Avoiding a HIPAA Nightmare

For years physicians have taken the lead in protecting patient confidentiality. It’s been standard operating procedure that sensitive patient information never leaves the office without staff first obtaining any necessary consent to release. And this traditional “S.O.P.” makes a news announcement from early July (detailed below) so unbelievable. For the actions fly in the face of what we’ve come to expect from the medical community. And this is the sort of thing that the Health Insurance Portability and Accountability Act (HIPAA) aims to stop when it goes into effect in April 2003. Unsolicited Free Samples — Okay for Breakfast Cereals, Not Medications How many times have you received in your mailbox a free sample of shampoo, breakfast cereal or some other commodity? It’s a common tactic used by many companies to promote their products. But a Ft. Lauderdale, FL, patient under treatment for depression received an unsolicited mailing from her pharmacy containing samples of Prozac. Actually, an estimated 300 people in South Florida received the samples, but this woman took strong exception. She knew she hadn’t discussed switching to Prozac with her physician and also realized the unsolicited mailing meant that someone at one or more companies had her name and some indication of her condition. (See “Another, Even More Alarming Case” for information about another case that has surfaced.) Justifiably upset, she filed suit against Eli Lilly (Prozac’s manufacturer), Walgreens (the pharmacy that shipped the Prozac) and her physician. Eli Lilly has apologized and either fired or reprimanded the appropriate parties responsible for the mishap. Walgreens is claiming that it only filled proper prescriptions from doctors and mailed the samples after receiving reimbursement coupons from Eli Lilly. The physicians aren’t saying anything. And the FDA is said to be “watching closely.” At the heart of the matter is a letter, signed by her physician, that came with the Prozac and stated in part: We are very excited to be able to offer you a more convenient way to take your antidepressant medication. Prozac Weekly is the exact same medication as Prozac, but with convenient once-a-week dosing. For you convenience, enclosed you will find a FREE one-month trial of Prozac Weekly. If you wish to try Prozac Weekly, stop your daily antidepressant one day before starting Prozac Weekly, then take only Prozac Weekly once a week thereafter. Congratulations on being one step [closer] to a full recovery. Stupid, Stupid, Stupid Reading that, especially the final sentence, you have to shake your head and wonder who at Walgreens was in charge of this looming debacle. And what were the physician(s) thinking when they got involved and (apparently?) supplied names and addresses without patient authorization? The hospital that owns the physician practice did its own tap-dancing, issuing a statement that read in part: This particular effort was the result of well-intentioned, respected physicians being given an opportunity to arrange for some of their patients to receive sample medications at no cost, through proper, licensed pharmacy channels, to introduce them to a more convenient dosage form. Somehow that may not fly if this case gets to court (and I suspect it will be settled without a very public and embarrassing litigation). Plaintiff’s attorney surely would argue that the unsolicited sample and its literature could disclose to unauthorized persons the sensitive nature of this patient’s treatment — an obvious violation of a patient’s right to privacy. Eliminating Occurrences Such As This One element of the HIPAA regulations (and proposed changes) deals with the release of confidential patient information for “marketing purposes.” Basically, absent a specific okay from the patient, confidential information is not to be given to third parties who would use that information to sell their products. The intent here is to make a clear differentiation between information shared and appropriately used for patient care and information used to influence purchasing decisions — for “marketing.” A proposed change to the original HIPAA regulations makes it clear that a communication would be considered “marketing” (and, therefore, allowable only with a patient’s authorization) if its purpose were to encourage recipients to purchase or use the item in question. Thus, the unsolicited shipment of a controlled substance and cover letter/marketing materials (especially, as in this case, one to treat a sensitive condition) would seem to be prohibited under the proposed HIPAA changes. The Hipaa Police If all along you’ve secured patient records from third parties that want the information only to increase their sales and market share, then you needn’t worry. The HIPAA police won’t be camped outside your office door on April 14, 2003, waiting to slap you with an expensive HIPAA violation. However, if you’re not keeping those records secure, then the time to change is now — before it’s mandated by HIPAA. As you write your office policies for HIPAA compliance, be sure to include something about the release of confidential records for purposes other than “treatment, payment and operations” — the allowable triumvirate. Remember, your first responsibility is to protect patient confidentiality.