COVER STORY

FOR YOUR EYES ONLY

Federal patient privacy rules will change how providers handle protected information

Could April 14, 2003, be the new Y2K? That's the day sweeping new federal regulations protecting confidential health information will take effect. Y2K (Jan. 1, 2000, in case you've forgotten) was either an overblown media-driven doomsday scenario that didn't even make the lights flicker or a worldwide disaster averted thanks to years of toil by computer-savvy saviors—take your pick.

All we know now about April 14, 2003, is that on that date a pharmacist or technician will not be permitted to fill certain prescriptions until the patient signs a consent form. The requirement is one of a host of actions wrought by the Health Insurance Portability & Accountability Act (HIPAA), enacted six years ago but only now being detailed in regulation.

HIPAA represents a national standard designed to fill in the gaps in the current patchwork of state privacy and confidentiality laws. The preparation ban covers those prescriptions phoned in by a physician, transferred from another pharmacy, or brought in by someone other than the patient or a legal guardian.

Many pharmacy groups and other healthcare providers view the written consent as a prescription for turmoil. CVS Corp. official Carlos R. Ortiz, R.Ph., predicted there would be "chaos at our pharmacy counters," which are already buckling under the strain of pharmacist shortages and skyrocketing prescription volumes.

There are other concerns as well in the 1,500 pages of ever-dense "bureaucratese." The rules require "covered entities," such as pharmacies and hospitals, not to disclose more information than the "minimum amount necessary" for any purpose other than treatment.

What happens, say, when one insurance company requires pharmacies to submit five fields of information and another company just three fields? "The pharmacy is the one that gets dinged," said Brian Gallagher, the former director of pharmacy regulatory affairs for the National Association of Chain Drug Stores and now general counsel for the pharmacy software firm TechRx Inc.

"Pharmacies are given a Hobson's choice," said Gallagher. If they have to provide five fields to company A to get paid, he explained, but company B can get by with only three fields, hasn't the pharmacy exceeded the minimum necessary standard by sending five? "That's going to be a nightmare if it's not fixed," he told Drug Topics.

Another problem is the overlap between health-related communications and marketing. The privacy rule defines marketing as "a communication about a product or service a purpose of which is to encourage recipients of the communication to purchase or use the product or service." Something that fits the definition requires a specific patient authorization to use or disclose protected health information to create the marketing communication. But isn't "a purpose" of most healthcare transactions to get people to use a product or service?

HHS issues guidance

Trying to be helpful, the Department of Health & Human Services recently issued a guidance that listed some of the communications that are not marketing. It included reminder notices for prescription refills, recommendations for specific brand-name prescription or over-the-counter medicines (R.Ph.s don't even need the general patient consent to make OTC suggestions), and notices about changes in a formulary or pharmacy network.

Pharmacies may not provide patient lists to pharmaceutical companies for those firms' drug promotion programs without patient authorization. Even marketing activities that do not require authorization must give individuals the ability to opt out of further marketing communications, HHS said.

Three years ago, CVS and Giant Food Inc. ran into a hail of criticism from patients and lawmakers when it was disclosed that the pharmacy chains had used a third party to generate refill reminders and mail out some drug manufacturers' efforts to switch patients from one product to another. More recently, Eli Lilly inadvertently sent out an e-mail message with the addresses of more than 600 patients taking Prozac.

The guidance released by HHS last month was the first in a series designed to calm some fears and exaggerations expressed by the healthcare community and make the complex regulations a little clearer. It was not a complete success. "Although the guidance does clarify some points, it seems to have raised more questions than answers and will not eliminate the need for rewriting the rules," said NACDS. "So it's back to square one."

Smack in the middle of that square is the patient's written consent. It will authorize the provider to use or disclose personally identifiable medical information for three specific purposes: treatment, payment, or healthcare operations, which HHS abbreviates as TPO. A provider has to get the consent only once, although a patient can revoke it. It must be retained for six years and may be obtained and stored in electronic or paper format. Patients have new rights to access their records, to correct factual errors, and to know who else accessed them. There are additional requirements for researchers to access those records, too.

"The consent document may be brief and may be written in general terms," HHS advises. "It must be written in plain language; inform the individual that information may be used and disclosed for TPO; state the patient's rights to review the provider's privacy notice, to request restrictions, and to revoke consent; and be dated and signed by the individual (or his or her representative)."

The provider's privacy notice must describe each purpose for which the provider may use or disclose protected health information, including those made as part of TPO. It also must discuss when a provider can or must disclose information without authorization. There also are several other administrative requirements, including employee training, designation of a privacy officer, a contact person, standard policies and procedures, contracts with business associates that may need to use protected information, and documentation on use or disclosure outside of TPO.

Pharmacy groups appeal

That's too much for 10 national pharmacy organizations. They appealed with no avail to HHS secretary Tommy Thompson to drop the requirement for written prior-consent forms, arguing that it "represents a fundamental operational change in how patients interact with pharmacies and how pharmacies interact with patients."

Susan Winckler, group director of policy and advocacy for the American Pharmaceutical Association, said that, besides the new administrative burden for R.Ph.s, there was the distinct likelihood "consumers won't learn anything" from the form. "They'll just sign it and move on," she said. "Then, when they are presented with a different document, an authorization when you want to use the information for something other than treatment, payment, or healthcare operations, such as for marketing or something, they'll just sign that, too, because they have already been kind of numbed to the whole thing."

Signing the appeal to Thompson were APhA, NACDS, the Academy of Managed Care Pharmacy, the American Association of Colleges of Pharmacy, the American College of Clinical Pharmacy, the American Society of Consultant Pharmacists, ASHP, the Food Marketing Institute, the National Council of State Pharmacy Association Executives, and the Pharmaceutical Care Management Association.

