New Guidance on Refill Reminders, Student Immunizations, Deceased Individuals

HHS’ Office of Civil Rights (OCR) has posted new guidance on its website regarding communications on (1) refill reminders for prescription drugs, (2) student immunizations, and (3) deceased individuals that are in compliance with the Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) and enacting regulations. The OCR also updated frequently asked questions on student immunizations and deceased individuals. The guidance provides details of existing regulations and examples of some common scenarios.

Refill Reminders

It is not considered a violation of the anti-marketing provisions of HIPAA for pharmacies to remind individuals to refill their prescriptions by phone, email or via the U.S. mail; although face-to-face reminders are prohibited. Included in refill reminders are communications regarding adherence programs where pharmacies contact individuals to see if they are taking their medications. Prohibited communications would include communications encouraging individuals to take (1) other drugs similar to or taken in conjunction with the prescribed medication; (2) new formulations of currently prescribed medications; or (3) a new type of medication. Any communication for which the pharmacy is reimbursed for anything other then administrative cost of the refill reminder or adherence program is prohibited. Organizations can contract with business associates to perform the refill reminder and adherence communication programs as long as the business associate meets the same requirements as the pharmacy.

Student Immunizations

In some instances physicians and other covered entities can provide information to school nurses and other health care professionals regarding a child’s immunization records without an authorization. Disclosure can be made directly to the school in states that require proof of vaccination in order to admit a child to school when a parent, guardian, or other person acting in loco parentis has agreed to the disclosure. In states without a requirement, authorization is needed but the authorization can be verbal or written. The authorization has to be recorded in the student’s medical record. If the state law does not require a HIPAA authorization for sharing immunization information, a physician or health care professional may disclose the information without any agreement or authorization. If disclosure is required by law, 45 C.F.R. 164.512(a) says the disclosure is permitted. Finally, disclosures of protected health information to a school nurse for the purposes of treatment are permitted without an authorization. For example, a student’s primary care physician may discuss the student’s medication and other health care needs with a school nurse who will administer the medication and provide care while the student is at school.

Deceased Individuals

The privacy of health information of deceased individuals must be maintained for 50 years after the person’s death if the health care provider maintains the records for that period of time. This requirement does not mean that physicians and health care professionals are required to maintain health information on deceased individuals for the 50 year time period. During this time, the personal representative of the deceased individual can sign authorizations for the release of the deceased individual’s protected health information. In addition, health professionals may release information to family members and friends of the deceased individuals unless the deceased individual prior to their death indicated not to release information to these people.

Disclosure of protected health information for treatment purposes, even the treatment of another person does not require an authorization. A covered entity may disclose the health information of a deceased individual to the health care provider of a surviving relative without an authorization. This allows individuals to obtain protected health information about a deceased person, such as family history, for treating their own medical condition.