HHS OCR Issues HIPAA Guidance on Refill Reminders, Decedent Information, Disclosure of Proof of Student Immunications and Delays CLIA Lab Enforcement

Late last night, HHS OCR issued its anticipated guidance on “The HIPAA Privacy Rule and Refill Reminders and Other Communications about a Drug or Biologic Currently Being Prescribed for the Individual.”  A new “Fact Sheet” and corresponding “Frequently Asked Questions” attempt to explain how the refill reminder exception to the marketing rule works, and seek to address both the scope of communications that fall within the exception, as well as the types of third party payments that are considered “reasonable” under the statute and regulations for making such communications.  In addition, the Secretary has decided not to enforce the restrictions on remunerated refill eminders and other communications about drugs and biologics for a period of 45 days following the September 23, 2013, compliance date, or until November 7, 2013.

Also released today are new fact sheets and FAQs that provide guidance on the Omnibus Rule changes to how the HIPAA Privacy Rule applies to decedent information and disclosures of proof of student immunizations to schools. 

Finally, HHS OCR also announced a delay in its enforcement of the requirement that certain HIPAA-covered laboratories revise their notices of privacy practices to comply with the Omnibus Rule.  This delay applies to HIPAA-covered laboratories that are subject to CLIA (i.e., CLIA-certified) or exempt from CLIA (i.e., CLIA-exempt) and that are not required to provide an individual with access to his or her laboratory test reports under § 164.524 of the HIPAA Privacy Rule because the information is subject to the exceptions to the right of access at § 164.524(a)(1)(iii)(A) or (B). The delay does not apply to laboratories that operate as part of a larger legal entity, such as a hospital, and by virtue of that relationship, do not have their own, laboratory-specific, NPPs. HHS OCR said it anticipates publishing an amendment to the HIPAA Privacy Rule and the CLIA regulations regarding the right of individuals to receive their test reports directly from CLIA and CLIA-exempt laboratories, which amendment was previously proposed for public comment in the Federal Register on September 14, 2011 (76 FR 56712).