Health Information Compliance Alert

Proposed changes to the HIPAA privacy rule have big implications for marketers' use of PHI: It's given them greater freedom to use the information while at the same time raising the blood pressure of scores of irate privacy advocates.

The Department of Health and Human Services' March 27 notice of proposed rule-making alters the privacy rule by eliminating the special provisions for marketing health-related products and services and requiring an individual's authorization for any communication defined as "marketing."

The NPRM defines marketing as "to make a communication about a product or service to encourage recipients of the communication to purchase or use the product or service." According to the NPRM, covered entities wouldn't be permitted to make any type of marketing communications without first obtaining an authorization. At first blush that seems like a strict standard, but close analysis of the NPRM reveals that exemptions from the marketing requirements could swallow the rule.

Exemptions from marketing status would include: descriptions of entities that participate in a health network and their products and services; communications for treatment of an individual; and communications for case management or care coordination for that individual, or to direct or recommend alternative treatments, therapies,health care providers, or settings of care to that individual.

In an April 25 letter to Secretary Tommy Thompson, John Lumpkin, chair of the National Committee on Vital and Health Statistics, expressed several concerns with the NPRM stemming from what he considered imprecise language that could lend fertile ground to a broad interpretation of the rule.

Privacy advocates are fuming over the NPRM; they say the rules will create more problems than they attempt to solve. Janlori Goldman, director of the Health Privacy Project at Georgetown University's Institute for Health Care Research and Policy, said April 25 in testimony before the Senate Committee on Health, Education, Labor and Pensions that the net effect of the proposed changes would substantially weaken the privacy rule by contracting the definition of marketing.

And Goldman's point of view has been well-received by some in the industry. "One would think by reading the rules that the marketing provisions are now more restrictive or more protective of patient rights because the rules say you need an authorization before you disclose any information for marketing purposes. But when you read through the rule, they have exempted so much from the definition of marketing that it seems that the new proposed rule has basically gutted the rule by expanding the definition of marketing," explains Michele Masucci, a partner with the New York office of McDermott Will & Emery.

Generally, the NPRM's marketing provisions exclude anything associated with a health-related service or product. "So, communications made in connection with a health-related service or product don't fall into the definition of marketing," Masucci says.

Additionally upsetting to privacy advocates is the older provision that stipulates if the provider gets paid for a marketing activity, the patient has to be notified and given a chance to opt out. That's no longer so. Under the notice, there's no longer a distinction between whether the provider gets a paid or not. Groups such as Goldman's say if the provider is getting paid, that creates a conflict of interest that the patient should know about.

"And that really gets to the core of the rule," Masucci tells Eli. "The lack of notifying about remunerations makes this a conflict of interest in terms of marketing something that privacy advocates feel individuals should be notified of. They should know where the providers' interests lie."