At odds over privacy
Rx industry pushes back against refill reminder rule
Ashowdown is shaping up between federal healthcare privacy regulators and the nation’s largest pharmacies and pharmaceutical manufacturers over a healthcare privacy rule affecting upwards of 100 million prescription-refill reminders sent to patients each year.
In July, CVS Caremark Corp. plans to halt its pharma-funded marketing program that mails prescription-refill reminders to customers. The company cited new limits on the use of patient-identifiable “protected health information” for marketing.
Meanwhile, two pharmacy trade groups— the National Association of Chain Drug Stores, or NACDS, and the Food Marketing Institute—have weighed in, too, but more moderately. They have called on HHS’ Office for Civil Rights to loosen up a portion of the omnibus privacy rule it released in January. The rule permits pharmacies to receive pay- ments from pharmaceutical manufacturers so pharmacies can send their customers the refill reminders in the mail.
One industry source said that between 75 million to 100 million of the mailings are sent a year, with pharmacies receiving payments of about $1.50 apiece to send them. They predominantly go to chronically ill patients on long-term medications, such as people with diabetes and high blood pressure.
The chronic illnesses targeted by drug compliance programs in general are among the most costly diseases in healthcare. “You’re talking 50 (million) to 75 million (people) in the U.S. with hypertension,” and many take prescription medications at one time or other, said Dr. David May, chairman of the American College of Cardiology Board of Governors.
Uncontrolled high blood pressure can lead to cardiovascular disease, the No. 1 cause of death in the U.S. Compliance with long-term medications, meanwhile, May said, “is not very good—it’s 50% to 60%.”
And while the value of some compliance programs is well-documented, the efficacy of pharma-funded mailings through pharmacies is unclear.
May said “a very robust body of literature” indicates that reminders in general help patients with compliance, but the research focuses on phone and other programs, not mailers.
“Whether a snail-mail piece has better response is not known,” May said. The drugmakers and pharmacies are probably “tracking that internally, (but) there are no published data that I am aware of which indicate better acceptance one way or another.”
The new federal rule fleshes out the more stringent privacy provisions in the American Recovery and Reinvestment Act of 2009 and updates the initial privacy rule created under the Health Insurance Portability and Accountability Act of 1996. The effective date of the rule is Sept. 23.
The ARRA, however, carved out a specific exemption for the use of patient data without patient authorization for thirdparty-funded marketing for prescription refills. It permits payments from pharma companies to the pharmacies for the refill mailings, so long as the payments are “reasonable in amount.”
Congress instructed HHS to define what was reasonable in this context, and the agency concluded that the notices should not be a profitable enterprise for pharmacies.
The privacy rule itself says payments must be “reasonably related to the covered entity’s cost of making the communication.” The lengthy preamble to the rule adds that “only the costs of labor, supplies and postage to make the communication” are allowable. It says if a payment “generates a profit or includes payment for other costs, such financial remuneration would run afoul of the act’s ‘reasonable in amount’ language.” CVS finds that interpretation intolerable.
“Over the years, we have collaborated with pharmaceutical companies to improve patient compliance to medication dispensed in our retail pharmacies by mailing select refill reminders to encourage and improve their medication adherence,” Mike DeAngelis, director of public relations at CVS/pharmacy, said in an e-mail. “However, in light of the recent HIPAA omnibus rule effective this September that places new restrictions on the usage of PHI, we have decided to end
supplier-funded refill reminders through our retail business.”
DeAngelis said the pharmacy chain will continue its own programs that promote medication adherence, such as phone calls to patients. No other pharmacy chain, so far, has announced plans to follow CVS’ lead, according to the associations.
In their May 3 letter to Susan McAndrew, deputy director for health information privacy at the Office for Civil Rights, the two pharmacy associations asked the agency to issue “guidance” on the scope of the refill reminder rule.
They want “reasonable” compensation much more broadly defined to include many specific costs such as legal advice and depreciation of equipment used for the mailing.
Without such guidance, pharmacies may conclude the programs are too much trouble.
“The marketing definition changed, and we also have that prohibition on the sale of” personal health information in the omnibus rule, said Rebecca Williams, a partner with the law firm Davis Wright Tremaine. There may be “some uncertainty as to what may be deemed to be a reasonable amount,” she said, adding that this may be “a gray area they don’t want to be in.”
That’s particularly so since the Office for Civil Rights already has hit the industry hard. In 2009, CVS Caremark paid $2.25 million in a joint HIPAA settlement with the OCR and the Federal Trade Commission. At the time, it was the largest HIPAA settlement in history. In 2010, OCR and the FTC followed up by obtaining a $1 million HIPAA settlement with No. 3 chain Rite Aid Corp.
“We’re trying to do the best we can to follow the intent of Congress and HHS and OCR,” said the NACDS’ Kevin Nicholson, a pharmacist and vice president of government affairs and policy for the group. “The rule and the preamble are unclear what exactly is allowed. Considering the substantial penalties pharmacies might be subjected to, they’re very concerned about doing something that OCR might consider a violation.”
One possible workaround for all concerned is if the pharmacies simply ask their patients’ permission for the mailings.
“If someone signs an authorization saying ‘market away,’ you can market away until they rescind that authorization,” Williams said.
Asked whether CVS had considered seeking customer consent for its pharma-funded mailers, DeAngelis said: “We evaluate our various programs on a case-by-case basis and stand behind our decision regarding supplier-funded communications.”
Catherine Polley, a pharmacist and vice president of health and wellness at the Food Marketing Institute, said its members “like the opt-out format” in which customers’ records are used in the program by default, but customers can be removed if they ask.
With opt-in, patients must give permission before they can be marketed to, so “you’re not going to reach the most vulnerable folks,” Polley said. “I think the value of these programs far outweighs the value of doing it in opt-in.”