If it's Subsidized, Get it Authorized: New Restrictions on the Sale and Use of PHI for Marketing Purposes Under HIPAA's Omnibus Rule Angela M. Rust This presentation is limited to a discussion of general principles and should not be interpreted to express legal advice applicable in specific circumstances or to create an attorney/client relationship.

Goals for Today's Presentation Spot instances when a patient's authorization may be required for marketing efforts using PHI. This is not a substitute for consulting with your legal counsel, but will help you pose intelligent questions and bring matters to your attorney's attention. Understand generally the recent changes to HIPAA to separate "myth" from real issues, and provide some perspective. Learn and practice applying the new

Changing Law The Health Information Technology for Economic and Clinical Health Act (HITECH) Enacted as part of the American Recovery and Reinvestment Act of 2009 Required the Department of Health and Human Services (HHS) to issue regulations making changes to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Regulations Proposed Rule Public Comment Final Rule

Rulemaking Implementing HITECH Notice of Proposed Rulemaking was issued in July 2010 “Omnibus” Final Rule issued January 17, effective March 26, compliance with most provisions is required by September 23, 2013. Addresses many changes under HIPAA/HITECH, including changes to the rules for marketing disclosures of PHI. Some provisions changed following public comment and are not the same as the proposed rule.

Other Laws and Regulations HIPAA/HITECH is only one piece of the puzzle Don’t forget to consider anti-kickback and Stark (anti self-referral) statutes, Medicare Marketing Rules, other state and federal law, internal policies and business associate agreements

The Basics You must have an authorization for a sale of PHI. Authorization is also required for marketing unless: It is face to face, or It is a promotional gift of nominal value provided by the CE (covered entity)

What is considered a "sale" of PHI under the new Omnibus Rule?

Sale of PHI Sale of PHI used to be addressed under the marketing rules, but is now a separate category of activity that requires authorization “[A] disclosure of PHI by a CE or BA [which] directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the PHI.” § 164.502(a)(5)(ii)(B)(1)

Further Defining “Sale” Applies when remuneration is given for access, license, or lease agreements, not just sales that transfer ownership Remuneration does not have to be financial payment, and may be “in kind” (note: this is the opposite under the new marketing rule!) Authorization must state disclosure will result in remuneration to CE (can tailor it this language, and explain what kind of remuneration) Can rely on existing authorizations that do not specify this

Disclosures that are exceptions, and not a “sale” of PHI Public health activities Research purposes when remuneration reflects cost of preparation/transmittal of the PHI Treatment of the individual Sale, merger or consolidation of a CE Business Associate (BA) compensated for performing services on behalf of CE Disclosing PHI to an individual about him/herself Health information exchange fees

Examples of Sale of PHI CE sells patient list composed of women who have recently delivered babies on the maternity unit to local photography studios to advertise newborn portrait services or to formula manufacturers CE sells patient list to pharmaceutical company that wants to target mailings to patients with a certain diagnosis

How does the Omnibus Rule change that definition? What is “Marketing”? How does the Omnibus Rule change that definition?

Marketing is … A communication “about a product or service that encourages recipients of the communication to purchase or use the product or service.” Subject to exceptions

The “Exceptions” Under HIPAA HIPAA provided that communication for the following purposes was NOT marketing: General Promotion of Good Health Treatment or Care Management/Coordination Health Care Operations The Omnibus Rule took away exceptions 2 and 3, but only when they are “subsidized” by a third party whose product or service is being marketed.

General Promotion of Good Health This does not meet definition of “marketing” Does not promote a specific product or service, just general good health or routine appointments E.g., Encouraging a healthy diet, getting an annual physical

Treatment or Care Management/ Coordination Communications for treatment, case management, care coordination, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care Examples: Patient appointment reminders Prescription drug samples from treating physician to patient Is it subsidized?

Pharmacy Refill Reminders Previously fell within “treatment” exception Now, the treatment exception applies only if: The reminder is not subsidized, or The financial remuneration received by the CE in exchange for making the reminder is reasonably related to the cost of making it Stayed the same from proposed to final rule “Reasonably related” = actual costs only

Health Care Operations Exception Communications for case management or care coordination, to the extent these activities do not fall within the definition of treatment Communications made to describe a health-related product or service provided by the CE making the communications. Is it subsidized?

A Communication is Subsidized if… It is made in exchange for “financial remuneration.” I.e., a "direct or indirect payment from or on behalf of a third party whose product or service is being described." This does not include payment for treatment of an individual or “in kind” remuneration Definition did not change from proposed to final rule

Proposed vs. Final Rule on "Subsidized" Communications Proposed Rule Final Rule (Follow This!) Notice of Privacy Practice must disclose that CE may send subsidized treatment communications and that individual may opt-out, AND the communication must disclose remuneration will be received and provide a “clear and conspicuous” chance to opt-out (e.g., by hotline or email) If it's “subsidized," get it authorized. (It is not enough to provide an "opt out" option.)

Summary of the Analysis Is it a communication encouraging purchase/use of a product or service? Is it face to face or a promotional gift of nominal value? Is it for general promotion of good health? Is it for treatment or health care operations purposes? If so, is there a direct or indirect payment (financial remuneration) for the communication? Is the payment on behalf of the third party whose product or service is being described?

Example: Hospital with New Mammography Equipment The hospital marketing budget is used to "target mail" former patients an announcement of the new mammography equipment. Treatment/health care operations exceptions, no authorization required. The same mailing is paid for by the manufacturer of the new equipment. Now it is subsidized, get it authorized.

Example: Hospital with New Mammography Equipment A non-profit breast cancer foundation pays for the mailing. No authorization required (remuneration not by or on behalf of the entity whose product or service is described) Doctor at hospital sends letter recommending the new equipment to a patient. Unless it is subsidized, no authorization required (treatment exception).

Example: Hospital with New Mammography Equipment Manufacturer of new equipment pays for color brochures for physicians at the hospital to hand out to patients who may benefit from a mammogram. Face to face communication, no authorization required

Example: Hospital with New Mammography Equipment Manufacturer of the equipment purchases patient contact information to mail patients an announcement regarding the new equipment. Authorization required, this is a "sale" of PHI

Example: Hospital with New Mammography Equipment Doctor calls patients and tells them about the new equipment. Treatment/care management or health care operations exceptions likely apply, unless this is subsidized. Phone calls are not "face to face" communication.

Example: Hospital with New Mammography Equipment Hospital sends reminders to its patients to get annual mammograms. Promotion of general health, not "marketing," so no authorization required.

Your Questions