Disease Management Is Treatment, Not Marketing

Holland & Knight's HIPAA Team assisted its client, the Disease Management Association of America (DMAA), in achieving a major success for its membership in the new proposed HIPAA privacy rule published in the March 27, 2002, Federal Register. In the final privacy rules, as in many state privacy laws, disease management services, which strive for patient health improvement, have frequently been confused with "marketing." Educating legislators and regulators to differentiate the two very different concepts has been a critical objective of DMAA for several years, because the current HIPAA privacy rules, and many state laws, require HIPAA-covered entities (e.g., providers and health plans) to obtain burdensome and expensive patient authorizations before they may disclose protected health information for marketing purposes.

Relying on Holland & Knight's HIPAA and Public Law groups, DMAA has consistently testified and advocated that legitimate disease management services do not promote the sale of certain drugs, devices or secondary products or services, and should not be confused with marketing. On March 1, 2002, the National Committee on Vital and Health Statistics (NCVHS) agreed with DMAA, stating in its recommendations to the Department of Health and Human Services (HHS): "Disease management, when the purpose of which is not to sell products or services, should be considered part of treatment or health care operations, and not marketing." The success with NCVHS has had the intended effect on the privacy rules modifications: HHS itself incorporated NCVHS's and DMAA's opinion that disease management is distinct. That rule, subject to a 30-day comment period, has changed the definition of marketing to clarify that care coordination, including disease management, is not marketing. HHS described its analysis as follows:

The Department [of HHS] received numerous comments suggesting that the Privacy Rule’s marketing exceptions in the definition and under §164.514(e) may not allow for certain common health care communications, such as disease management, wellness programs, prescription refill reminders, and appointment notifications that individuals expect to receive as part of their health care to continue unimpeded. The Department believes that these types of communications are allowed under the exceptions to the definition of "marketing" in the Privacy Rule, and therefore would continue to be allowed under the proposed modification.

We now expect that this precedent will help DMAA to educate state legislators that disease management programs, at the forefront in providing solutions to the care coordination, quality and access problems with the healthcare system, have no relation to marketing, and that consents and authorizations are unnecessary to protect patients, but instead could seriously hinder the quality of care for the 60% of Americans with a chronic illness who can benefit from disease management services.