March 1, 2002
The Honorable Tommy G. Thompson
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201
Dear Secretary Thompson:
As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Committee on Vital and Health Statistics (NCVHS) monitors the implementation of the Final Rules that adopt the health data standards required by the Administrative Simplification provisions of HIPAA.
On January 24-25, 2002, the NCVHS Subcommittee on Privacy and Confidentiality held public hearings on the implementation of the final rule “Standards for Privacy of Individually Identifiable Health Information” that was published on December 28, 2000. The two topics addressed at the hearings were marketing and fundraising. The witnesses presented the perspectives of trade associations, medical associations, insurance commissioners, academic medical centers, non-profit hospitals, and consumers. In addition to their oral remarks, the witnesses submitted written comments to the subcommittee.
In an October 1, 2001 letter to you, NCVHS provided recommendations on the issues of consent and minimum necessary. In our letter of November 21, 2001, we provided recommendations on the issue of research. This letter follows up on the previous ones by providing our recommendations on the issues of marketing and fundraising.
NCVHS will continue to seek public comments on the implementation of HIPAA administrative simplification provisions. In light of the expected publication of the notice of proposed rulemaking (NPRM) on amendments to the privacy rule, we respectfully recommend that these NCVHS recommendations be considered in the rulemaking process.
Marketing
The diverging views expressed in the witness testimony indicated to the subcommittee the difficulty of balancing the competing interests. On the one hand, activities considered health care marketing include not only the sale of health-related products and services, but also patient education, health promotion, and disease management. On the other hand, patients have a legitimate privacy interest in preventing the disclosure of their protected health information to commercial entities, the redisclosure of the information to other commercial entities, and the intrusion associated with unwanted solicitations.
In the NPRM on the privacy rule, marketing was one of the topics for which a prior authorization was required. This approach was changed in the final rule to permit marketing activities pursuant to the one-time general consent for treatment, payment, and health care operations so long as the marketing was (1) face-to-face, (2) involved items of nominal value, or (3) complied with rules for health care marketing including disclosures and opt-out provisions.
There are two main options for regulating marketing. First, the NPRM position can be used, in which marketing without an individual authorization is presumed to be a violation of the privacy rule and then certain exceptions can be created (e.g. permitting pharmacists to notify customers that it is time to refill a prescription) to strike the proper balance. Second, the final rule position can be used, in which marketing without an individual authorization is presumed to be permitted under the privacy rule, and then restrictions are added (e.g. disclosures and opt-out provisions) to strike the proper balance. After carefully considering the issues, the NCVHS believes that the final rule should be amended to return to the approach of the NPRM. In our view, the current approach provides inadequate protection in several key areas, such as disclosure of health information about children, disclosure of sensitive medical conditions, redisclosure of information by marketers, and reliance on an opt-out system of questionable effectiveness that puts the burden on consumers. We believe that it will be easier to strike the appropriate balance by creating exceptions to a general prohibition on marketing without individual authorization than it will be to add restrictions to a general approval of marketing.
The Committee makes the following recommendations:
1. Except as provided in our additional recommendations, marketing should not be considered within treatment, payment, or health care operations.
2. The definition of marketing should be clarified such that refill reminders and other treatment-related reminders by pharmacists and other providers or their business associates are considered treatment and not marketing.
3. Disease management, when the purpose of which is not to sell products or services, should be considered part of treatment or health care operations, and not marketing.
4. Authorizations to permit health care marketing should be limited to products or services that are directly related to the health of the patient, and should clearly indicate that they are comprehensive and can include sensitive protected health information.
5. The disclosure of protected health information by covered entities to marketers should be conditioned on the marketers’ agreement (1) not to redisclose the information, and (2) to disclose, in the course of marketing, the financial arrangements of the parties.
6. Standardized, simplified procedures should be adopted to ease the burden on individuals who want to opt-out of future marketing contacts.
7. In marketing pursuant to an authorization, and in health care reminders and disease management, protected health information should not be disclosed via voice mail, an unattended FAX, or through other methods of communication that are not secure.
Fundraising
Although marketing and fundraising are often discussed together and they receive similar treatment under the final rule, there are fundamental differences. The fundraising activities of non-profit health care institutions are essential to our health care system. Without the billions of dollars of private contributions obtained each year through fundraising there would be serious adverse effects on medical research, indigent care, medical education, and other vital areas. Thus, although the privacy interests of patients in their protected health information must be taken seriously, in weighing the competing interests it is essential not to unnecessarily impede responsible fundraising activities.
The final rule provides that fundraising is within health care operations and therefore is subject to the one-time general consent. The main limitation placed on fundraising is that the only protected health information that may be disclosed to fundraisers is demographic information about the individual and dates of service. A point of contention expressed at the hearing was whether department of service information also should be made available for fundraising purposes without an authorization.
The NCVHS supports the general approach adopted in the final rule with regard to fundraising. We believe that fundraising should remain within health care operations. Nevertheless, there are some specific matters that we believe need to be addressed.
The Committee makes the following recommendations:
1. HHS should explore procedures for the disclosure of clinical department of service information for use in fundraising such as a simplified authorization or an opt-out procedure for departmental information. These measures should attempt to balance the interests of health care institutions to target fundraising with the privacy interests of patients who could consider departmental information to be sensitive health information.
2. In fundraising, protected health information should not be disclosed via voice mail, unattended FAX, or other methods of communications that are not secure.
3. Transitional rules for fundraising are needed to allow the continued use of protected health information obtained before the effective date of the privacy rule until first contact with the patient after the effective date of the privacy rule.
NCVHS is continuing to explore a range of issues in the implementation of the HIPAA privacy rule. We will provide you with additional recommendations in due course.
At its hearings on the privacy rule, the NCVHS sensed considerable anxiety based on the perceived complexity of the rule. With the imminent publication of the NPRM, the NCVHS would like to emphasize our belief that public education and outreach are essential in promoting compliance with the privacy rule and in allaying public concerns about the nature and effect of the rule. Therefore, we encourage HHS to redouble its efforts in this regard. Similarly, we encourage HHS to make the revised rule as understandable as possible to the general public.
We appreciate the opportunity to offer these comments and recommendations.
Sincerely,
/s/
John Lumpkin, M.D., M.P.H.
Chair, National Committee on Vital and Health Statistics
cc: HHS Data Council Co-Chairs