Conspicuously absent was the National Community Pharmacists Association, which does not believe obtaining a one-time consent will be a particular problem for its members.

"When our people perceive that this is a way of protecting the information and relationship that flows amongst the pharmacist, the patient, and the doctor, then they see it in a little different light," said John Rector, a senior v.p. and general counsel for NCPA. "It will help reduce the intrusions by these pharmacy benefit managers and health plans. They will only have to give them what's minimally necessary to adjudicate the claims."

PBMs may not agree with that characterization, but they do acknowledge it won't be business as usual down the road. "The good news with HIPAA is that it will really force the industry to share with the patients why it was they were targeted—share with them how their information was used," said Dena Rus, v.p. of regulatory initiatives for AdvancePCS. "From a patient standpoint, I think that has largely been a mystery." Rus does not expect mail-order operations to be hampered by the initial consent requirement, since patients already have to sign a refill request form.

Kenneth R. Baker, v.p. and general counsel for the insurance firm Pharmacists Mutual Insurance Co., would like to see HHS spell out exactly what a consent form to release information should say, instead of having 25,000 independents and every chain writing their own. "That's the only safe harbor you're going to have," he said. "No release is going to be unchallenged unless it is written by the same people who wrote the regulations." But he expects HHS to make some changes and thinks it's definitely "too early to panic."

There are a lot of other things pharmacy would like to see HHS do. Short of dropping the written consent, which is considered highly unlikely, the problem of preparing a phoned-in prescription for a new patient must be addressed.

Thompson knows this and has promised to propose modifications. He also has affirmed that a friend or relative will be able to pick up a patient's Rx. The patient does not need to provide the names in advance. There will not have to be private consulting rooms—pharmacies can ask customers to stand back a few feet from a counter used for counseling, HHS suggested. Calling out that a patient's Rx is ready is apparently permissible, but HHS will propose regulatory changes to clarify the status of some oral communications and address other areas with additional guidances.

Marketing or treatment?

Whether disease state management, health promotions, preventive care, and wellness programs fall under the definition of marketing or treatment is unclear, and HHS' first guidance was not particularly helpful. "The activities currently undertaken under these rubrics are diverse," it noted. "Covered entities must examine the particular activities they undertake and compare these to the activities that are exempt from the definition of marketing."

"The privacy regulations have become the latest excuse for not doing something, not for pharmacists, but for our colleagues in the medical community," complained APhA's Winckler. "Some are saying they can't share information [with R.Ph.s] because of HIPAA. That's an incorrect interpretation."

Interpretations, incorrect or not, may be in the eye of the lawyers. There are civil and criminal penalties for misuse of personal health information, ranging from $100 for a simple violation up to $250,000 and 10 years in prison for selling, transferring, or using it for commercial advantage, personal gain, or malicious harm.

TechRx's Gallagher, who like Winckler and Baker is both a lawyer and a pharmacist, is not as concerned with a big government enforcement mechanism as he is with private attorneys. "You're going to have legal rights created," he predicted. "Even though [HHS] purports to claim this doesn't create a private right of action [to sue], a good plaintiff lawyer, given the right factual situation, will find a way to do that."

But, that's years away. For pharmacists pondering what to do now, the National Association of Boards of Pharmacy is planning a conference with state medical societies and state attorneys general in October. The goal is to identify where state laws and regulations complement HIPAA and where they conflict and to develop model regulations. NABP executive director Carmen Catizone, R.Ph., said there are a lot of implausible situations and worst-case scenarios floating around. "I think they are alarming a lot of people," he said. "What we want to do is to take an objective view of it, step back, and lay things out."

If pharmacy boards, medical societies, and attorneys general can agree on how they think HIPAA and state regulations should be interpreted, "that's a sizable block of opinion," Catizone continued. He's hoping to produce "a good road map, so people will know what areas are safe, what areas are still under construction, and what areas we're going to have to try to change. But, at least people will know where they are going."

Michael F. Conlan

HIPAA TIME LINE

Aug. 21, 1996—President George H. W. Bush signs the Health Insurance Portability & Accountability Act (HIPAA), originally written to ensure that health insurance coverage would continue when an individual changed jobs. The law includes a provision that recognizes the need for national patient record privacy standards and gives Congress three years to do the job.

Aug. 21, 1999—Congress misses its self-imposed deadline to pass comprehensive medical privacy legislation.

Nov. 3, 1999—As required by HIPAA, the Department of Health & Human Services issues a proposed privacy rule that will have the force of law. The proposal is 672 pages long.

Dec. 20, 2000—With a month left in office, President Clinton allows HHS to release a final rule, after receiving more than 52,000 written comments from interested parties. Unlike the earlier proposal, it contains a written, prior-consent requirement covering community pharmacies. The new version is some 1,500 pages long.

Feb. 23, 2001—HHS secretary Tommy Thompson reopens the final rule for additional comments.

April 14, 2001—President George W. Bush decides to let the rule take effect as scheduled. Thompson says HHS, which had received 24,000 additional comments, will provide written guidances to better explain the regulations. He also promises to propose modifications to the final rule to deal with "unintended consequences."

July 6, 2001—Thompson issues several guidance documents on the new federal privacy protections for medical records and other personal health information. They explain that family members can pick up prescriptions, but Rxs can't be filled until a patient signs a one-time consent. More clarifications and proposed amendments are still expected.

April 14, 2003—Full compliance deadline.

 

Mike Conlan. FOR YOUR EYES ONLY. Drug Topics 2001;16:26.