HIPAA Marketing Rule Guidance: Better Than Nothing

The HITECH Act made some significant changes to the HIPAA Privacy Rule, updating some provisions and increasing protections for individuals.

The HITECH Act made some significant changes to the HIPAA Privacy Rule, updating some provisions and increasing protections for individuals. Improvement of regulatory schemes that are a little long in the tooth is laudable, since technical and societal changes, of necessity, make for a perpetual game of catch-up. However, it is a challenge for regulators to pick the right battles to fight, and the challenge is made that much more difficult to navigate when, as in the case of the HITECH Act, Congress gets into the weeds with extremely detailed statutory language, thus limiting the regulators’ range of discretion. Since it is often difficult for Congress to act, and even more difficult for it to act rationally, the detailed language of the HITECH Act hamstrings the regulators and the regulated community.

The increased privacy protections include limits on research, fundraising and marketing. Some of the restrictions in the new marketing rule have, in particular, caught the eye of the regulated community.

On the eve of the effective date of the Omnibus Rule, a commercial free speech challenge to the HIPAA marketing rule was brought in federal court, yielding an agreement by the federales to not enforce that portion of the rule (temporarily) and issue subregulatory guidance clarifying the rule to the satisfaction of the litigants. OCR posted the clarifying guidance regarding refill reminders for drugs and biologics.

This guidance did not address all open questions.

I assisted a client recently in seeking additional subregulatory guidance from OCR. My client’s issue was centered on the limitation on remuneration for communication to patients — appointment reminders for eye exams — where these established patients had not previously authorized their eye care professionals to contact them by mail with information about appointments or new types of contact lenses. The reminders do not fall into the category of refill reminders because contact lenses are neither drugs nor biologics (though they are also prescribed and they are not liable to marketing abuses that differ from those relevant to drugs and biologics; they are not high-cost, high-risk implantable medical devices).

Interestingly, the Marketing Rule (and related definitions) permits the use of informational kiosks and displays in the practitioner’s office without advance authorization from the patient. Speaking for myself, I would much rather receive information by mail or email so that I may review it at my leisure and do a little on-line research. It’s not just me: A large proportion of the public prefers to receive marketing information in a manner that allows individuals to review and absorb information at their convenience, and to formulate questions for review with clinicians or other sellers at a later date.

85% of consumers think email, text messages, and voicemails are as helpful as in-person or phone conversations with their healthcare providers. But patients would rather receive via email feedback following in-person visits with their doctors (59%), notices for seasonal health offers such as flu shots (55%), and payment reminders (56%) than receive this information via text message, phone call, or voicemail, according to the survey. For patient care between visits, 49% of patients said they prefer email communication.

(Emphasis supplied.) How to Master Electronic Communication with Patients by Julia Brown, Medical Economics (April 10, 2013). See also: Foresee Press Release on Social Media vs. Traditional Advertising (February 3, 2011) (email preferred by consumers to social media contacts).

Frankly, in this day and age, we thought that it might be time for sub-regulatory guidance expanding the definition of “face-to-face” communications (a term not defined in the regulations) beyond communications between individuals in the same room. At the very least, we thought that that might be somewhere for OCR to hang its hat in extending itself a bit.

In the end, we were unable to obtain guidance that fully addressed our issues. However, OCR was willing to issue guidance that describes some permitted marketing activities — though it falls short of what we sought, and what we thought made sense from a policy perspective. I respect the perspective of the regulators, and the desire to stick within the boundaries of existing regulatory language and commentary.

Letter from Susan McAndrew, OCR, on the Marketing Rule

The key highlights from the OCR letter:

[C]ommunications about products or services that do not fall within the refill reminder exception for one or more reasons are still permitted under the Privacy Rule without authorization if . . . [t]he communications describe the availability of new developments or generations of contact lenses in only a general manner (e.g., do not identify a particular product or brand). For example, an eye care practitioner or its business associate could mail recall notices to individuals that describe in a general, non-brand specific manner new attributes of contact lenses that the individual may wish to inquire about when he or she comes to the office for an eye exam, even if such communications are paid for by the manufacturer of the contact lenses.

. . .

[In addition, covered entities and busines associates] may continue to provide to individuals promotional gifts of nominal value, such as brand-named pens, calendars, etc.,without prior written authorization from the individual.

Good as far as it goes — it does outline a range of permitted activity for the client going forward — but it doesn’t go far enough.

Either HHS or Congress should act to expand the very narrowly limited range of permitted activity in the marketing of certain low cost, low risk devices requiring a prescription.