Marketing and Research: New HIPAA Privacy Rules Affect Pharmaceutical, Medical Device Companies’ Use of PHI

The new omnibus final rule recently released by the Department of Health and Human Services (HHS) implementing the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act (Final Rule)¹Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules; Final Rule, 78 Fed. Reg. 5566 (Jan. 25, 2013) (to be codified at 45 C.F.R. pts. 160, 164), available at http://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf. significantly impacts not just HIPAA-covered entities²There are three types of HIPAA ‘‘covered entities’’: (1) health plans, (2) health care clearinghouses, and (3) health care providers who perform certain transactions involving health information in electronic form. See
45 C.F.R. §160.103. Certain medical device companies are covered health care providers; pharmaceutical companies very rarely are any of these types of entities (although company-sponsored employee health plans are HIPAA-covered entities). and their “business associates,” but also many other entities, including members of the pharmaceutical and medical device manufacturing industries.

In particular, the Final Rule changes the provisions of the HIPAA Privacy Rule (Privacy Rule)³Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. pts. 160, 164, subparts A, E. regarding permissible uses of “protected health information” (PHI)⁴“PHI” under the HIPAA Privacy Rule includes, with very limited exceptions, any information relating to an individual’s health that is created or received by a health care provider, health plan, employer, or “health care clearinghouse” and either identifies or reasonably could be used to identify the individual. 45 C.F.R. §160.103. for purposes of marketing and research. On the marketing side, the Final Rule tightens up the current restrictions on the use of PHI to promote particular health-related products or services. On the research side, the Final Rule relaxes current restrictions on obtaining an individual’s authorization to participate in certain types of research.

Pharmaceutical and medical device companies, among others, will want to consider these changes carefully to determine how they may impact their current and future activities. (Medical device manufacturers that are themselves HIPAA-covered entities will also need to review the many other aspects of the Final Rule affecting their operations.)

Background

The Privacy Rule generally prohibits the use or disclosure of an individual’s PHI without a written authorization. There are several exceptions to that general prohibition, including for uses and disclosures for purposes of treatment, payment, and “health care operations.”⁵45 C.F.R. §164.506(c). “Health care operations” are certain types of activities typically undertaken by health care providers and health plans as part of their daily health-related functions. But using or disclosing PHI for marketing or research purposes almost always requires a HIPAA authorization.

The HITECH Act required HHS to amend the Privacy Rule in a variety of ways, including with respect to its restrictions on the use of PHI for marketing. In July 2010, HHS published a proposed rule (Proposed Rule)⁶Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the Health Information Technology for Economic and Clinical Health Act; Proposed Rule, 75 Fed. Reg. 40868 (July 14, 2010). that included such amendments, as well as certain proposed changes to the Privacy Rule not required by the HITECH Act that HHS believed would help eliminate ambiguities in and/or enhance the workability and effectiveness of the Privacy Rule. In response, HHS received approximately 300 sets of comments, including from members of Congress, privacy advocates, HIPAA-covered entities, and business associates. Many of the comments raised complex and controversial issues, and it took HHS almost two and a half years to work through those issues and resolve them to its satisfaction in the Final Rule.

With limited exceptions, the provisions of the Final Rule will be effective as of March 26. Covered entity and business associate compliance, however, is not required until 180 days thereafter—i.e., Sept. 23.

Marketing

Under the Privacy Rule, “marketing” is defined as making a “communication about a product or service that encourages the recipient of the communication to purchase or use the product or service.”⁷45 C.F.R. §164.501. A HIPAA-covered entity may not use PHI for marketing without an individual authorization, unless the marketing communication: (i) is made during a face-to-face encounter with an individual or (ii) consists of a promotional gift of nominal value provided by the covered entity.⁸42 C.F.R. §164.508(a)(3)(i)(A)–(B).

The “marketing” definition is broad, but HHS limited its scope in the Privacy Rule to permit communications made for three purposes deemed to be in the best interests of the individual whose PHI is used to make the communication: (i) describing a health-related product or service that is provided by, or included in a plan of benefits of, the covered entity; (ii) providing treatment to the individual; or (iii) for case management or care coordination for the individual, or directing or recommending alternative treatments, therapies, health care providers, or settings of care to the individual.⁹Id. Prior to the relevant effective date of the HITECH Act (Jan. 18, 2010), these exceptions applied even if the covered entity was paid by a third party to make the communication.

