Senior Communications Manager
Wiley Rein’s Kirk Nahra Discusses New Sales and Marketing Provisions of the HITECH Act
Kirk J. Nahra, chair of the Privacy Practice, was quoted in a March 2013 Report on Patient Privacy article about the sale and marketing provisions in the new omnibus regulation of the Health Information Technology for Economic and Clinical Health (HITECH) Act. As the article reports, covered entities (CEs) should trace payments and “follow the money” to ensure they are in compliance with the new regulations.
CEs will have to make sense of what is permitted under the new rules and, as Mr. Nahra noted, they may find that practices they currently engage in weren’t permitted under the regulation in effect today, and also won’t be allowed come Sept. 23, the compliance date of the new rule. He noted that CEs will have to “think long and hard” about which situations might trigger the need for an authorization under both the sale and marketing provisions. “Who is paying you?” is the central question, Mr. Nahra added. “What [CEs] need to do is think about every situation in which there is something flowing, money or something else, and figure out if it is OK” under both the marketing and sales provision of the new regulation, Mr. Nahra said, adding “there is some overlap” between the two.
There are a few common scenarios that illustrate the complexity of the provisions which Mr. Nahra says can’t easily be addressed without a lot of probing to understand the nuances of all the possible arrangements. Mr. Nahra also isn’t sure whether CEs are going to take the trouble to obtain the patient authorizations if their assessments show they are required under the new regulations. CEs will have to decide whether the activity that triggers the authorization is really “worth it,” he said.
Regarding an authorization for the sale of protected health information (PHI), it would be difficult to imagine a situation where a patient would permit the sale of his or her PHI, especially given that only the CE will benefit, a fact that must be divulged in the authorization. “Authorizations are very hard to get,” Mr. Nahra explained. Even if a CE obtains an authorization from a patient giving his or her consent to receive marketing material, that’s only step one in the process—and no guarantee of a positive response to the communication itself.