United States: California Legislative Revisions to the Confidentiality of Medical Information Act

The Act creates a new definition for "marketing" that limits the ability of providers of health care, health care service plans, contractors, and corporations and their subsidiaries and affiliates from sending communications that are sponsored by third parties. The restrictions could impact the ability of pharmacies, pharmacy benefit managers, and pharmaceutical manufacturers to distribute informational mailings to consumers. The purpose of this memorandum is to provide our clients with a summary of the background of the Act and to describe the Act’s impact.

Since the early 1980s, California has maintained and amended the CMIA. The CMIA states that no provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates may disclose medical information regarding a patient without obtaining an authorization, absent certain exceptions. The CMIA defines "provider of health care" broadly to include virtually every medical entity licensed in California. The term "medical information" means any "individually identifiable" information regarding a patient’s medical history, mental or physical condition, or treatment. "Individually identifiable" means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual (such as the patient’s name, address, electronic mail address, telephone number, or social security number), or other information that reveals the individual’s identity.

As noted above, the CMIA requires that regulated entities maintain and preserve the confidentiality of medical information. These entities are generally prohibited from disclosing medical information regarding a patient without first obtaining a valid patient authorization. Under the CMIA, a valid authorization must be: (1) handwritten by the person who signs it or in a typeface no smaller than 8-point;¹ (2) separate from other language on the same page; and (3) properly signed and dated. Notwithstanding the general prohibition against disclosure without authorization, there are exceptions when such medical information must be disclosed, for example, pursuant to court or administrative orders, search warrants, or other legally required disclosures.

Further, providers of health care may disclose medical information in certain instances. Medical information may be disclosed to other providers of health care, health care services plans, contractors, or other health professionals or facilities for purposes of diagnosis or treatment of the patient. The information may be disclosed to an insurer, employer, health care service plan, employee benefit plan, governmental authority, contractor, or any other person responsible for paying for health care services rendered to the patient, to the extent necessary to determine and provide payment. Similarly, medical information may be disclosed to any entity providing billing, claims management, medical data processing, or other administrative services on behalf of the patient. These exceptions apply equally to entities seeking to obtain confidential medical information.

On April 14, 2003, the patient privacy protections enacted under the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA") became effective. Absent certain exceptions similar to those in the CMIA, HIPAA prohibits covered entities from utilizing or disclosing certain protected health information ("PHI") without a valid authorization from the patient or authorized representative. Such "covered entities" include health care providers.

Generally, a covered entity must obtain an authorization to utilize or disclose a patient’s PHI for marketing except for face-to-face communications or gifts of nominal value. The authorization must disclose any third-party remuneration that the covered entity received for the marketing. For purposes of HIPAA, "marketing" means making a communication about a product or service that encourages recipients of the communication to purchase or utilize the produce or service. Importantly, excluded from the definition of marketing are communications: (1) describing health-related products or services of the covered entity making the communication; (2) for the treatment of the patient; and (3) for case management or care coordination of the patient, or to direct or recommend alternative treatments, therapies, health care providers, or care settings. Pursuant to HIPAA’s preemption provision, if an entity is governed by HIPAA, HIPAA and the CMIA are to be read in conjunction, with HIPAA controlling unless the CMIA’s terms conflict and are more stringent than HIPAA.

The Act seeks to close a perceived gap in the HIPAA definition of marketing. Specifically, the Act prohibits communications by health care providers or other entities to patients that are paid for by third parties, such as pharmaceutical companies. Pursuant to the Act, providers of health care, health care service plans, contractors, and corporations and their subsidiaries and affiliates are prohibited from intentionally sharing, selling, using for marketing, or otherwise utilizing medical information for purposes not necessary to provide health care services to a patient.

Like HIPAA, the Act defines "marketing" to mean a communication about a product or service that encourages recipients of the communication to purchase or utilize the product or service. The Act’s exclusions from the definition of marketing are more limited than HIPAA, however, only covering communications: (1) for which the communicator does not receive direct or indirect remuneration from a third party; (2) made to current health plan enrollees informing them of their benefits and plan procedures, including the availability of more cost-effective drugs; (3) concerning "disease management programs"² for chronic and seriously debilitating or life-threatening conditions, provided that notification of third party remuneration is provided and patients are provided the opportunity to opt-out of receiving future remunerated communications. The HIPAA exclusions for "treatment," "case management or case coordination," and recommending alternative "treatments" or "therapies" are omitted. Moreover, the definition of disease management programs is detailed and could be narrowly construed.

The Act was co-sponsored by the California Department of Health Services, Office of HIPAA Implementation and the California Medical Association. The legislative history of the Act states that it seeks to eliminate a "loophole" in which information may not be disclosed to a third party, but is still used for marketing purposes. For example, the authors cite a letter delivered by a retail pharmacy to a patient praising a certain drug and encouraging patients to refill their prescription for the drug. The letter noted that the mailing was funded by the prescription drug’s manufacturer and neither the patient’s name nor patient’s doctor name would be given to the manufacturer. In citing the necessity for the Act, the authors stated that under both HIPAA and the CMIA, this practice of allowing pharmaceutical companies to pay health care providers to market the companies’ drug directly to the provider’s patients would be allowable. The Act is intended to prohibit such funded communications, absent specific patient authorization.

Several pharmaceutical companies and associations opposed the Act. In particular, these entities requested that "refill reminder" letters be exempted from the Act’s marketing definition and that the disease management exception be drafted more broadly. Despite these objections, the Act was passed and signed. Since the Act would restrict the utilization of confidential medical information for marketing in circumstances where HIPAA would permit the use of such information, the Act appears to conflict with and be more stringent than HIPAA and, therefore, would not be preempted.

As a general matter, the Act places additional restrictions upon entities engaged in marketing activities in California. The programs most affected by the Act will be sponsored refill reminder mailings, which the legislative history specifically targets. In light of the exclusion from the definition of marketing of communications to health plan enrollees about more cost-effective pharmaceuticals, interchange letters discussing documented cost advantages of certain medications are likely permitted in the managed care context. Similarly, generic switching programs utilized by many health care providers and plans may be exempted from the provisions of the Act.

The Act also allows for remunerated communications for disease management programs provided that patients are notified of such remuneration and are provided an opt-out opportunity. Disease management programs, however, are carefully defined, and must be based on "evidence-based" or "consensus-based" guidelines. In light of the legislative history, regulated entities likely cannot casually deem a mailing to be disease management and assume that the requirements of the Act have been met.

This article is presented for informational purposes only and is not intended to constitute legal advice.