In response to recent litigation as well as concerns from the health care industry and privacy advocates, the Office for Civil Rights (OCR) has published guidance regarding the scope of the refill reminder exception under the HIPAA Omnibus Rule. Specifically, OCR has made clear that third party providers of refill reminder services may be paid “fair market value” for their services.

Background

The HIPAA Privacy Rule, as modified by the HIPAA Omnibus Rule, generally requires individuals to authorize uses or disclosures of their protected health information for marketing purposes. For example, a pharmacy cannot compile a list of customers on high blood pressure medication in order to target products of interest to those customers. Often, however, targeted communications can be useful for patients, so HIPAA contains exceptions, such as an exception for refill reminders and other communications about a drug or biologic currently prescribed for the individual. When a third party – like a pharmaceutical company – pays for such a communication, the HIPAA Omnibus Rule requires that the payment be reasonably related to the cost of the communication, or the costs of labor, materials, postage and other out of pocket costs. This limitation caused concern for vendors of prescription refill reminder services who were left with the choice of either breaking even on their services or violating the law by making a profit. The payment limitation prompted a lawsuit by Adheris, Inc.challenging the scope of the HIPAA Omnibus Rule on a constitutional basis and seeking to enjoin its enforcement.

OCR’s Clarification

Through guidance and FAQs published today, OCR has made clear that permissible reasonable costs for a vendor’s provision of refill reminder or other adherence communications includes the fair market value of the service. Note, however, that subsidized marketing communications made by a pharmacy or health care provider directly are still limited to the actual costs of making the communication. Regulated entities of all kinds should review the guidance and related FAQs and structure their outreach programs accordingly.