The Privacy Rule gives individuals important controls over whether and how their health information is used and disclosed for marketing purposes. With some exceptions, the Rule essentially requires an individual’s written authorization before his or her protected health information (“PHI”) can be used or disclosed for marketing purposes. To the Department of Health and Human Services (“DHHS”), the term marketing means a communication to an individual about a product or service that encourages the individual to purchase or use that product or service. Not surprisingly, the lines between a marketing communication and a communication for a treatment or health care purpose unavoidably overlap when it is necessary to encourage or advise people about necessary treatment and health care services and benefits that they may enjoy from the purchase or use of certain health-related products or services.

The Privacy Rule includes exceptions to what is considered marketing to ensure that important health care communications are not impeded, particularly the so-called “refill reminder exception.” Under the refill reminder exception, the Rule expressly excludes from the definition of “marketing” refill reminders or other communications about a drug or biologic that is currently being prescribed for the individual, provided that financial remuneration received by the covered entity in exchange for making the communication, if any, is reasonably related to the covered entity’s cost of making the communication. 45 C.F.R. § 164.501(2)(i). As they say, “The devil is in the details.”

As a result, determining whether a communication falls within the refill reminder exception to marketing has two criteria, and the second criterion has a subpart. The first criterion is whether the communication is about a currently prescribed drug or biologic. The second criterion is whether the communication involves financial remuneration and, if it does, whether the financial remuneration is reasonably related to the covered entity’s cost of making the communication.

On September 19, 2013, DHHS published a series of FAQs in an effort to help clarify what qualifies as a proper communication for the purposes described above. The following are examples of what is not an acceptable and exempt communication:

• Communications about specific new formulations of a currently prescribed medicine.
• Communications about specific adjunctive drugs related to the currently prescribed medicine.
• Communications encouraging an individual to switch from a prescribed medicine to an alternative medicine.

Regarding the remuneration question, DHHS considers the following communications acceptable and all other communications involving other remuneration as unacceptable:

• Communication does not involve remuneration.
• Communication involves only non-financial or in-kind remuneration, such as supplies, computers, or other materials.
• Communication involves only payment from a party other than the third party (or other than on behalf of the third party) whose product or service is being described in the communication, such as payment from a health plan.
• Remuneration involves payments to the covered entity by a pharmaceutical manufacturer or other third party whose product is being described that cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials, and supplies, as well as capital and overhead costs.
• Remuneration involves payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.

DHHS gives the following examples of permitted communications:

• A pharmacy administers a medication adherence program that involves mailing refill reminders and adherence communications to patients about their currently prescribed drugs even though the pharmacy receives financial remuneration from the pharmaceutical manufacturers, provided that the financial remuneration covers only the pharmacy’s reasonable direct and indirect costs associated with the program.
• A pharmacy mails its diabetic patients information concerning the diabetic pumps used to administer their insulin even though the pharmacy is paid by the manufacturer of the pumps, provided that the payment covers only the reasonable direct and indirect costs associated with the communications.
• A pharmacy hires a business associate to assist in administering a medication adherence program that involves mailing adherence communications to patients about their currently prescribed drugs, even though the business associate is paid by the pharmaceutical manufacturers, provided that the payment does not exceed the fair market value of the business associate’s services.

Communications about drugs or biologics not falling within the refill reminder exception for one or more reasons described above are still permitted under the Privacy Rule under the following circumstances:

• The communications are made face-to-face at the pharmacy or other setting. Face-to-face communications do not include communications by telephone or sent by mail or email.
• Written authorization has been obtained from the individual to make the communications.
• The communications fall within another exception to the definition of marketing and do not involve financial remuneration.