September 1, 2004
The Honorable Tommy G. Thompson
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201
Dear Secretary Thompson:
As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the National Committee on Vital and Health Statistics (NCVHS) monitors the implementation of the Administrative Simplification provisions of HIPAA, including the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule).
The NCVHS Subcommittee on Privacy and Confidentiality held hearings in Washington, DC, on July 14-15, 2004. The hearings, part of an ongoing series on HIPAA implementation, were intended to gather information about the effect of the Privacy Rule on three areas: marketing, fundraising, and the media. This letter conveys the Committee’s findings and concerns regarding marketing.
Marketing has been the subject of several prior hearings and letters to the Department. At our most recent hearing, we heard from two witnesses who previously testified before the Subcommittee, the general counsel of the National Association of Chain Drug Stores (NACDS), and a representative of the Georgetown University Health Privacy Institute. We asked both witnesses to address the implementation of the Privacy Rule’s marketing provisions.
The representative of the NACDS expressed general satisfaction with the marketing provisions of the Privacy Rule, and he noted that a best practices guide drafted by a consumer organization would be released shortly. The representative of the Health Privacy Institute testified that the marketing provisions of the Privacy Rule were insufficiently protective in the following respects: (1) retail pharmacies are not required to inform their customers when the pharmacies are paid by drug manufacturers to send letters and other communications (targeted by using the individual’s protected health information (PHI)) urging them to switch medications; (2) some product promotion materials, such as mailers promoting certain brands of anti-depressants, were mailed to individuals without any envelope, thereby disclosing information about the individual’s diagnosis; and (3) when a covered entity receives compensation from a third party to promote its products or services, this communication should be considered marketing (for which a prior authorization is required) rather than treatment or case management communications.
Although the NCVHS has previously addressed marketing in general and the specific issues discussed at the hearings on July 14-15, 2004, the most recent hearings did not include representatives of several key stakeholders. For example, we did not hear testimony from the pharmaceutical industry, pharmacy benefit managers, or health plans. Accordingly, the NCVHS believes it would be imprudent to make specific recommendations at this time. Nevertheless, we would like to highlight the following concerns raised at the hearing that relate closely to our prior recommendations.
First, the NCVHS is concerned that PHI is being used to target individuals for the sale of specific products and services without any disclosure of the commercial relationships of the covered entity and the commercial entity. We believe that the Department should explore whether to require the disclosure of the financial and other arrangements when covered entities and commercial entities collaborate to approach individuals with recommendations that they utilize specific health care products and services.
Second, the NCVHS is concerned that in the course of some commercial activities by covered entities and their business associates that target particular individuals through the use of their PHI, diagnostic or other information may be disclosed. We note that other provisions of the Privacy Rule require covered entities to adopt measures to prevent the incidental disclosure of PHI to other patients and members of the public in the treatment setting and when communicating PHI. We believe that the Department should explore whether to require that covered entities and their business associates take specific measures to prevent the incidental disclosure of PHI in communications promoting products and services.
Third, the NCVHS is concerned that covered entities have no requirement to afford individuals an opportunity to opt out of receiving communications regarding products and services. We note that designing such a requirement would be complicated by the need for covered entities to convey health information as part of their legal standard of care. We believe that the Department should explore whether it would be feasible and desirable to permit individuals to opt out of further communications regarding products and services.
The NCVHS would be pleased to schedule additional hearings on this issue and to take other steps that the Department believes would assist it in addressing this important matter. We appreciate the opportunity to offer these comments.
Sincerely,
/s/
John R. Lumpkin, M.D., M.P.H.
Chairman, National Committee on Vital and Health Statistics
Cc: HHS Data Council Co-Chairs