New HIPAA Limitations and Changes

NEW HIPAA LIMITATIONS ON USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION AND REQUIRED CHANGES TO NOTICE OF PRIVACY PRACTICES AND POLICIES

(I)The United States Department of Health and Human Services Office of Civil Rights final modified HIPAA regulations under the HITECH Act are now in effect and health care providers must achieve compliance with all of the new requirements by September 23, 2013. This is one in a continuing series of blogs from Pierce & Mandell, P.C. describing some of the major changes health and dental practices, hospitals and other health care facilities must be following by that date.

By Kate Auerbach, Esq., Rebecca Merrill, Esq.  and William Mandell, Esq.

Marketing.

The modified HIPAA Privacy Rule redefines ‘marketing’ and increases the limits on the use and disclosure of protected health information (“PHI”), including patient contact information, by health care providers to do marketing.

Previously, marketing was defined as communication about a product or service to encourage individuals to purchase or use the product or service. While providers previously had to obtain a patient’s written authorization before using or disclosing their contact information for marketing purposes, the HIPAA Privacy Rules has allowed for several broad exceptions to securing patient authorization, including any communication about products or services offered by the provider itself or that recommended alternative treatments.  

Under the modified Privacy Rule, starting on September 23, 2013, providers will now have to secure their patients’ written authorization in order to use their contact information for marketing about health-related products or services if the provider or its business associates receive any financial remuneration in exchange for making the marketing communication from or on behalf of the third party whose product or service is being described. The modified rule does include an exception for refill reminders or communications about a medication being prescribed as long as the only remuneration received is reasonably related to costs of making the communication (labor, supplies, & postage). For example, if a medical practice sent a mailing without advance patient authorization about a new medication on the market and received compensation the practice could violate HIPAA (such remuneration, however, could raise fraud and abuse compliance issues). However, if the practice sent information about refilling a prescription and was reimbursed for the cost of the mailing it would not need to secure written authorization from the recipient/patients.

Under the modified Privacy Rule, marketing authorization forms must disclose to the patients the remuneration received by the provider from the third party and must also state that the patient may revoke the authorization at any time.  

There are exceptions to this authorization requirement. If a communication is made face-to-face by a practitioner to a patient or if a promotional gift of nominal value is given, then advance patient written authorization is not required.  Additionally, refill reminders, adherence reminders and delivery system instructions are allowed without pre-authorization, as long as the remuneration received is reasonably related to the cost of making the communications, and the provider does not make a profit.  

Fundraising.

The original HIPAA Privacy Rule allowed non-profit providers to use, or disclose to a business associate or an institutionally related foundation, specific types of information about patients for fundraising activities without advance authorization, including demographic information and dates of service.

The modified Privacy Rule creates additional categories of PHI that can be used for targeted fundraising communications.  These categories include: (i) department of service (general department of treatment); (ii) treating physician information; (iii) outcome information, and (iv) health insurance status.  This expanded scope of permissible information flow for fundraising related uses and disclosures is intended to permit non-profit providers to develop more focused fundraising efforts to particular individuals.  

However, HIPAA now requires starting on September 23, 2013 that fundraising communications to patients include a clear and conspicuous opportunity for the patient to “opt out” of receiving further fundraising communications.  The opt-out method can be chosen by the provider but it must not cause an “undue” burden” to patients and they cannot be required to write letters to the provider in order to opt-out of having their PHI used for fundraising purposes. Once a patient elects to opt-out the provider is absolutely prohibited from sending any more fundraising communications.  Non-profit providers are also prohibited from conditioning treatment or payment on a patient’s choice not to receive fundraising communications.

Obviously, these new requirements and limitations imposed on providers that do fundraising will add to their administrative burden and cost as a result of the need to avail patients of an opt-out or opt-in system and to track and ensure properly targeted marketing to patients and their families.

Sale of PHI.

The modified HIPAA Privacy Rule also prohibits the sale of PHI by a covered entity or business associate. “Sale” is defined as the receipt of remuneration, directly or indirectly, in exchange for PHI, without patient written authorization, unless the sale meets a specified exception.  

There are eight exceptions to this sale of PHI prohibition, which include: (1) for public health activities; (2) for research, where the only remuneration received by the covered entity is a reasonable, cost-based fee to cover the cost to prepare and transmit the PHI for such purpose; (3) for treatment and payment purposes; (4) for the sale, transfer, merger or consolidation of all or part of the covered entity and related due diligence; (5) to or by a business associate, if the only remuneration is provided by the covered entity to the business associate for the performance of its contracted services; (6) providing an individual with access to his or her PHI; (7) for disclosures required by law; and, (8) for any other purpose permitted by and in accordance with the applicable requirements of the Privacy Rule, where the only remuneration received by the covered entity is a reasonable, cost-based fee to cover the cost to prepare and transmit the PHI for such purpose, or a fee otherwise expressly permitted by other laws.

Modification to Notice of Privacy Practices and health Information Policies and Procedures

No later than September 23, 2013 all providers that are covered entities under HIPAA must modify their required HIPAA Notice of Privacy Practices (“NPP”) and Health Information Policies and Procedures to incorporate the above mentioned changes on the patient privacy rights as to the use and disclosure of their health and personal information for marketing, fundraising and sales purposes, as well as the other new rights established under the HIPAA modified Privacy Rule. These include:

• Right to limit any use or disclosure of PHI for certain sales, marketing and fundraising purposes before granting written authorization

• Right to restrict disclosure of PHI to a health plan when the patient opts to pay the provider in full directly out of pocket

• Right to be informed by a provider or other covered entity of any breach of unsecured PHI

• Right to obtain electronic copies of PHI

• Any uses and disclosure of PHI for treatment, payment or operations not stated and described in the NPP may only be upon patient written authorization.

• Any prior written authorization granted may always be revoked.

Providers should be moving forward now to update their NPPs and Policies to reflect the new requirements in the modified HIPAA Privacy Rule. Care should be taken in the drafting of the modified NPP as it will now dictate if written authorization is needed for certain uses an disclosures even beyond those otherwise required under more stringent applicable state privacy laws. The new form of the NPP does not have to be shared with existing patients. It only needs to be posted on the provider’s website and in prominent place in its office or facility and given to all new patients during their first encounter or admission starting no later than September 23, 2013.

Please feel free to contact the health law attorneys at Pierce & Mandell if you desire additional information on this subject.

< Go Back...