APA Wants Privacy Rule To Restrict Product Marketing

Picture being diagnosed with asthma. A few days later, the phone calls and letters start coming from companies trying to sell you asthma-related products and services.

Your only recourse is to ask the companies to remove your name from their lists and hope they do.

“It is much harder to turn off the flood of marketing information than to never release it in the first place,” said Jeffrey Janofsky, M.D., who testified for APA before the National Committee on Vital and Health Statistics Subcommittee on Privacy and Confidentiality in January. APA President Richard Harding, M.D., is a subcommittee member, and Janofsky is a member of APA’s Commission on Judicial Action.

Janofsky described the asthma-marketing scenario based on a relative’s experience. He hoped the committee would understand the impact on individuals of the federal rule’s marketing and fundraising exceptions.

APA is “disappointed that the privacy regulation permits only an ex post facto withdrawal of authorization after the marketing and fundraising damage has occurred,” said Janofsky. He said that APA thinks harm to patients can be avoided if the rule is changed to require an “opt-in” process before any such information can be released.

A provision that required patient authorization for all marketing and fundraising activities was revised in the final rule issued last April (Psychiatric News, March 2, 2001). Although patient authorization is still required for activities such as insurance underwriting and employment decisions, a new marketing definition and several exceptions were added.

For example, “covered entities,” which the rule defines as health care providers, health care database companies, and health care plans, can freely discuss their services and products with patients without written authorization under certain conditions. The conditions are that if the communication occurs face to face, the services must be of nominal value; if the communication is in writing, the covered entity cannot receive any remuneration, whether direct or indirect, from a third party that could benefit from such patient communication.

Health care professionals, plans, and database companies can also release protected health information to business associates for marketing purposes, according to the rule. Marketing efforts must meet three criteria to be in compliance with the privacy rule. They must

• tell the patient which health care entity provided the information,

• say whether the health care entity has or will receive payment from the marketer, and

• tell the patient being targeted that he or she can opt out of future communications from this and other marketers.

When marketing is based on the individual’s health status or condition, the marketer must explain why the individual is receiving the communication and how the product or service relates to the individual’s health, according to the rule.

APA is also concerned about the final rule’s fundraising exceptions. A covered entity can disclose a person’s demographic information and dates of health care to a business associate or to a related institution such as a foundation without that person’s consent, according to Janofsky.

Any fundraising materials must describe how the patient may opt out of future communications. “However, APA maintains that the patient should be asked for consent before the fundraising communication is sent,” said Janofsky.

For example, “a commercial fundraising organization for a health facility could learn that a prominent person, such as a member of Congress or any other public official, was a patient at that facility and use the confidential information without that person’s authorization,” testified Janofsky. “APA is particularly concerned about the need for sensitivity when patients have psychiatric problems.”

The Department of Health and Human Services justified the changes last year to the federal rule by saying that patients should know all the treatment options and products and services that may benefit them. But HHS also conceded that the line between disease management and marketing is anything but clear.

Organizations that oppose any patient authorization requirement for marketing and fundraising activities in the final rule include the Direct Marketing Association and the National Association of Chain Drug Stores.

HHS issued the first proposed health privacy rule in 2000 after Congress failed to pass medical privacy legislation in the three-year timeframe mandated by the 1996 Health Insurance Portability and Accountability Act (HIPAA).

Although the rule was finalized in December 2000 under the Clinton administration, the Bush administration delayed the implementation date to review the rule and solicit additional comments.

HHS issued the final rule last April with the caveat that it will continue to review comments and consider making more changes as the rule is implemented. Health care providers, plans, and database companies have until April 2003 to comply with the rule.

The federal rule will not preempt stronger state health privacy rules. Approximately 35 states have privacy rules or laws with stronger protections for individual health information than the HHS final rule, according to Wendy Pellow, who testified on behalf of the National Association of Insurance Commissioners at the subcommittee hearing in January. They use the “opt-in” standard, which allows patients to decide in advance whether they want to receive any marketing materials, Pellow testified. ▪