Last week, the U.S. Department of Health and Human Services (“HHS”) released guidance that helps to clarify four parts of the Final HIPAA Omnibus Rule (the “Omnibus Rule”) – many provisions of which become effective today. Specifically, HHS released clarification regarding how the Omnibus Rule governs the following topics: 1) disclosures of Protected Health Information (“PHI”) regarding student immunizations to schools; 2) protection of deceased individuals’ PHI; 3) amendments to laboratories’ Notices of Privacy Practices; and 4) refill reminders and other communications regarding drugs and biologics.
1. The Omnibus Rule relaxes the restrictions regarding Covered Entities’ disclosures of proof of immunizations to schools. In its newly released guidance, HHS confirms that Covered Entities may disclose proof of immunization of students directly to schools that are required by law to have such information prior to admitting a student, with the oral or written agreement of a parent or guardian. Such agreement need not contain all required elements of a traditional HIPAA authorization. The Covered Entity must document such agreement, but it may do so in a nature or format appropriate given the circumstances. For example, HHS explains that the Covered Entity may retain a copy of a parent’s written request to disclose proof of immunization, and documentation of a phone conversation in which a parent requests such disclosure would also suffice.
2. The Omnibus Rule imposes a 50 year limit on the length of time that individuals’ PHI must be protected following death. In other words, the HIPAA Privacy Rule applies to PHI of a decedent for 50 years after the individual passes away. (Note that state law, not HIPAA, dictates the length of time that entities must retain medical records.) HHS has further explained that during those 50 years, the Privacy Rule protects the decedent’s PHI to the same extent as the PHI of living individuals; however, certain special disclosures are permitted: to alert law enforcement of a death when there is suspicion of criminal conduct; to coroners or medical examiners and funeral directors; for research solely on the PHI of decedents; and to organ procurement or other similar organizations. Additionally, a decedent’s PHI may be disclosed to family members or others involved in the individual’s care prior to his or her death, unless such disclosure is inconsistent with the decedent’s prior expressed preferences known to the entity.
3. The Omnibus Rule requires Covered Entities to amend their Notices of Privacy Practices (“Notices”) in various ways. This requirement was a source of concern for many laboratories, because the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”) is expected to be amended in the coming months with regard to individuals’ rights to receive their test reports directly from CLIA and CLIA-exempt labs. In order to save labs from potentially having to amend their Notices twice in the span of several months, HHS has announced a delay in its enforcement of the requirement that certain labs amend their Notices to comply with the Omnibus Rule until further notice. This delay does not apply to labs that operate as part of a larger legal entity, such as a hospital, and thus do not have their own lab-specific Notices. HHS will issue a notice at least 30 days in advance of when the enforcement delay is lifted, and they will also publish such information on the website of the HHS Office for Civil Rights (“OCR”).
4. Finally, the Omnibus Rule imposes more stringent limitations on the use of PHI for marketing purposes. Entities recently expressed concern and challenged HHS with regard to the application of these limitations to prescription refill reminders and communications regarding prescription drugs. In response, HHS has stated that “refill reminders or other communications about a drug or biologic that is currently being prescribed for the individual” are excluded from the definition of marketing, provided that financial remuneration received by the Covered Entity in exchange for making the communication, if any, is reasonably related to the Covered Entity’s cost of making the communication. A determination of whether HIPAA permits communications regarding prescriptions requires a two-part analysis: 1) whether the communication is about a currently prescribed drug or biologic; and 2) whether the financial remuneration paid, if any, is reasonably related to the cost of making the communication. Of note, the newly released guidance specifically states that refill reminders for which pharmaceutical manufacturers cover reasonable costs including labor, materials, supplies, and overhead costs are permitted. It also states that Covered Entities may hire Business Associates to assist with mailing adherence communications about currently prescribed drugs so long as payment does not exceed the fair market value of the Business Associate’s services. HHS included in its guidance a full list of FAQs regarding refill reminders and related communications.