Guidance: The HIPAA Privacy Rule and Refill Reminders and Other Communications about a Drug or Biologic Currently Being Prescribed for the Individual
This page provides guidance on The HIPAA Privacy Rule and Refill Reminders and Other Communications about a Drug or Biologic Currently Being Prescribed for the Individual under HIPAA.
Final
Issued by: Office for Civil Rights (OCR)
The HIPAA Privacy Rule and Refill Reminders and Other Communications about a Drug or Biologic Currently Being Prescribed for the Individual
Background
The Privacy Rule gives individuals important controls over whether and how their protected health information is used and disclosed for marketing purposes. With limited exceptions, the Rule requires an individual’s written authorization before his or her protected health information can be used or disclosed to make a marketing communication to the individual. In general, marketing means to make a communication to an individual about a product or service that encourages the individual to purchase or use that product or service. Often, the lines between a marketing communication and a communication for a treatment or health care purpose unavoidably overlap, as a necessary part of providing treatment and health care services and benefits is to encourage or advise individuals to purchase or use certain health-related products or services. For this reason, the Privacy Rule includes important exceptions to what is considered marketing to ensure essential healthcare communications are not impeded. One important exception concerns communications about refill reminders and other communications about a drug or biologic currently being prescribed to the individual (“refill reminder exception”).
How the Refill Reminder Exception Works
The Privacy Rule expressly excludes from the definition of “marketing” refill reminders or other communications about a drug or biologic that is currently being prescribed for the individual, provided that financial remuneration received by the covered entity in exchange for making the communication, if any, is reasonably related to the covered entity’s cost of making the communication. See paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. Financial remuneration means payment to a covered entity (or business associate, if applicable) from or on behalf of a third party whose product or service is being described. Financial remuneration does not include non-financial or in-kind benefits.
Thus, there are two components to determining whether a communication falls within the refill reminder exception to marketing. The first is whether the communication is about a currently prescribed drug or biologic. The second is whether the communication involves financial remuneration and if it does, whether the financial remuneration is reasonably related to the covered entity’s cost of making the communication. Below is guidance on each of these aspects of the exception.
1. Is the Communication about a Currently Prescribed Drug or Biologic?
WITHIN EXCEPTION
- Refill reminders.
- Communications about generic equivalents of a drug being prescribed.
- Communications about a recently lapsed prescription (one that has lapsed within the last 90 calendar days).
- Adherence communications encouraging individuals to take prescribed medicines as directed.
- Where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system.
NOT WITHIN EXCEPTION
- Communications about specific new formulations of a currently prescribed medicine.
- Communications about specific adjunctive drugs related to the currently prescribed medicine.
- Communications encouraging an individual to switch from a prescribed medicine to an alternative medicine.
2. Does the Communication Involve Financial Remuneration, and If So, Is It Reasonable?
WITHIN EXCEPTION
- Communication does not involve remuneration.
- Communication involves only non-financial or in-kind remuneration, such as supplies, computers, or other materials.
- Communication involves only payment from a party other than the third party (or other than on behalf of the third party) whose product or service is being described in the communication, such as payment from a health plan.
- Remuneration involves payments to the covered entity by a pharmaceutical manufacturer or other third party whose product is being described that cover the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials, and supplies, as well as capital and overhead costs.
- Remuneration involves payments to a business associate assisting a covered entity in carrying out a refill reminder or medication adherence program, or to make other excepted communications, up to the fair market value of the business associate’s services. The payments may be made by a third party whose product is being described directly to the business associate or through the covered entity to the business associate.
NOT WITHIN EXCEPTION
- Communication involves financial remuneration other than as described above.
Examples of Permitted Communications
- A pharmacy administers a medication adherence program that involves mailing refill reminders and adherence communications to patients about their currently prescribed drugs even though the pharmacy receives financial remuneration from the pharmaceutical manufacturers, provided the financial remuneration covers only the pharmacy’s reasonable direct and indirect costs associated with the program.
- A pharmacy mails its diabetic patients information concerning the diabetic pumps used to administer their insulin even though the pharmacy is paid by the manufacturer of the pumps, provided the payment covers only the reasonable direct and indirect costs associated with the communications.
- A pharmacy hires a business associate to assist in administering a medication adherence program that involves mailing adherence communications to patients about their currently prescribed drugs, even though the business associate is paid by the pharmaceutical manufacturers, provided the payment does not exceed the fair market value of the business associate’s services.
