HIPAA’s Privacy Rule (the “Privacy Rule”), among other rights, gives individuals important controls over whether, and how their protected health information (“PHI”) is used and disclosed for marketing purposes. Generally, “marketing” is communication made to an individual about a product or service that encourages the individual to purchase or use that product or service. With limited exceptions, the Privacy Rule requires an individual’s written authorization before PHI can be used or disclosed for marketing purposes. One of these exceptions involves communications about current prescriptions (the “Reﬁll Reminder Exception”). The Reﬁll Reminder Exception excludes certain communications from the deﬁnition of marketing thereby, permitting the use and disclosure of PHI without the individual’s prior consent for the following purposes:
- Reﬁll reminders about currently prescribed drugs and their generic equivalents;
- Adherence communications encouraging individuals to take currently prescribed medicines as directed;
- Communications about prescriptions that have lapsed within the last 90 calendar days; and
- Communication regarding all aspects of drug delivery systems for currently prescribed drugs and biologics (collectively, the “Permitted Communications”).
Under the Reﬁll Reminder Exception, pharmaceutical manufacturers or other third parties are permitted to compensate “Covered Entities” including doctors, pharmacies, and health plans for services that disseminate Permitted Communications, if the compensation is reasonably related to the cost of providing the services. If Covered Entities enlist the services of third party business associates to carry out services to disseminate Permitted Communications on their behalf, the Reﬁll Reminder Exception requires that payments made by pharmaceutical manufacturers through the Covered Entity to the business associate, or directly to the business associate, not exceed the fair market value (“FMV”) of the business associate’s services.
Monetary exchanges between pharmaceutical manufacturers and Covered Entities, which may include those in a position to prescribe, use, or recommend the pharmaceutical company’s products, can be problematic if there is intent to provide remuneration for referrals. Notwithstanding, the Reﬁll Reminder Exception, may provide a reasonably defensible basis for payments from pharmaceutical companies to healthcare providers, payors and other Covered Entities for such monetary exchanges. The determination of FMV requires a consistent methodology that accounts for the speciﬁc facts and circumstances of the contemplated arrangement, including all direct and indirect costs such as:
- Labor Costs
- Materials, supplies, and services
- Software – Capital and operating costs
- Equipment – Capital and operating costs
- Occupancy and utilities
- Other capital costs
- Overhead allocation
Given the broad reach of HIPAA’s Privacy Rule and the potential for scrutiny of marketing arrangements under Stark law and Anti-Kickback Statute, the valuation of these activities requires careful assessment of operational data, technology, and capital investments being employed in the delivery of excepted communication services. It is prudent for pharmaceutical manufacturers and covered entities to examine marketing practices to ensure they are in compliance with the FMV requirements of the Privacy Rule.