Last month’s subject was privacy pre-emption, using the federal health privacy rules from the Health Insurance Portability and Accountability Act as an illustration. I promised to consider the rule’s health marketing provision, and I will.
First, let’s continue exploring pre-emption’s complexities.
Uncreative federal bureaucrats are often the cause of regulatory problems. I know that the health privacy rule was written under time pressure, but I doubt any of the dozens of responsible bureaucrats at the Department of Health and Human Services considered pre-emption adequately.
As I explained last time, I just completed a project that required evaluating each state’s health privacy laws to determine whether HIPAA pre-empted it. The work was long and difficult. One conclusion I reached is that some pre-emption problems can be avoided easily.
Let’s look at the rule regulating patient access to records. The federal rule, like many state laws, gives patients the right to inspect and copy health records maintained by healthcare providers and insurers. The federal rule says that record keepers can charge for providing a copy. It is OK to charge a patient who wants a copy. The rule says that the cost cannot exceed a reasonable cost-based fee, plus the cost of postage.
The rule prevents the fee from being either a barrier to access or a profit center. It prohibits minimum fees, search fees and handling fees. The policy also allows flexibility by saying that a fee must be cost-based and not strictly limited to actual costs.
This is all reasonable policy for access to records. Now let’s match the federal policy to state laws. Many states enacted fee schedules into law. The schedules vary considerably, reflecting different local costs. A typical law says that the fee can be so much for a copy of a page and so much for an X-ray. Some states provide annual inflation adjustments.
How does a doctor know what to charge once the federal rule takes effect? Does 50 cents a page meet the federal requirement for a reasonable cost-based fee? I don’t think so. A fee fixed by statute isn’t cost-based. It may be perfectly reasonable, but it is arbitrary.
Had the bureaucrats at HHS researched before they regulated, they would have found that the rule creates confusion. Before HIPAA, the charges for copying were known in many states. After HIPAA, uncertainty prevails. HIPAA seems to wipe out existing state fee schedules, but it offers nothing definitive in their place. This is a case where the federal rule made life worse. Multiple state fee schedules were better and fairer than a single federal rule.
The problem could have been avoided. The rule should have used the reasonable cost-based standard, but it also should have recognized and accepted any copying charge authorized by state law. Those charges may not be cost-based, but they are certainly reasonable. Accepting statutory fee schedules would have been simple and certain. Alternatively, accepting them for a few years would have allowed time for new approaches and left the old fees in place.
Now let’s look at the marketing provision, a very complex rule. The basic policy is that a covered entity needs the consent of a patient to use or disclose information for marketing. Privacy advocates like that rule a lot more than marketers do. Marketers were happy with the opt-out marketing rule proposed by the Clinton administration. The Bush administration changed the marketing rule from opt out to opt in.
Good or bad, the marketing provision remains messy. Consider when an obstetrician gives a diaper sample to an expectant mother. That activity probably falls under the definition of marketing because it is a communication that encourages purchase or use of a product. If we had more space, we could play with the words to try to characterize the activity in other ways, but let’s stick with this analysis for now.
HHS recognized that there isn’t anything awful about the diaper sample. It wrote an exception so that the patient wouldn’t have to sign an authorization. The rule doesn’t provide that giving the sample isn’t marketing. What the rule says is that a face-to-face communication from a doctor to a patient is exempt from the written authorization requirement that applies to marketing activities. It’s marketing, but it’s exempt.
Here’s the problem. Some states have laws that prohibit use or disclosure of patient information for marketing purposes without written consent. I doubt that anyone in those states thought their language prohibited diaper samples. State laws don’t define marketing, so it is hard to tell where the lines are.
Now the federal rule provides that a diaper sample constitutes marketing, albeit exempt from the written authorization requirement. What happens to the state law marketing prohibitions? At best, we have an uncertain situation. Can trial lawyers start suing? Will state courts adopt the federal definition? Will state legislators have to fix the problem by casting a risky vote allowing marketing with healthcare data just to rescue diaper samples? A more artful rule would have avoided all of these problems.
I hope that you have enjoyed this romp through privacy pre-emption. Whatever side you take, pre-emption isn’t as easy as you might think or hope.