Communications Not Falling Within the Refill Reminder Exception
Communications about drugs or biologics not falling within the refill reminder exception for one or more reasons described above are still permitted under the Privacy Rule if:
- The communications are made face-to-face at the pharmacy or other setting. Face-to-face communications do not include communications by telephone or sent by mail or e-mail.
- Written authorization has been obtained from the individual to make the communications.
- The communications fall within another exception to the definition of marketing and do not involve financial remuneration.
FAQs
Q: What types of communications fall within the “refill reminder” exception to marketing?
The refill reminder exception to the definition of “marketing” encompasses refill reminders and other communications about a drug or biologic that is currently being prescribed for the individual. See paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. In addition to refill reminders about currently prescribed drugs, the exception encompasses communications about generic equivalents of a drug being prescribed, adherence communications encouraging individuals to take prescribed medicines as directed, and communications about prescriptions that have lapsed within the last 90 calendar days. Also, where an individual is prescribed a self-administered drug, communications regarding all aspects of a drug delivery system fall within the refill reminder exception. Thus, these types of communications are permitted without an individual’s authorization, provided any financial remuneration received from the pharmaceutical manufacturer in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication.
Q: Do communications about recently-lapsed prescriptions for a medicine fall within the “refill reminder” exception to marketing?
Yes, so long the prescription lapsed within the last 90 calendar days and any financial remuneration received in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication. Communications encouraging individuals to renew recently lapsed prescriptions are consistent with the purpose of refill reminder and medication adherence communications, which is to encourage individuals to continue to take their medication as directed. However, once a prescription has lapsed for more than 90 calendar days, it is no longer reasonable to treat such communications as refill reminders or medication adherence communications for a currently prescribed drug or biologic.
Q: Do communications about drug delivery systems fall within the “refill reminder” exception to marketing?
Yes. Where an individual is prescribed a self-administered drug or biologic, such as insulin, communications regarding all aspects of a drug delivery system, such as an insulin pump, fall within the refill reminder exception at paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501, provided any financial remuneration received in exchange for making the communication is reasonably related to the covered entity’s cost of making the communication.
Q: Do communications about specific adjunctive drugs related to the currently prescribed drug fall within the “refill reminder” exception to marketing?
No, only communications about drugs or biologics currently prescribed to the individual fall within the refill reminder exception at paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. An adjunctive drug that may be used in conjunction with a currently prescribed drug to help treat a patient’s underlying condition or address one or more side effects of a currently prescribed drug does not fall within this category. However, covered entities may communicate in a general manner to individuals regarding the availability of adjunctive drugs related to the drug that is currently being prescribed to the individual without triggering the marketing requirements. For example, a pharmacy could send a communication to an individual alerting the individual to possible side effects from her currently prescribed medication, and suggesting the individual go ask her doctor about a medication to treat the side effects if she experiences them, without naming a particular medication. Alternatively, communications about adjunctive drugs may fall within the treatment exception to marketing at paragraph (2)(ii)(A) of the definition, provided the covered entity does not receive financial remuneration in exchange for making the communication. In addition, such communications may be made in a face-to-face encounter with the individual, without authorization, even if financial remuneration is received in exchange for making the communication.
Q: Do communications about new formulations of a currently prescribed medicine fall within the “refill reminder” exception to marketing?
No, only communications about drugs or biologics currently prescribed to the individual fall within the refill reminder exception at paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. However, covered entities may communicate in a general manner to individuals regarding the availability of a drug with, for example, a different dosing schedule or form, without triggering the marketing requirements. For example, a pharmacy could send an adherence communication to an individual that also informs the individual about the availability of a product with a more convenient dosing schedule or in a liquid instead of pill format, without naming the particular medication. Alternatively, communications about specific new formulations of a drug may fall within the treatment exception to marketing at paragraph (2)(ii)(A) of the definition, provided the covered entity does not receive financial remuneration in exchange for making the communication. In addition, such communications may be made in a face-to-face encounter with the individual, without authorization, even if financial remuneration is received in exchange for making the communication.
Q: Do communications encouraging individuals to switch from a prescribed medicine to an alternative therapy fall within the “refill reminder” exception to marketing?
