Health Information Compliance Alert

The Department of Health and Human Services' final privacy rule throws a blob of spackle onto what HHS considers loopholes in the marketing provisions, but some say not all of the fissures in the rule have been properly sealed.

The final privacy rule defines at length what the HHS considers to be "marketing." As most covered entities know by now, the HHS redefined marketing Aug. 14 "to make a communication about a product or service that encourages the recipients of the communication to purchase or use the product or service."

Communications excluded from the definition even if such communications involve third-party remuneration include case management or care coordination for the individual, including recommendations for alternative treatments, therapies, health care providers, or care settings; descriptions of health-related services or products or payments for those services that are included in a benefit plan or provided by the covered entity that makes the communication; and an individual's treatment.

Authorizations are required before any marketing communication can be performed unless the communication is made face-to-face by an entity to an individual or involves promotional gifts "of nominal value."

According to Marilyn Lamar, an attorney with McDermott Will & Emery, the new definition has caused quite a stir. Lamar says one of the primary changes to the definition is that it doesn't focus nearly as keenly as the old rule on the intent of the communication.

"One of the things covered entities find most troublesome is that if you're within the definition of marketing, you need to get an authorization and also to disclose whether you're going to be receiving remuneration. A lot of covered entities don't want to disclose that," she stated in an audio conference, "Finalized Amendments to the HIPAA Privacy Regulations: What They Mean for Your Organization's Implementation Plans."

Lamar says one bit of controversy in the marketing definition includes the exceptions to the definition, especially as they pertain to the activities of pharmaceutical companies. "There's a great deal of concern there," she states. "There's concern that if a provider were being paid to send prescription reminders, that it wouldn't be within the definition of marketing because it's part of treatment, and therefore the physician could be getting compensated for sending the reminder and no one would know about it."

And others are troubled that exceptions related to treatment and to discussing one's own health care services might be too broad. "I think [the definition] is going to be unclear," offers Eileen Kahaner with the D.C. office of Arent Fox Kintner Plotkin & Kahn. Kahaner believes there's enough ambiguity in the definition to generate disagreements and controversy, especially pertaining to the sale or furnishing of information for a third-party to market services. Some may argue that that's not marketing third-party services rather, it could be construed as an activity related to treatment of patients, she notes.

Kahaner doesn't expect the new marketing definition to have a significant impact on most small covered entities such as physicians' practices because she believes most small practices won't think to sell their patient lists and other patient data.

It's the larger organizations that are likely to be most affected, Kahaner anticipates. "For larger health systems, or for third parties who are trying to develop more creative relationships with providers, they're going to have to think more carefully about how to get their activities into the [privacy rule's] exceptions."

Another potential source of marketing infringement has to do with the opt-out provision that was deleted from the final rule. Under the earlier rule, individuals had the opportunity to opt out of marketing. Now that the rule has been canned, some say the door has been opened to many activities that look and smell a lot like marketing. "Suppose I'm a pharmacy benefit manager. If I know what drug you're taking, I know what's the matter with you," says Washington privacy and information policy consultant Robert Gellman.

Gellman says he's been told that the insurance companies reviewing applicants don't even look at medical records a lot of times they just want to know the drugs. "They go to the pharmacy benefit manager, they buy the information, and 'poof,' they decide on whether you're at risk or not. The PBMs, which are basically invisible to patients, can do whatever they want."

Gellman finds it inappropriate that health care providers can solicit marketing authorizations and argues that patients are given a myriad of forms to sign one contains an authorization for marketing when the patients are ignorant of what they're signing.

More disturbing than that, according to Gellman, is the absence of an expiration date on the authorization form. Signing an authorization can render an individual defenseless for years to come, he says. "Under the rules, the authorization can be forever, and the disclosures that are made for marketing purposes under that authorization don't have an accounting requirement."

Gellman says since there's no disclosure history that has to be maintained, individuals can find themselves being solicited from those who know all of their ailments. And he says there may not be an opportunity to keep track of where the initial disclosure originated. "So, where can I go to cancel the authorization? Each facility says they don't have it."

For those reasons, Gellman believes authorizations, especially in the context of marketing, should have an absolute expiration requirement. And though Gellman claims that the present marketing rule represents a great improvement over the earlier rule created under the Clinton administration, he believes the rules are sufficiently ambiguous to open up further controversies: "This is when lawyers start playing games at the edges," he says.