On September 19, the Health and Human Services Department (HHS) issued guidance on the effect of the January 25, 2013 Final Rule provision about remuneration related to prescription refill reminders and medication adherence programs in the absence of a patient's authorization. This guidance came the day before mandatory compliance with Omnibus Rule changes.
Previously the marketing rules and their exceptions to HIPAA had been interpreted to prohibit covered entities and their business associates from profiting by providing patients with refill reminders. The guidance clarifies that patient consent is not required prior to refill reminders or medication adherence programs if payments are received from pharmaceutical companies.
On the primary issue of remuneration, HHS has now taken the position that business associates may be subsidized for the "fair market value" of their refill reminder and medication adherence programs, while covered entities may only receive "reasonable direct and indirect costs" related to such programs. HHS explains that an analysis of a refill reminder and medication adherence program is a twofold inquiry: 1) Is the communication about a currently prescribed drug or biologic; and 2) Does the communication involve financial remuneration, and if so, is it reasonable. The guidance provides:
- Payments to a covered entity by a pharmaceutical manufacturer or other third party whose product is being described may only cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials and supplies, as well as capital and overhead costs. Without patient authorization, only direct and indirect costs are allowed.
- Payments to a business associate up to the fair market value of assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications is permissible. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.
- Communications that involve only non-financial or in-kind remuneration, such as supplies, computers or other materials, are permissible.
- Communications about new formulations of or adjunctive drugs to currently prescribed medications are not allowed.
- Communications encouraging an individual to switch to an alternative medicine are not allowed.
- Communications regarding refills of currently prescribed medications, generic equivalents of currently prescribed medications, and prescriptions that have lapsed in the last 90 days are allowed.
- Where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system are permissible.
As part of the guidance, HHS published a series of informative FAQS that illustrate the scope of the refill reminder exception, which provide significant clarification. The guidance also confirms that pharmaceutical manufacturer-funded communications to patients concerning a prescribed drug are not considered marketing under the Privacy Rule if required by a Risk Evaluation and Mitigation Strategy (REMS). The pertinent FAQ provides that if the FDA determines that a drug can only be approved with additional measures beyond labeling to mitigate risk, and one of those measures is patient communications, then such communications are not marketing, even if the communication is funded by the drug manufacturer. Consequently, a covered entity may use or disclose an individual's protected health information without the individual's authorization to send the individual educational or other information concerning a prescribed drug that is required by a REMS, even if the communication is funded by the drug manufacturer.
Refill reminder programs had become an area of concern after the Final Rule was published, spurring litigation over what was ostensibly an outright prohibition on any profits from reminder programs without an authorization from a patient. In early September 2013, Adheris, Inc., a subsidiary of inVentive Health, brought suit for a declaratory judgment and injunctive relief in the D.C. Federal District Court against HHS, seeking relief from the Final Rule, alleging the provision put impermissible content and speaker based restraints on its protected First Amendment right to free speech, jeopardizing its $49 million refill reminder program. 1 HHS issued the guidance as a part of settling the dispute.
Historically, covered entities and business associates were not required to obtain a patient's authorization for communications made in connection with prescription refill programs. Refill communications have been considered "treatment" communications, not marketing, even if the communications were subsidized by a third party, such as a pharmaceutical company.
The Omnibus Rule provides that a patient's authorization is required for refill reminders unless the financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication. HHS has clarified that the "reasonably related" requirement only allows for "the costs of labor, supplies, and postage to make the communication. Where the financial remuneration a covered entity receives in exchange for making the communication generates a profit or includes payment for other costs, such financial remuneration would run afoul of the Act's 'reasonable in amount' language."
The September 19 guidance will allow prescription refill reminder programs run by business associates, such as Adheris' programs, to remain in place. However, under the guidance, doctors, pharmacies and their business associates may have constraints on their ability to derive profit from refill reminder programs, as remuneration to covered entities is limited to direct and indirect expenses.
The ongoing restrictions on remuneration on refill reminder programs established by the covered entities (without any pharmaceutical input) may be challenged as an impermissible First Amendment restriction, similar to the claims brought by Adheris in its lawsuit against HHS. The argument springs from the 2011 Supreme Court decision, Sorrell v. IMS Health, Inc., in which the high Court struck down a Vermont law that restricted the sale, disclosure and use of pharmacy records that revealed the prescribing practices of individual doctors, holding that "[s]peech in aid of pharmaceutical marketing . . . is a form of expression protected by the Free Speech Clause of the First Amendment." Sorrell v. IMS Health Inc., 131 S. Ct. 2653, 2659 (2011). 2
While the guidance offers significant clarification, and allows for business associates to continue refill reminder programs for the fair market value of the services, the permissible compensation for refill reminder programs will likely be a continuing area of flux in the law. It is almost certain that the limitations on remuneration for covered entities for refill reminders will be challenged in the courts, as it is not clear if the permissible remuneration of "reasonable direct and indirect costs" allows for any profit for covered entities. While the guidance clarifies that business associates may be compensated by pharmaceutical manufacturers for the "fair market value" of the refill reminder services, it is unclear what will constitute fair market value.
Based on the new guidance, we recommend manufacturers, covered entities and their business associates operating refill reminder or medication adherence programs evaluate and document their costs in operating such programs and price such services accordingly. Such documentation should further be well represented in their HIPAA policies and procedures.
If you have questions about this or other HIPAA-related issues, please contact any of the following attorneys:
1 Prescription refill reminder programs are prevalent in the pharmaceutical industry, and have been shown to increase drug therapy adherence, improve patient outcome, and decrease public spending on health care. Adheris' Complaint alleged that failure to follow drug therapy regimens cost up to $290 billion in avoidable medical costs a year and lead to an estimated 89,000 premature deaths from hypertension alone. Adheris also alleged that patients in its refill reminder program are 2-7% more likely to remain compliant with their prescribed drug therapy.
2 The Vermont law at issue in Sorrell targeted a practice called "detailing" in which pharmacies sold information about physician prescribing practices to "data miners" who would analyze the data and sell the reports to pharmaceutical companies. Id. at 2659. The pharmaceutical companies then used the data in marketing to individual physicians. Id. In practice, pharmaceutical companies used the data mining report to primarily market their brand names drugs. Id. at 2662. Because the "detailing" practice is costly, the practice was not used to market generic drugs, which prompted the Vermont legislature's actions. Id. Vermont enacted a statute prohibiting pharmacies, among others, from selling or exchanging for value, any prescriber-identifiable information, without the consent of the prescriber. Id. at 2660. In striking down the law, the high Court found that Vermont's law contained content restrictions on marketing speech and speaker-based restriction on pharmaceutical manufacturers. Id. at 2663.