In the HITECH Act, however, Congress altered this legal framework by prohibiting a covered entity from using PHI to make any of the three above-described types of communications without a HIPAA authorization if the covered entity is paid—directly or indirectly—to make the communication.¹⁰HITECH Act, 42 U.S.C. §17936(a)(2) (2009). The only statutory exception to that prohibition is for a communication that “describes only a drug or biologic that is currently being prescribed for the recipient of the communication,” if the payment for making the communication is “reasonable in amount.”¹¹Id. §17936(a)(2)(A). Essentially, this means that a covered entity can accept payment for marketing purposes only to provide refill reminders—and then only for payment up to a “reasonable amount.”

Notably, the HITECH Act did not directly address whether using PHI to make certain paid communications, such as communications recommending that patients switch to alternative therapies, would be for the purpose of “treatment” of a patient and thus not require an authorization. In the Proposed Rule, HHS crafted an approach that it believed was consistent with Congress’s intent for the HITECH Act, proposing to permit remunerated uses of PHI to make such “treatment”-related communications without an authorization, but to require that patients be given the opportunity to opt out of receiving those types of communications.¹²See
75 Fed. Reg. at 40886. The comments HHS received in response, however, indicated that covered entities found the proposed approach too complicated and ambiguous, principally because it would be hard to know whether a communication would be viewed as made for purposes of “treatment,” which by definition is directed to a particular patient, or rather, by virtue of being made to a group of patients, would instead be deemed to be made for more generalized purposes.¹³Id. For example, under the Proposed Rule’s approach, if a health care provider received remuneration for sending a pregnant patient a brochure recommending a specific birthing center suited to the patient’s particular needs, that could be viewed as recommending a setting of care specific to the individual’s condition, in which case there would be no need for an authorization, because the communication would be deemed made for “treatment” of the individual. However, if the provider were remunerated for sending a blanket mailing to all patients with information about a new affiliated birthing center, that might not be deemed for purposes of “treatment” and thus would be “marketing,” and the use of PHI to make the mailing would require an authorization.

In the Final Rule, HHS acknowledged that it received “a great deal of public comment” on its framework for distinguishing communications made for purposes of treatment from nontreatment communications.¹⁴78 Fed. Reg. at 5595. In light of the concerns expressed in the comments, HHS rejected its proposed “treatment”-based distinction and opted for a simple rule that the use of PHI for making any remunerated communication that encourages the recipient to purchase or use a particular product or service requires an individual authorization, with very limited exceptions.¹⁵Id. at 5596. With respect to marketing communications that involve financial remuneration, the covered entity must obtain a valid authorization from the individual before using or disclosing PHI for such purposes, and such authorization must disclose the fact that the covered entity is receiving financial remuneration from a third party.

Refill Reminder Exception. HHS elected to adopt, without modification, its proposed implementation of the HITECH Act’s provision permitting the use of PHI for purposes of remunerated communications that describe “only a drug or biologic that is currently being prescribed for the recipient of the communication.”¹⁶42 U.S.C. §17936(a)(2)(A)(i). Under this provision, a covered entity may, without a HIPAA authorization, be paid to use PHI to send out refill reminders, if the payment for making the communications is “reasonable in amount.”¹⁷Id. §17936(a)(2)(A)(ii).

In implementing this provision in the Final Rule (as in the Proposed Rule), HHS amended the definition of “marketing” to exclude communications made “[t]o provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, [so long as] any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication.”¹⁸Id. at 5696 (to be codified at 45 C.F.R. §164.501) (emphasis added). HHS clarified that “reasonably related” costs in this context are those that cover only the costs of labor, supplies, and postage to make the communication.¹⁹78 Fed. Reg. at 5597. HHS considers any remuneration a covered entity receives in exchange for making a communication that generates a profit (or includes payment for other costs) not to be “reasonably related” to the covered entity’s cost for making the communication.²⁰Id. For example, if a pharmaceutical manufacturer paid a pharmacy an amount sufficient to cover only the pharmacy’s cost of drafting, printing, and mailing refill reminders, no authorization would be required, but if the manufacturer provided the pharmacy an additional amount to encourage the pharmacy’s continued willingness to send such communications, authorizations would be required.²¹Id.

Importantly, in its notice of the Final Rule, HHS clarified the scope of the phrase “drug or biologic currently prescribed” in this context, which was an issue upon which it had sought public comment when releasing the Proposed Rule. Based on the comments it received, HHS concluded that the phrase should be construed to include not only the specific form of a currently prescribed drug, but also generic forms of that drug.²²78 Fed. Reg. at 5596. In addition, HHS determined that, with respect to self-administered drugs or biologics, all aspects of a drug delivery system (e.g., insulin pumps) should be considered within the scope of the phrase.²³Id. HHS also indicated that it intends to provide future guidance through additional examples and suggestions about what should fall within or outside of the scope of this exception.

