The Office for Civil Rights of the Department of Health and Human Services (HHS) recently announced the issuance a proposed modification to the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security and Enforcement Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act. Several provisions of this rule are of great interest to pharmaceutical companies and pharmacies.

Prior to the HITECH Act, pharmaceutical companies could pay pharmacies to communicate with their patients for the purpose of either reminding patients to refill their prescription (refill reminders), or to recommend switching to alternative therapies (switch communications). Such communications were considered “health care operations” that did not require a written authorization from the patient. The HITECH Act changed the definition of “health care operations” such that paid switch communications were no longer considered “health care operations” and thus required an authorization.

Thew newly proposed rule provides that since Congress did not make it clear wether the lawmakers intended to  restrict only those subsidized communications about products and services that are less essential to an individual’s health care (i.e., those classified as health care operations) or all subsidized communications about products or services, including treatment communications.  HHS explains that the difference between a switch communication that is healthcare operations and one that is treatment depends on whether the communication is made to all patients, which would be marketing if subsidized by the third party whose product or service is recommended or healthcare operations if unsubsidized, or whether it is based on the treatment needs of an individual, such as a letter to all pregnant patients recommending a particular birthing center.

Under the new rule those paid switch comunication that are to be considered treatment related do not require patient authorization but require only that (1) the covered entity’s Notice of Privacy Practices includes a statement informing patients that the healthcare provider may send the paid switch communications and the individual has the right to opt out of receiving such communication, and (2) that the communication itself disclose the financial payment and the ability to opt out.

Interestingly, HHS asked for comment on whether to expand the HITECH Act exception that permits communications about the drug a patient is currently prescribed (e.g., refill reminders) to be deemed healthcare operations so that the exception includes generic alternatives or new formulations of the drug. This is puzzling, since under the proposed rule, it would appear that such communications could in any event be considered treatment.  It is expected that marketing/treatment distinction will receive numerous comments.