No, only communications about drugs or biologics currently prescribed to the individual fall within the refill reminder exception at paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. Making a communication to an individual encouraging the individual to switch from a prescribed medicine to an alternative therapy would only be appropriate where such communication falls within the treatment exception to marketing at paragraph (2)(ii)(A) of the definition and the covered entity does not receive financial remuneration in exchange for making the communication; where the communication is made in a face-to-face encounter with the individual; or where the individual has authorized the use or disclosure of her protected health information to make such communications.
Q: Can a doctor or pharmacy be paid by a pharmaceutical manufacturer to make a prescription refill reminder without an individual’s prior authorization under the HIPAA Privacy Rule?
Yes, provided that any payments from the pharmaceutical manufacturer are reasonably related and limited to the covered entity’s cost of making the communication.
- For payments to the doctor or pharmacy, this means payments may cover only the reasonable direct and indirect costs related to the refill reminder or medication adherence program (or other excepted communications), including labor, materials, and supplies, as well as capital and overhead costs.
- For payments to a business associate that contracts with a doctor or pharmacy to assist in carrying out the refill reminder or medication adherence program (or to make other excepted communications), this means payments (either directly from the pharmaceutical manufacturer or through the covered entity) may be only up to the fair market value of the business associate’s services.
Q: What is permitted remuneration for purposes of the “refill reminder” exception to marketing?
The Privacy Rule excepts from the definition of “marketing” refill reminders and other communications about a drug or biologic that is currently being prescribed for the individual, provided that financial remuneration received by the covered entity in exchange for making the communication, if any, is reasonably related to the covered entity’s cost of making the communication. See paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. Financial remuneration means payment to a covered entity (or business associate, if applicable) from or on behalf of a third party whose product or service is being described. Thus, for these purposes, permitted remuneration in exchange for making a “refill reminder” communication is:
- Non-financial or in-kind remuneration, such as supplies, computers, or other materials.
- Payment from a party other than the third party (or other than on behalf of the third party) whose product or service is being described in the communication, such as payment from a health plan.
- Payments to a covered entity by a pharmaceutical manufacturer or other third party whose product is being described in the communication that cover only the reasonable direct and indirect costs related to the refill reminder or medication adherence program, or other excepted communications, including labor, materials, and supplies, as well as capital and overhead costs.
- Where a covered entity enlists the services of a business associate to assist in carrying out a refill reminder or medication adherence program, or to make other excepted communications, the business associate may be paid by the third party (either directly or through the covered entity) only up to the fair market value of its services.
Q: May a covered entity pay a business associate to assist in making a refill reminder or other communication that falls within the “refill reminder” exception to marketing?
Yes. The Privacy Rule permits a covered entity to engage and pay a business associate to assist in making otherwise permitted communications to individuals and does not prescribe what the covered entity itself may pay the business associate for such services. However, where financial remuneration is received from the pharmaceutical manufacturer or other third party whose product is being described to make such communications, there are limits on what the business associate may be paid from that financial remuneration. In particular, a business associate only may receive, whether directly from the third party or through the covered entity from the financial remuneration the covered entity receives from the third party, payments not to exceed the fair market value of its services.
Q: May a business associate be paid by a pharmaceutical manufacturer to assist a covered entity in making a refill reminder or other communication describing the manufacturer’s product that falls within the “refill reminder” exception to marketing?
Yes, provided any payments to the business associate do not exceed the fair market value of its services. See paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. The payments may be made by a pharmaceutical manufacturer through a covered entity to the business associate, or directly to the business associate, that is acting on behalf of the covered entity to assist in making the refill reminder or other communication describing the manufacturer’s product.
Q: May a covered entity contract with a business associate to assist in administering a refill reminder or medication adherence program paid for by a pharmaceutical manufacturer?
Yes. However, in order for the refill reminders or other program communications to fall within the “refill reminder” exception to marketing, any financial remuneration received by the business associate from the pharmaceutical manufacturer (either directly or through the covered entity) must not exceed the fair market value of the business associate’s services. See paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501. Such limitations do not apply to what the covered entity itself may pay the business associate for such services when no financial remuneration is received from the pharmaceutical manufacturer or other third party whose product or service is being described.
Q: We operate specialty pharmacy programs that make pharmaceutical manufacturer-funded communications to patients concerning their prescribed drugs for chronic and complex diseases that require complicated therapies. Rather than ensure such communications meet the conditions of the “refill reminder” exception at paragraph (2)(i) of the definition of “marketing” at 45 CFR 164.501 of the Privacy Rule, we have decided to obtain authorizations going forward for such communications from new patients as they enroll in the programs. For existing patients, must we either obtain authorizations by the September 23, 2013, compliance date of the new provisions or terminate these sponsored communications with these patients?
