CVS has announced that it no longer will mail prescription refill notices to consumers on behalf of pharmaceutical companies because of the new HIPAA omnibus rule, Modern Healthcare reports.
About the Refill Notices
CVS currently uses data from patients' prescription drug records to mail refill notices on behalf of pharmaceutical firms.
According to Modern Healthcare, between 75 million and 100 million refill notices are sent annually, primarily to patients with chronic conditions. Drug companies typically pay pharmacies about $1.50 per mailed notice (Conn, Modern Healthcare, 5/6).
About the HIPAA Omnibus Rule
The final HIPAA omnibus rule -- which includes four final rules that implement tougher privacy and security provisions -- was called for under the 2009 federal economic stimulus package's HITECH Act and the Genetic Information Nondiscrimination Act. The rules:
- Clarify when breaches must be reported to HHS' Office for Civil Rights;
- Establish new standards for the use of patient-identifiable information for fundraising and marketing;
- Expand liability to "business associates" of hospitals and other "HIPAA-covered entities," such as data miners and health IT service providers; and
- Raise the maximum penalty for noncompliance to $1.5 million per violation (iHealthBeat, 5/2).
Details on CVS' Policy Change
Mike DeAngelis -- director of public relations at CVS/pharmacy -- in an emailed statement said, "Over the years, we have collaborated with pharmaceutical companies to improve patient compliance to medication dispensed in our retail pharmacies by mailing select refill reminders to encourage and improve their medication adherence."
DeAngelis added, "However, in light of the recent HIPAA omnibus rule effective this September that places new restrictions on the usage of [personal health information], we have decided to end supplier-funded refill reminders through our retail business."
CVS' new policy will take effect at the end of July, DeAngelis said.
Comments on CVS' Policy Change
According to HHS' Office for Civil Rights, the HIPAA omnibus rule generally restricts the ability of covered entities to send information to consumers about a third party's products or services. However, the rule includes an exception for prescription drug refill reminders, provided that any payments received by the covered entity are related only to the cost of distributing the refill reminders, such as the cost of labor, supplies or postage.
Rebecca Williams -- a partner with the law firm Davis Wright Tremaine -- said that CVS' decision might stem from "some [uncertainty] as to what may be deemed to be a reasonable amount" to receive as payment for distributing refill reminders. "So this may be a gray enough area that this may not be an area they want to be in," Williams said.
Rachel Seeger -- spokesperson for OCR -- in an email said, "OCR does not have information on CVS's actions." Seeger added that OCR cannot comment on the business actions of covered entities (Modern Healthcare, 5/6).