On September 19, 2013, the Department of Health and Human Services released guidance addressing HIPAA Privacy Rule limitations on how companies may remind patients to refill their prescriptions in exchange for remuneration (the Guidance).  With limited exceptions, the Privacy Rule requires an individual’s written authorization before his or her protected health information may be used or disclosed for a marketing communication (i.e., a communication about a product or service that encourages the individual to purchase or use that product or service).  The Guidance clarifies the Privacy Rule exception to this authorization requirement for refill reminders and other medication adherence communications relating to drugs or biologics currently prescribed to the individual (refill reminders). 

Permissible Content of and Payments for Refill Reminders

The Guidance confirms that communications provided without an individual's authorization under the refill reminder exception may pertain not only to drugs or biologics that currently are prescribed for the individual, but also to their generic equivalents and may be made up to 90 days after the prescription has lapsed.  Communications about new formulations of a currently prescribed drug or a drug related/ancillary to a currently prescribed drug, however, fall outside the exception.

The Guidance reiterates that costs of labor and supplies necessary to send refill reminders may lawfully be reimbursed by a third party, and adds “capital and overhead costs” as another category of costs for which payment may be made without need for patient authorization.  Moreover, business associates engaged by covered entities to assist in making refill reminder communications may be paid “up to the fair market value of the business associate’s services” and may be paid either directly by the manufacturer whose product is the subject of the communication or through the covered entity that hired the business associate.  Accordingly, a business associate performing multiple functions (i.e., not only those relating to the covered entity’s refill reminder program) may need to segregate fair market value compensation received pursuant to its refill reminder services from compensation for other services. 

Remaining Questions, Future Issues

Notably missing from the Guidance is any discussion of allowable reimbursement for more specialized medication management services, such as clinicians’ services commonly provided by specialty pharmacies for communications with patients about conditions that require complicated therapies.  Thus, authorization may be required if a covered entity or its business associate is to continue to receive remuneration for such services.  In the Guidance, HHS explains that for individuals currently receiving specialized refill reminder communications, specialty pharmacies may continue to receive reimbursement for such communications until the earlier of September 23, 2014, or the next time the individual’s prescription is renewed, provided that the individual does not opt out of receiving communications beforehand.

Also missing is further definition of what constitutes “capital and overhead costs” that may be paid to a covered entity for making refill reminder communications and explanation of what constitutes “fair market value” for business associate services.

While the Guidance provides some more latitude regarding the content of and payment for refill reminder communications, technological advances may reduce the long-term need for paid refill reminder communications.  Mobile apps with refill reminder and other drug management capabilities are catching on with consumers, and several pharmacy service companies, including Express Scripts, now offer apps that facilitate a do-it-yourself approach to medication adherence.  In the near-term, however, to avoid potential exposure for HIPAA violations, covered entities and business associates are advised to review their policies, processes and contractual arrangements to assure compliance with the Guidance, which HHS will enforce as ofNovember 7, 2013.

The refill reminder guidance is available on HHS’s website by clicking here.