Financial Remuneration. As noted, the HITECH Act’s restrictions on certain remunerated communications extend not only to those communications for which a HIPAA-covered entity receives payment directly, but also to such communications made in exchange for “indirect payment.”²⁴42 U.S.C. §17936(a)(2). As did the Proposed Rule, the Final Rule uses the term “financial remuneration” rather than “payment” (to avoid confusion with payment for treatment) and defines “financial remuneration” to mean “direct or indirect payment from or on behalf of a third party whose product or service is being described.”²⁵Id. at 5696.

Thus, a covered entity is prohibited from using PHI without an authorization to make a remunerated communication about a product or service not only if the remunerating entity is the producer or provider of the product or service being promoted, but also if the remunerating entity is acting on behalf of such producer or provider. Similarly, the prohibition applies where a business associate of a covered entity, as opposed to the covered entity itself, receives financial remuneration from a third party in exchange for making such a communication (e.g., payment from a pharmaceutical manufacturer to a mailing house that a covered entity engages to send the pharmaceutical manufacturer’s written promotional materials).²⁶Id. at 5595.

In its notice of the Final Rule, HHS also clarified that:

•  The term “financial remuneration” does not include nonfinancial benefits, such as in-kind benefits, provided to a covered entity in exchange for making a communication about a product or service.²⁷Id. at 5596. Thus, for example, a pharmaceutical or medical device company could provide a set of written materials to a covered entity to facilitate communications about the company’s products, so long as there is no financial payment for actually sending the communications.

•  The financial remuneration a covered entity receives from a third party will trigger the authorization requirement only if the remuneration is provided in exchange for the covered entity making a communication that encourages individuals to purchase or use the third party’s product or service.²⁸Id. Thus, a covered entity could be remunerated to communicate with patients about its own services, even if those services may involve the use of the third party’s products, so long as the communication does not specifically promote the third party’s products.

•  The Final Rule does not alter the Privacy Rule’s existing exceptions to the requirement for an authorization to use an individual’s PHI for “marketing,” even with financial remuneration, if the marketing communication: (i) is made in a face-to-face encounter with the individual; or (ii) consists of a promotional gift of nominal value provided by the covered entity. Accordingly, a pharmacy, for example, may continue to use a patient’s PHI to suggest to the patient that he or she might benefit from a drug different from that currently being prescribed, even if the maker of the alternative product pays the pharmacy to make the suggestion (and irrespective of the amount of such payment), so long as the pharmacy’s communications about the alternative product are made solely in a face-to-face encounter with the patient.²⁹Id. (“For example, a health care provider could, in a face-to-face conversation with the individual, recommend, verbally or by handing the individual written materials such as a pamphlet, that the individual take a specific alternative medication, even if the provider is otherwise paid by a third party to make such communications.”). However, the use of PHI to make such communications over the phone (or by mail or email) requires individual authorization whenever the covered entity is paid to make the communication.

The following chart summarizes the authorization requirements described above.

Research

As noted, the Privacy Rule generally requires an authorization for the use or disclosure of PHI for purposes of research. To be valid, a HIPAA authorization must state that providing the authorization does not affect an individual’s right to obtain treatment or health care benefits to cover the cost of treatment. However, there is an exception to this rule in the context of clinical trials, where permitting the use of PHI is integral to the decision to participate in a trial and receive the treatment being evaluated in the trial. Accordingly, health care providers conducting such trials “are able to condition research-related treatment on the individual’s willingness to authorize the use or disclosure of PHI for research associated with the trial.”³⁰Id. at 5609.

Compound Authorizations

Currently, the Privacy Rule does not permit another HIPAA authorization to be combined with a treatment-conditioned research authorization.³¹45 C.F.R. §164.508(b)(3)(iii). As HHS explained in the Proposed Rule, this limitation was intended to help ensure that individuals understand that they may decline the activity described in the unconditioned authorization yet still receive the clinical trial treatment by agreeing to the treatment-conditioned authorization.³²See
75 Fed. Reg. at 40892; see also
78 Fed. Reg. at 5609. For example, if a researcher sought to collect and store tissue specimens collected during a clinical trial that includes treatment, the researcher would need to obtain a separate authorization for the use and disclosure of PHI for banking the specimens, because the permission for use or disclosure of PHI for that activity must be regarded as distinct and unconditioned.

