1. If it's Subsidized, Get it Authorized: New Restrictions on the Sale and Use of PHI for Marketing Purposes Under HIPAA's Omnibus Rule
Angela M. Rust
This presentation is limited to a discussion of general principles and should not be interpreted to express legal advice applicable in specific circumstances or to create an attorney/client relationship.

2. Goals for Today's Presentation
Spot instances when a patient's authorization may be required for marketing efforts using PHI.
This is not a substitute for consulting with your legal counsel, but will help you pose intelligent questions and bring matters to your attorney's attention.
Understand generally the recent changes to HIPAA to separate "myth" from real issues, and provide some perspective.
Learn and practice applying the new

3. Changing Law
The Health Information Technology for Economic and Clinical Health Act (HITECH)
Enacted as part of the American Recovery and Reinvestment Act of 2009
Required the Department of Health and Human Services (HHS) to issue regulations making changes to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

4. Regulations
Proposed Rule
Public Comment
Final Rule

5. Rulemaking Implementing HITECH
Notice of Proposed Rulemaking was issued in July 2010
“Omnibus” Final Rule issued January 17, effective March 26, compliance with most provisions is required by September 23, 2013.
Addresses many changes under HIPAA/HITECH, including changes to the rules for marketing disclosures of PHI.
Some provisions changed following public comment and are not the same as the proposed rule.

6. Other Laws and Regulations
HIPAA/HITECH is only one piece of the puzzle
Don’t forget to consider anti-kickback and Stark (anti self-referral) statutes, Medicare Marketing Rules, other state and federal law, internal policies and business associate agreements

7. The Basics You must have an authorization for a sale of PHI.
Authorization is also required for marketing unless:
It is face to face, or
It is a promotional gift of nominal value provided by the CE (covered entity)

8. What is considered a "sale" of PHI under the new Omnibus Rule?

9. Sale of PHI
Sale of PHI used to be addressed under the marketing rules, but is now a separate category of activity that requires authorization
“[A] disclosure of PHI by a CE or BA [which] directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the PHI.”
§ (a)(5)(ii)(B)(1)

10. Further Defining “Sale”
Applies when remuneration is given for access, license, or lease agreements, not just sales that transfer ownership
Remuneration does not have to be financial payment, and may be “in kind” (note: this is the opposite under the new marketing rule!)
Authorization must state disclosure will result in remuneration to CE (can tailor it this language, and explain what kind of remuneration)
Can rely on existing authorizations that do not specify this

11. Disclosures that are exceptions, and not a “sale” of PHI
Public health activities
Research purposes when remuneration reflects cost of preparation/transmittal of the PHI
Treatment of the individual
Sale, merger or consolidation of a CE
Business Associate (BA) compensated for performing services on behalf of CE
Disclosing PHI to an individual about him/herself
Health information exchange fees

12. Examples of Sale of PHI
CE sells patient list composed of women who have recently delivered babies on the maternity unit to local photography studios to advertise newborn portrait services or to formula manufacturers
CE sells patient list to pharmaceutical company that wants to target mailings to patients with a certain diagnosis

13. How does the Omnibus Rule change that definition?
What is “Marketing”?
How does the Omnibus Rule change that definition?

14. Marketing is …
A communication “about a product or service that encourages recipients of the communication to purchase or use the product or service.”
Subject to exceptions

15. The “Exceptions” Under HIPAA
HIPAA provided that communication for the following purposes was NOT marketing:
General Promotion of Good Health
Treatment or Care Management/Coordination
Health Care Operations
The Omnibus Rule took away exceptions 2 and 3, but only when they are “subsidized” by a third party whose product or service is being marketed.

16. General Promotion of Good Health
This does not meet definition of “marketing”
Does not promote a specific product or service, just general good health or routine appointments E.g., Encouraging a healthy diet, getting an annual physical

17. Treatment or Care Management/ Coordination
Communications for treatment, case management, care coordination, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care
Examples:
Patient appointment reminders
Prescription drug samples from treating physician to patient
Is it subsidized?

18. Pharmacy Refill Reminders
Previously fell within “treatment” exception
Now, the treatment exception applies only if:
The reminder is not subsidized, or
The financial remuneration received by the CE in exchange for making the reminder is reasonably related to the cost of making it
Stayed the same from proposed to final rule
“Reasonably related” = actual costs only

19. Health Care Operations Exception
Communications for case management or care coordination, to the extent these activities do not fall within the definition of treatment
Communications made to describe a health-related product or service provided by the CE making the communications.
Is it subsidized?

20. A Communication is Subsidized if…
It is made in exchange for “financial remuneration.”
I.e., a "direct or indirect payment from or on behalf of a third party whose product or service is being described."
This does not include payment for treatment of an individual or “in kind” remuneration
Definition did not change from proposed to final rule

21. Proposed vs. Final Rule on "Subsidized" Communications
Proposed Rule
Final Rule (Follow This!)
Notice of Privacy Practice must disclose that CE may send subsidized treatment communications and that individual may opt-out, AND the communication must disclose remuneration will be received and provide a “clear and conspicuous” chance to opt-out (e.g., by hotline or )
If it's “subsidized," get it authorized. (It is not enough to provide an "opt out" option.)

22. Summary of the Analysis
Is it a communication encouraging purchase/use of a product or service?
Is it face to face or a promotional gift of nominal value?
Is it for general promotion of good health?
Is it for treatment or health care operations purposes?
If so, is there a direct or indirect payment (financial remuneration) for the communication?
Is the payment on behalf of the third party whose product or service is being described?

23. Example: Hospital with New Mammography Equipment
The hospital marketing budget is used to "target mail" former patients an announcement of the new mammography equipment.
Treatment/health care operations exceptions, no authorization required.
The same mailing is paid for by the manufacturer of the new equipment.
Now it is subsidized, get it authorized.

24. Example: Hospital with New Mammography Equipment
A non-profit breast cancer foundation pays for the mailing.
No authorization required (remuneration not by or on behalf of the entity whose product or service is described)
Doctor at hospital sends letter recommending the new equipment to a patient.
Unless it is subsidized, no authorization required (treatment exception).

25. Example: Hospital with New Mammography Equipment
Manufacturer of new equipment pays for color brochures for physicians at the hospital to hand out to patients who may benefit from a mammogram.
Face to face communication, no authorization required

26. Example: Hospital with New Mammography Equipment
Manufacturer of the equipment purchases patient contact information to mail patients an announcement regarding the new equipment.
Authorization required, this is a "sale" of PHI

27. Example: Hospital with New Mammography Equipment
Doctor calls patients and tells them about the new equipment.
Treatment/care management or health care operations exceptions likely apply, unless this is subsidized.
Phone calls are not "face to face" communication.

28. Example: Hospital with New Mammography Equipment
Hospital sends reminders to its patients to get annual mammograms.
Promotion of general health, not "marketing," so no authorization required.

29. Your Questions