Privacy Regs Won't Prevent PBMs From Contacting Patients, Lawyer Suggests

HHS' privacy regulations will allow PBMs to promote therapeutic switches to patients without prior patient authorization, provided the companies disclose to the patients how they were targeted, attorney David Bloch suggested during a marketing conference.

The rule, issued under the 1996 Health Insurance Portability & Accountability Act, will allow pharmacy benefit management firms to contact patients to suggest other therapeutic options as long as several required disclosures are made, including "how [patients] were chosen and why," Bloch, an associate at the Washington, D.C. law firm Reed Smith, told a Center for Business Intelligence conference Jan. 29.

The privacy regulations require healthcare providers, health plans and health clearinghouses (collectively termed "covered entities") to obtain patient authorization prior to using or disclosing health information, except under certain circumstances. The final regs were published in the Federal Register Dec. 28 but have not yet been implemented (¹ (Also see "Privacy Regs Allow Companies Access To Patient Records For AE Reporting" - Pink Sheet, 1 Jan, 2001.)).

The final rule provides three situations in which covered entities will be exempt from obtaining patient authorization before using or disclosing private health information for marketing purposes.

Under the broadest of the three exceptions, the rule will not require covered entities to obtain authorization to use protected health information for marketing purposes as long as the covered entity first makes an advanced determination that the marketed product and services are beneficial to the patient.

In addition, the marketing communications must 1) identify the covered entity as the party making the communication; 2) prominently disclose whether payment is received for undertaking the marketing; 3) instruct patients on how to opt-out from receiving further communications; 4) explain how the patients were targeted and how the product relates to their health.

"For an example of how this might work, I can think of a couple offhand," Bloch said. "PBMs [are] always very interested in getting people further information about...drugs they want you to use because of cost effectiveness."

Under the privacy regs, PBMs "could send out a communication like this," Bloch suggested: "'We know...that you are taking this drug....We thought you might be interested in knowing about this other treatment...that could help improve your health.'"

In order to disclose financial arrangements, the patient should be told, "'We receive no remuneration for doing this,' or, 'We're doing this in conjunction with this drug company; we've provided funding to help sponsor some of these mailings."

Bloch added that patients should be told, "'if you don't want to receive these mailings, please let us know.'"

Though not covered entities in themselves, PBMs will be covered under the privacy regulations when they enter into contracts with covered entities, and will then be classified as a "business associate."

Pharmacies can also benefit from this provision, Bloch said. "Pharmacies have very valuable listed prescription history. Everyone could potentially benefit from pharmacies informing their customers about their prescription history and what other information they should keep in mind, what other drug they might want to consider."

Another marketing exception to the authorization requirement is for face-to-face communication. The final rule allows for unlimited discussion on any service or product during face-to-face contact. A sample product or other information may also be given in this setting, the regs add.

Bloch suggested that a telephone conversation might constitute a face-to-face communication. "We can argue about whether a phone call covers this or not; it probably does. No authorization is required that you tell the person on the phone what is going on."

Covered entities may also send newsletters and other communications to patients and may provide nominally-priced items and services promoting the covered entity. This provision ensures that covered entities do not violate regulations when they distribute calendars and pens for general promotion, the final rule states.

Certain communications are also excluded from the definition of marketing. Communications by a provider to a patient to extend treatment, or by a provider or health plan to a patient in the course of managing treatment, or to recommend alternative treatments, are not defined as marketing.

Therefore, a provider or plan may market alternative therapies to patients without authorization and without informing them of their patient-targeting process, Bloch said.

"A pharmacy or PBM...might be very interested in following benefit customers...to say, 'we also dispense these products, have you considered X?'" Bloch suggested. "They can do that without having to disclose why they came up with you and how."

He added however that since the communication would be considered part of treatment, payment and operations under this scenario, it would become necessary to get patient consent.

"In other words, the consent document...at the beginning of the relationship would describe in it...a statement saying 'we may from time to time contact you about information that we think might be valuable to further your treatment such as alternative therapies or settings you might consider.'"

Bloch emphasized the importance of patient-friendly disclosures that explain when and why protected health information may be used.

"I think it will be very important not to just comply with the regs...but also to do it in a way that is user-friendly, customer friendly. You may comply very well with the regs and still scare the daylights out of your customers, out of your patients, and end up working at cross-purposes to yourselves."

Bloch recommended including a cover letter disclosing the required information in user-friendly language. "I would think, with some cases, even if consent has been given, to include a cover letter.... If this can be done in a...user-friendly language, we are hoping it might put people at ease."

"I think the real concern over healthcare privacy is the thought that someone without our knowing it is using our healthcare information and telling people about purposes that are not...in our best interest," Bloch said. "Again, disclosures can take away a lot of that concern. Authorization is the most important thing. But even once you've gotten that, let people know what you're doing and why."