Federal medical privacy rules strengthened; Medication adherence must be protected – National Consumers League

Last week, the U.S. Department of Health and Human Services’ (HHS) Office of Civil Rights (OCR) published its long-awaited final rule revising the nation’s federal medical privacy requirements under the HITECH Act of 2009 – a.k.a. the “HIPAA Privacy Rule.” NCL, a founding member of the Best Privacy Practices Coalition, congratulates HHS for strengthening consumer privacy and data security protections, and enhancing enforcement for HIPAA violations by covered entities and their business associates.

The final rule attempts to strike a balance between patients’ privacy concerns and the meaningful benefits of sponsored and non-sponsored communications that can improve adherence to prescribed therapies and greatly improve patient health. Notwithstanding HHS’s efforts, there remains some tension between certain of the privacy protections and the goals of bolstering public health.

The problem of poor medication adherence is a major, and significantly under-appreciated health problem. Studies suggest that nearly three-out-of-four Americans do not take their medication as directed and that the cost to the health care system of non-adherence annually is a $290 billion. To address the problem, NCL is leading a medication adherence public awareness campaign, Script Your Future (www.scriptyourfuture.org). NCL’s campaign is designed to help patients take their prescribed medication as directed and better manage health problems such as diabetes, COPD, asthma, high blood pressure, and high cholesterol.

To help combat this problem of poor adherence, most pharmacies, health plans, and doctors provide a broad range of patient-directed communications regarding prescription drug therapies, including communications that encourage patients to stay on prescribed therapy. NCL’s views these communications, particularly “refill reminders,” as tools that help patients follow their medication regimen.

While we are pleased that the rule does allow use of “refill reminders” we are concerned that HHS’s final rule is more restrictive than the prior HIPAA Privacy Rule in requiring patient authorization (opt in) for health care providers’ (and health plans’) capability to use patient information to execute certain sponsored patient communications programs (refill reminders are excepted). To its credit, in addition to codifying the statutory exception for “refill reminder” messages, HHS also maintained the exception for sponsored communications that are delivered in face-to-face settings (e.g., in the pharmacy or doctor’s office).

In particular, we are concerned that the statutory exception for “refill reminders” is available only if compensation received by the covered entity provider or plan is “reasonably related” to the entity’s costs of making the communication. Although Congress included this “reasonable in amount” limitation in the HITECH Act, NCL believes that HHS has gone too far in its preamble interpretation by limiting such compensation to only certain direct costs. Specifically, under the final rule, HHS considers permissible costs to be restricted to those of labor, supplies, and postage to make the communication and that they include “only the pharmacy’s cost of drafting, printing, and mailing the refill reminders.” It sounds like a minor point, perhaps, but we are concerned that this could have a negative impact on patient adherence. We think that a broader definition of costs is called for, including such things as computer hardware, software, and other overhead – because we don’t want to inhibit in any way communications that can help improve the likelihood of patient adherence to medication.

We also are concerned that, from a policy standpoint, the “reasonable compensation” requirement may inhibit HHS efforts to promote medication adherence, and in the end does little to advance patient privacy. For instance, HHS’s Centers for Medicare and Medicaid (CMS) requires and rewards patient adherence programs in several respects, including through physicians’ “meaningful use” of electronic health records (EHRs). Furthermore, in order for vendors implementing Medicare part D to qualify for reimbursement, they must make use of CMS’s Medication Management Therapy Programs (MTMP), which are, by their very nature, adherence -focused incentives. In addition, HHS’s Agency for Healthcare Research and Quality (AHRQ) has studied the comparative effectiveness of medication adherence interventions and funds adherence educational programs.

We’re concerned that HHS’s interpretation of “reasonable compensation” may not be grounded in good public policy and could actually hamper sponsored adherence efforts, which are widely regarded as beneficial to public health. In the final rule, HHS signaled its intention to issue informal guidance on the “refill reminder” exception. NCL hopes that, in so doing, HHS will make clear that the exception serves an important public health function and that “reasonable compensation” ought to be interpreted in the broadest possible fashion in order to ensure that we are doing all we can to promote improved medication adherence.