National Committee on Vital and Health Statistics'
Recommendations on Marketing & Fundraising
March 1, 2002
The Honorable Tommy G. Thompson
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201
Dear Secretary Thompson:
As part of its responsibilities under the Health Insurance Portability
and Accountability Act of 1996 (HIPAA), the National Committee on
Vital and Health Statistics (NCVHS) monitors the implementation
of the Final Rules that adopt the health data standards required
by the Administrative Simplification provisions of HIPAA.
On January 24-25, 2002, the NCVHS Subcommittee on Privacy and Confidentiality
held public hearings on the implementation of the final rule "Standards
for Privacy of Individually Identifiable Health Information"
that was published on December 28, 2000. The two topics addressed
at the hearings were marketing and fundraising. The witnesses presented
the perspectives of trade associations, medical associations, insurance
commissioners, academic medical centers, non-profit hospitals, and
consumers. In addition to their oral remarks, the witnesses submitted
written comments to the subcommittee.
In an October 1, 2001 letter to you, NCVHS provided recommendations
on the issues of consent and minimum necessary. In our letter of
November 21, 2001, we provided recommendations on the issue of research.
This letter follows up on the previous ones by providing our recommendations
on the issues of marketing and fundraising.
NCVHS will continue to seek public comments on the implementation
of HIPAA administrative simplification provisions. In light of the
expected publication of the notice of proposed rulemaking (NPRM)
on amendments to the privacy rule, we respectfully recommend that
these NCVHS recommendations be considered in the rulemaking process.
Marketing
The diverging views expressed in the witness testimony indicated
to the subcommittee the difficulty of balancing the competing interests.
On the one hand, activities considered health care marketing include
not only the sale of health-related products and services, but also
patient education, health promotion, and disease management. On
the other hand, patients have a legitimate privacy interest in preventing
the disclosure of their protected health information to commercial
entities, the redisclosure of the information to other commercial
entities, and the intrusion associated with unwanted solicitations.
In the NPRM on the privacy rule, marketing was one of the topics
for which a prior authorization was required. This approach was
changed in the final rule to permit marketing activities pursuant
to the one-time general consent for treatment, payment, and health
care operations so long as the marketing was (1) face-to-face, (2)
involved items of nominal value, or (3) complied with rules for
health care marketing including disclosures and opt-out provisions.
There are two main options for regulating marketing. First, the
NPRM position can be used, in which marketing without an individual
authorization is presumed to be a violation of the privacy rule
and then certain exceptions can be created (e.g. permitting pharmacists
to notify customers that it is time to refill a prescription) to
strike the proper balance. Second, the final rule position can be
used, in which marketing without an individual authorization is
presumed to be permitted under the privacy rule, and then restrictions
are added (e.g. disclosures and opt-out provisions) to strike the
proper balance. After carefully considering the issues, the NCVHS
believes that the final rule should be amended to return to the
approach of the NPRM. In our view, the current approach provides
inadequate protection in several key areas, such as disclosure of
health information about children, disclosure of sensitive medical
conditions, redisclosure of information by marketers, and reliance
on an opt-out system of questionable effectiveness that puts the
burden on consumers. We believe that it will be easier to strike
the appropriate balance by creating exceptions to a general prohibition
on marketing without individual authorization than it will be to
add restrictions to a general approval of marketing.
The Committee makes the following recommendations:
1. Except as provided in our additional recommendations, marketing
should not be considered within treatment, payment, or health care
operations.
2. The definition of marketing should be clarified such that refill
reminders and other treatment-related reminders by pharmacists and
other providers or their business associates are considered treatment
and not marketing.
3. Disease management, when the purpose of which is not to sell
products or services, should be considered part of treatment or
health care operations, and not marketing.
4. Authorizations to permit health care marketing should be limited
to products or services that are directly related to the health
of the patient, and should clearly indicate that they are comprehensive
and can include sensitive protected health information.
5. The disclosure of protected health information by covered entities
to marketers should be conditioned on the marketers' agreement (1)
not to redisclose the information, and (2) to disclose, in the course
of marketing, the financial arrangements of the parties.
6. Standardized, simplified procedures should be adopted to ease
the burden on individuals who want to opt-out of future marketing
contacts.
7. In marketing pursuant to an authorization, and in health care
reminders and disease management, protected health information should
not be disclosed via voice mail, an unattended FAX, or through other
methods of communication that are not secure.
Fundraising
Although marketing and fundraising are often discussed together
and they receive similar treatment under the final rule, there are
fundamental differences. The fundraising activities of non-profit
health care institutions are essential to our health care system.
Without the billions of dollars of private contributions obtained
each year through fundraising there would be serious adverse effects
on medical research, indigent care, medical education, and other
vital areas. Thus, although the privacy interests of patients in
their protected health information must be taken seriously, in weighing
the competing interests it is essential not to unnecessarily impede
responsible fundraising activities.
The final rule provides that fundraising is within health care
operations and therefore is subject to the one-time general consent.
The main limitation placed on fundraising is that the only protected
health information that may be disclosed to fundraisers is demographic
information about the individual and dates of service. A point of
contention expressed at the hearing was whether department of service
information also should be made available for fundraising purposes
without an authorization.
The NCVHS supports the general approach adopted in the final rule
with regard to fundraising. We believe that fundraising should remain
within health care operations. Nevertheless, there are some specific
matters that we believe need to be addressed.
The Committee makes the following recommendations:
1. HHS should explore procedures for the disclosure of clinical
department of service information for use in fundraising such as
a simplified authorization or an opt-out procedure for departmental
information. These measures should attempt to balance the interests
of health care institutions to target fundraising with the privacy
interests of patients who could consider departmental information
to be sensitive health information.
2. In fundraising, protected health information should not be disclosed
via voice mail, unattended FAX, or other methods of communications
that are not secure.
3. Transitional rules for fundraising are needed to allow the continued
use of protected health information obtained before the effective
date of the privacy rule until first contact with the patient after
the effective date of the privacy rule.
NCVHS is continuing to explore a range of issues in the implementation
of the HIPAA privacy rule. We will provide you with additional recommendations
in due course.
At its hearings on the privacy rule, the NCVHS sensed considerable
anxiety based on the perceived complexity of the rule. With the
imminent publication of the NPRM, the NCVHS would like to emphasize
our belief that public education and outreach are essential in promoting
compliance with the privacy rule and in allaying public concerns
about the nature and effect of the rule. Therefore, we encourage
HHS to redouble its efforts in this regard. Similarly, we encourage
HHS to make the revised rule as understandable as possible to the
general public.
We appreciate the opportunity to offer these comments and recommendations.
Sincerely,
/s/
John Lumpkin, M.D., M.P.H.
Chair, National Committee on Vital and Health Statistics
cc: HHS Data Council Co-Chairs
Read NCVHS' recommendations from February 2002 on medical information
data standards.
Read NCVHS' recommendation
from November 2001 on research provisions.
Read NCVHS' recommendation
from October 2001 on consent and minimum necessary.
|
