Health Information Compliance Alert

Proposed amendments to the HIPAA privacy rule mean big changes in marketers' access to health information.

In proposed modifications published in the Federal Register March 27, the Department of Health and Human Services now intends to require explicit authorization for all forms of communication that satisfy the rule's definition of marketing.

In most cases, under the current privacy rule, a covered entity is required to get an individual's authorization before using or disclosing that person's health information for marketing purposes.

However, covered entities do not need authorization to use a person's health information to send out certain types of "health-related" marketing communications. Such communications must satisfy a range of disclosure conditions by including information about who authored the communication, who paid for it, how to opt out of it and why it was sent.

Under the new proposal, however, covered entities must get authorization to use or release health information before issuing any marketing communication.

As such, "health-related" communications previously excluded are no longer exempt from authorization requirements, and covered entities can no longer engage in health-related marketing simply by meeting the required disclosure and opt-out provisions.

"I think they increased the patient protections a lot," says Kristen Rosati of Phoenix-based Coppersmith Gordon Schermer Owens & Nelson. "The present rules allow 'one bite at the apple' in terms of allowing marketing and then giving someone the right to opt out of future solicitation. Now the modifications require advance written authorization before that solicitation occurs and that's perfectly appropriate."

While the proposed changes tighten the demands on marketing, they also include a clearer explanation of what types of communication will be excluded from that definition.

In particular, the proposal indicates that common health care communications such as disease management, wellness programs, prescription refill reminders and appointment notifications will not count as instances of marketing and as such will not require prior authorization.

Specifically, the proposed changes exclude as marketing any communication used: