Stormy Weather Ahead: Adheris Challenges HHS’s Final Rule on HIPAA/HITECH Act, May Provide Further Insight into Supreme Court’s Decision in Sorrell

By Jeffrey N. Wasserstein & Alexander J. Varond –

Several months ago, when HHS released the final HITECH rule, we noted that several of the provisions represented a sea change from prior practice (see our previous post here).  Well, the seas have gotten rougher and one company feels that federal court is the safest port in this storm.  (Have we pushed the metaphor too far?)   On September 5, 2013, Adheris, Inc., a company that provides refill reminder and adherence messaging services, filed a complaint (and accompanying memorandum) seeking injunctive and declaratory relief to prohibit the Department of Health and Human Services from enforcing its final rule restricting certain paid marketing communications.  The final rule is scheduled to go into effect on September 23. 

Adheris’s refill reminder and adherence services

Adheris’s core business model involves sending reminders to customers of participating pharmacies to refill their existing prescriptions before their refills are due, and also preparing and sending letters that encourage customers to adhere to their prescribed treatment regimens.  The letters the company sends include “educational information about the medication, safety information, positive reinforcement to stay on therapy, and a direction to follow the treating physician’s advice.”  Adheris’s complaint states its services have a “verifiably significant impact on the percentage of patients still complying with their prescribed regimens at the end of a program period,” and, therefore, improve patient health.  Although pharmaceutical companies are the sponsors of these refill reminders and adherence messages, Adheris does not disclose protected health information to pharmaceutical manufacturers.  According to the complaint, Adheris derived total revenues of $49 million from these services in 2012. 

HHS’s final rule

Before the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which became law on February 17, 2009, pharmaceutical companies could hire pharmacies and pharmacy chains to remind patients to refill their prescriptions, or recommend switching to alternative therapies.  These types of communications were considered treatment communications and did not require a written authorization from the patient to comply with HIPAA.  As we discussed in our prior blogposts (here and here), Congress muddied the water by calling these communications “health care operations” (a separate category under HIPAA) without addressing treatment communications.  The final rule, issued by HHS’s Office for Civil Rights on January 25, 2013, seeks to implement the HITECH Act and requires patient authorization before using protected health information to direct any paid communication recommending a product or service to the patient, regardless of whether the purpose of the communication is treatment or health care operations. 

One exception provided for in the final rule is that refill reminders, adherence communications, and other communications to patients with current prescriptions for that drug do not require authorization if the payment received by the covered entity is “reasonably related to the covered entity’s cost of making the communication.”  As we noted in our prior post, HHS explained that this means that a covered entity cannot profit from the communication.  If the covered entity receives a financial incentive beyond its cost, it must obtain the patient’s authorization.  Because, as the complaint states, Adheris’s service-related expenses far exceed its permissible remuneration, Adheris’s business is threatened by the rule.

It is unlikely, despite repeated requests from industry, that HHS will issue guidance before its final rule goes into effect.  Without guidance from HHS indicating that refill reminders and adherence communications are permitted even where the payments to a covered entity or its business associate may include a profit component, Adheris stands to lose the lion’s share of its business – the complaint states that “substantially all” of the companies that use Adheris’s services have cancelled or are re-evaluating their programs.  Pharmaceutical companies fear that, under HHS’s final rule, using Adheris’s service may expose them to sanctions and other harm for the use of protected health information for marketing purposes.
                                                                                                                           
The complaint

In its complaint, Adheris states that the final rule (referred to as the “Omnibus Final Rule”) violates the First Amendment.  The following paragraph from the complaint nicely summarizes Adheris’s First Amendment position: 

The Omnibus Final Rule places content- and speaker-based burdens on Adheris’s protected speech.  The Omnibus Final Rule is content-based because its restrictions on refill reminders and adherence communications apply only to communications that “encourage individuals to purchase or use a third party’s product or service.” 78 Fed. Reg. at 5596.  The Omnibus Final Rule is speaker-based because it discriminates against speakers who communicate in exchange for payment from “a third party whose product or service is being described.”  45 C.F.R. § 164.501.  HHS itself has explained that the restrictions of the Omnibus Final Rule are triggered only where financial remuneration is provided in exchange for making the communication from or on behalf of the entity whose product or service is being described, and that identical speech funded by anyone other than the manufacturer of a product or provider of a service is permissible without individual authorization. Id. at 5593.  These content- and speaker-based restrictions have already had a serious chilling effect on Adheris’s refill reminders and adherence communications.

Adheris thus asserts that the rule is subject to heightened scrutiny and violates the First Amendment “because its restrictions on refill reminders and adherence communications do not directly advance a substantial government interest in a proportional manner.”

A decision in this case would shed light on the scope of the Supreme Court’s 2011 decision in Sorrell v. IMS Healthcare Inc., which declared that certain restrictions on the use of prescriber-identifying information were unconstitutional.  We blogged on that decision here.  In Sorrell, the Supreme Court held that Vermont’s Prescription Confidentiality Law, which provided that “absent the prescriber’s consent, prescriber-identifying information may not be sold by pharmacies and similar entities, disclosed by those entities for marketing purposes, or used for marketing by pharmaceutical manufacturers,” violated the First Amendment.  The Court further held that the law imposed a content- and speaker-based restriction on the sale, disclosure, and use of prescriber-identifying information and that, when subjected to heightened scrutiny, Vermont’s justifications were insufficient.

Adheris also advanced an administrative law position and argued that:

The HITECH Act, properly construed, does not limit the pre-existing ability of health care providers to make “treatment” communications that are funded by pharmaceutical manufacturers.  Instead, it only limits their ability to make “health care operations” communications when funded by pharmaceutical manufacturers.  42 U.S.C. § 17936(a)(1).  As HHS has previously recognized, refill reminders and adherence communications are “treatment” communications, not “health care operations” communications, when made by health care providers such as pharmacies, and their business associates, such as Adheris.  67 Fed. Reg. 53187.  The HITECH Act does not change the pre-existing definition of “treatment” [and, therefore, those aspects of the Omnibus Final Rule] restricting refill reminders and adherence communications are not in accordance with law.

This is an interesting next issue in the pharmaceutical industry’s struggle with free speech, and we will keep you posted as the case progresses.