No. With respect to obtaining authorizations from patients already enrolled in these programs, OCR will not determine that a covered entity is in violation of the marketing provisions if it has not obtained authorizations from all existing patients to whom it is making such communications by the September 23, 2013, compliance date, provided the patients from whom authorizations have not been obtained have not opted out or declined to receive such communications and the patients’ authorizations are obtained at the next time their prescriptions are renewed, but no later than September 23, 2014.
Q: If a covered entity is going to obtain authorizations from patients to make pharmaceutical manufacturer-funded communications to the patients about currently prescribed drugs or biologics, is the covered entity required to obtain a new authorization each time a prescription is renewed?
No. A HIPAA authorization remains valid until it expires or is revoked by the individual. While a HIPAA authorization must contain an expiration date or event that relates to the individual or the purpose of the use or disclosure, the Privacy Rule does not otherwise prescribe the expiration date or event that must apply to the authorization, which may vary based on the circumstances. For example, in the case of communications to individuals concerning currently prescribed drugs, a HIPAA authorization could expire at the time, or within a specified period of time after, a prescription expires or is no longer valid; or at the time a patient opts out of receiving such communications from the covered entity or opts out of participating in the prescription drug adherence or education program. Further, the scope of the authorization need not be limited to communications related to a single drug or biologic or the drugs or biologics of only one pharmaceutical manufacturer. The authorization must adequately describe the intended purposes of the requested uses and disclosures and otherwise contain the elements and statements of a valid authorization under 45 CFR 164.508. For these purposes, this includes stating in the authorization that the covered entity is receiving financial remuneration from one or more pharmaceutical manufacturers to make the communications, and that the individual may revoke the authorization in writing at any time he or she wishes to stop receiving the communications.
Q: Are communications about government programs or government-sponsored programs “marketing” under the HIPAA Privacy Rule?
No. Communications about government and government-sponsored programs do not fall within the definition of “marketing,” as there is no commercial component to communications about benefits available through public programs. Therefore, a covered entity is permitted to use and disclose protected health information to communicate with individuals about eligibility for such programs as Medicare, Medicaid, or the State Children’s Health Insurance Program (SCHIP). Similarly, government-mandated communications are not considered marketing under the Privacy Rule as such communications also are not commercial in nature.
Q: Are pharmaceutical manufacturer-funded communications to patients concerning a prescribed drug considered marketing under the Privacy Rule if they are required by a Risk Evaluation and Mitigation Strategy (REMS)?
No. If the Food and Drug Administration (FDA) determines that a particular drug can only be approved with additional measures, beyond labeling, to mitigate a serious risk posed by the drug, and one or more of those measures take the form of patient communications about the drug, then such communications are not marketing, even if the communication is funded by the drug manufacturer. Government-mandated communications to individuals are not considered marketing under the Privacy Rule, even if such communications are paid for by a third party whose product or service is being described. As with communications to individuals concerning government and government-sponsored programs, government-mandated communications to individuals are not commercial in nature. Thus, a covered entity may use or disclose an individual’s protected health information without the individual’s authorization to send the individual educational or other information concerning a prescribed drug that is required by a REMS, even if the communication is funded by the drug manufacturer.
Q: Must a pharmacy obtain an individual’s written authorization prior to discussing with the individual an alternative medication to the one prescribed to the individual in a face-to-face encounter?
No. Face-to-face communications with an individual about specific products or services do not require individual authorization, even if such communications are subsidized by the third party whose product or service is being described. See 45 CFR 164.508(a)(3)(i)(A). Thus, a pharmacy or other covered entity may discuss with, or hand printed information to, an individual about particular medicines in a face-to-face encounter, without triggering the individual authorization requirements of the HIPAA Privacy Rule. However, face-to-face communications do not include communications over the telephone or by e-mail or mail.
Significant Aspects of the Privacy Rule
- Introduction
- General Overview
- Incidental Uses and Disclosures
- Minimum Necessary
- Personal Representatives
- Business Associates
- Uses and Disclosures for Treatment, Payment, and Health Care Operations
- Marketing
- Public Health
- Research
- Workers' Compensation Laws
- Notice
- Government Access
- Decedents
- Student Immunization
- Marketing: Refill Reminders
Frequently Asked Questions for Professionals - Please see the HIPAA FAQs for additional guidance on health information privacy topics.
HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.