In its notice of the Proposed Rule, HHS acknowledged that various groups, including researchers and professional organizations, had reported that the prohibition on combining “conditioned” with “unconditioned” authorizations may be hampering recruitment into clinical trials, because multiple authorization forms may be confusing for trial enrollees.³³See 75 Fed. Reg. at 40893. To address these concerns, HHS proposed to allow a covered entity to combine treatment-conditioned and unconditioned authorizations for research, provided that the authorization: (i) clearly differentiates between the conditioned and unconditioned research components and (ii) ensures that an individual’s authorization for the unconditioned research activities is provided as an affirmative (opt-in) consent. Thus, it would not be permissible to use a combined authorization that only allows the individual the option to opt out of the unconditioned research activities (e.g., “check here if you do not want your data provided to the specimen/data-bank”).

The Final Rule adopts the proposed approach to allowing compound “conditioned and unconditioned” authorizations for research. In affirming that approach, HHS suggested several ways in which covered entities could design such compound authorizations to ensure they provide the requisite level of clarity, emphasizing that covered entities have flexibility in the methods used to distinguish the conditioned and unconditioned research activities and to design the required “opt-in” mechanism.³⁴78 Fed. Reg. at 5611. For example, any of the following could be used:

•  a combined consent/authorization form for a clinical trial and optional specimen/data-bank component, with a check box for the individual to have the choice to opt in to the optional specimen/data-bank component, and one signature;

•  a combined consent/authorization form for a clinical trial and optional specimen/data-bank component, with one signature for the clinical trial and another signature to indicate the individual agrees to the optional specimen/data-bank component; and

•  a combined consent/authorization form for a clinical trial and optional specimen/data-bank component, with a check box for the individual to have the choice to opt in to the specimen/data-bank component, and one signature, but with detailed information about the specimen/data-bank component presented in a separate brochure or information sheet that is incorporated by reference into the consent/authorization form such that it is considered to be part of the form (even if not physically attached to the form).³⁵Id. HHS noted that if the brochure or information sheet includes required elements of the authorization (or informed consent) then the brochure or information sheet must be made available to potential research participants before they are asked to sign the consent/authorization document (unless the authorization document itself includes the required elements).

The Final Rule also clarifies what is necessary for an individual to revoke only one component of his/her compound authorization, while not affecting the other component. Under the Final Rule, if an individual exercises his or her right to revoke a compound authorization, but fails to make clear whether the revocation applies solely to one aspect of the authorization (e.g., the unconditioned activity component), such revocation must be deemed to apply to the entire authorization (e.g., including the treatment-conditioned component). Only if the individual provides written clarification that states explicitly that the revocation applies only to a portion of the compound authorization may any other portion be considered to remain valid.³⁶Id.

Future Research

Another important area HHS addressed in the Proposed Rule was the Privacy Rule’s requirement that authorizations for the use or disclosure of PHI for research purposes be “study-specific.”³⁷45 C.F.R. §164.508(c)(1)(iv). This requirement is based on the general principle that, to be an adequately informed and protective permission, an authorization must include a description of each purpose of the requested use or disclosure.

However, the “study-specific” requirement is problematic for researchers who seek to use data collected during clinical trials for purposes of future research that may not be clearly envisioned at the time of the clinical trial, as it is frequently impracticable to recontact past trial participants to seek a new authorization at the time when the scope of the future research becomes more definite. Noting this problem and its apparent deterrent to potentially valuable research, HHS stated in the Proposed Rule that it was considering relaxing the “study-specific” requirement.³⁸See
75 Fed. Reg. at 40894.

The Final Rule provides for such modification, permitting an authorization for the disclosure and use of PHI for future “unspecified” research, so long as the authorization is sufficiently descriptive such that it would be reasonable for the individual to expect that his or her PHI could be used or disclosed for such future research. For example, the authorization could state that the PHI may be used “beyond the time of the original study,” or refer to “your future medical records [at Hospital]” or “your future medical records [relating to diseases/conditions].”³⁹78 Fed. Reg. at 5613.

Implications

The Final Rule is something of a “mixed bag” for the pharmaceutical and medical device industries, providing significant benefits on the research side while tightening up on the use of PHI for marketing purposes. In both contexts, there are nuances to the Final Rule that should be considered in planning marketing and/or research activities.