federal HIPAA Privacy Rule, and HHS’s “Refill Reminder” Guidance, The HIPAA Privacy Rule and Refill Reminders and Other Communications about a Drug or Biologic Currently Being Prescribed for the Individual (Sept. 2013).
This is good news for Californians who have, for a variety of reasons over the past ten-plus years, been effectively denied the critical health benefits of customized, sponsored prescription drug adherence and compliance communications such as “refill reminders.” This was largely due to apparent confusion within the healthcare community regarding the interplay between the HIPAA Privacy Rule and California law.
Now, however, it is clear that sponsored “refill reminders” and similar adherence and compliance communications are permissible under California law as interpreted by CalOHII in its Manual.
CalOHII is actively soliciting and accepting comments on the Manual and intends to modify it on an ongoing basis:
[W]e welcome your feedback on the manual. The SHIPM is intended to be a useful, living document that provides on-going guidance and support to HIPAA-impacted state departments. We expect it to be an ongoing, well-used and well-trusted resource. To ensure the SHIPM’s ongoing effectiveness, please send any recommended changes to CalOHII for consideration at OHlcomments@ohi.ca.gov.
Manual, Scordakis Letter, at unnumbered p. 3. The Manual, therefore, is intended to be an “evolving document” that CalOHII clearly plans to continue refining in harmony with the federal HIPAA Privacy Rules. CalOHII further makes clear that the Manual unquestionably applies as meaningful guidance to private entities: “entities outside of state service may also use SHIPM policies to assist with the difficult task of reconciling state and federal medical privacy and security laws.” Manual, Scordakis Letter, at unnumbered p. 3.
We will continue to watch CalOHII’s development of the Manual with interest and provide updates on its progress toward complete harmonization with the federal HIPAA Rules.
