HIPAA Changes in the HITECH Act of 2009: Conditions of Certain Contacts as Part of Health Care Operations

House bill Sec. 4406
Senate bill Sec.
13406
Conference agreement Sec. 13406

Current Law

Generally, covered entities may use and disclose health
information for the purpose of treatment, payment, and other
health care operations without the individual's authorization
and with few restrictions. Health care operations are broadly
defined to include quality assessment and improvement
activities, case management and care coordination, evaluation
of health care professionals, underwriting, legal services,
business planning, customer services, grievance resolution,
and fundraising.

Under the Privacy Rule promulgated pursuant to HIPAA, a
covered entity may not disclose health information to a third
party (e.g., pharmaceutical company), in exchange for direct
or indirect remuneration, for the marketing activities of the
third party without first obtaining a patient's
authorization. Similarly, a covered entity may not use or
disclose health information for its own marketing activities
without authorization. Marketing is defined as a
communication about a product or service that encourages the
recipient to purchase or use the product or service. However,
communications made by a covered entity (or its business
associate) to encourage a patient to purchase or use a health
care-related product or service are excluded from this
definition and, therefore, do not require the patient's
authorization, even if the covered entity is paid by a third
party to engage in such activities.

House Bill

The House bill would clarify that a marketing communication
by a covered entity or business associate about a product or
service that encourages the recipient to purchase or use the
product or service may not be considered a health care
operation, unless the communication relates to a health care-
related product or service. Further, it would prohibit a
covered entity or business associate from receiving direct or
indirect payment for marketing a health care-related product
or service without first obtaining the recipient's
authorization. Business associates would be permitted to
receive payment from a covered entity for making any such
communication on behalf of the covered entity that is
consistent with the contract. Fundraising using a patient's
protected health information would not be permitted without a
patient's authorization.

Senate Bill

Like the House bill, the Senate bill would clarify that a
marketing communication by a covered entity or business
associate about a product or service that encourages the
recipient to purchase or use the product or service may not
be considered a health care operation, unless the
communication relates to a health care-related product or
service. Further, the Senate bill states that a communication
about a health care-related product or service would be
permitted as a healthcare operation including where the
covered entity receives payment for making the communications
where (1) the communication only describes a health care item
or service previously prescribed for or administered to the
recipient, or (2) the covered entity or business associate
obtains authorization. Finally, the Senate bill does not
include the House provision on fundraising.

Conference Agreement

The conference agreement retains the general rules about
marketing in both the House and Senate bills. The conference
report makes an exception and allows providers to be paid
reasonable fees as determined by the Secretary to make a
communication to their patients about a drug or biologic that
the patient is currently prescribed. The conference agreement
continues to permit fundraising activities by the provider
using a patient's protected health information so long as any
written fundraising provide an opportunity to opt out of
future fundraising communications. If the recipient chooses
to opt out of future fundraising communications, that choice
is treated as a revocation of authorization under 45 CFR
164.508. All the protections that apply under 45 CFR 164.508
to an individual who has revoked an authorization would thus
apply to a recipient of communications who chooses to opt out
of receiving future fundraising communications, including the
right not to be denied treatment as a result of making that
choice.