"Avoiding a HIPAA Nightmare"
An unbelievable example of what can go very wrong
by Gil Weber, MBA
Reprinted with permission of the publisher.
Skin & Aging, Volume 10 - Issue 8
August 2002 - pages: 68-69
For years physicians have taken the lead in protecting patient confidentiality. It's been standard operating procedure that sensitive patient information never leaves the office without staff first obtaining any necessary consent to release.
And this traditional "S.O.P." makes a news announcement from early July (detailed below) so unbelievable. For the actions fly in the face of what we've come to expect from the medical community. And this is the sort of thing that the Health Insurance Portability and Accountability Act (HIPAA) aims to stop when it goes into effect in April 2003.
Unsolicited Free Samples -- Okay For Breakfast Cereals, Not Medications
How many times have you received in your mailbox a free sample of shampoo, breakfast cereal or some other commodity? It's a common tactic used by many companies to promote their products.
But a Ft. Lauderdale, FL, patient under treatment for depression received an unsolicited mailing from her pharmacy containing samples of Prozac. Actually, an estimated 300 people in South Florida received the samples, but this woman took strong exception. She knew she hadn't discussed switching to Prozac with her physician and also realized the unsolicited mailing meant that someone at one or more companies had her name and some indication of her condition. (See "Another, Even More Alarming Case" for information about another case that has surfaced.)
Justifiably upset, she filed suit against Eli Lilly (Prozac's manufacturer), Walgreens (the pharmacy that shipped the Prozac) and her physician.
Eli Lilly has apologized and either fired or reprimanded the appropriate parties responsible for the mishap. Walgreens is claiming that it only filled proper prescriptions from doctors and mailed the samples after receiving reimbursement coupons from Eli Lilly. The physicians aren't saying anything. And the FDA is said to be "watching closely."
At the heart of the matter is a letter, signed by her physician, that came with the Prozac and stated in part:
We are very excited to be able to offer you a more convenient way to take your antidepressant medication. Prozac Weekly is the exact same medication as Prozac, but with convenient once-a-week dosing.
For you convenience, enclosed you will find a FREE one-month trial of Prozac Weekly. If you wish to try Prozac Weekly, stop your daily antidepressant one day before starting Prozac Weekly, then take only Prozac Weekly once a week thereafter.
Congratulations on being one step [closer] to a full recovery.
Stupid, Stupid, Stupid
Reading that, especially the final sentence, you have to shake your head and wonder who at Walgreens was in charge of this looming debacle. And what were the physician(s) thinking when they got involved and (apparently?) supplied names and addresses without patient authorization?
The hospital that owns the physician practice did its own tap-dancing, issuing a statement that read in part:
This particular effort was the result of well-intentioned, respected physicians being given an opportunity to arrange for some of their patients to receive sample medications at no cost, through proper, licensed pharmacy channels, to introduce them to a more convenient dosage form.
Somehow that may not fly if this case gets to court (and I suspect it will be settled without a very public and embarrassing litigation). Plaintiff's attorney surely would argue that the unsolicited sample and its literature could disclose to unauthorized persons the sensitive nature of this patient's treatment - an obvious violation of a patient's right to privacy.
Another, Even More Alarming Case
A 16-year-old boy also recently received unsolicited samples of Prozac in the mail -- an entire month's worth of the medication, reported the Associated Press. Not only was he underage, but also he'd never even taken the drug or been treated for depression.
The boy had his name sent by a local doctors' office to a Walgreens in Palm Beach with instructions to send him the drug samples. According to the Associated Press, a lawsuit is planned by the boy's family, alleging invasion of privacy and possible unauthorized practice of medicine. In the state of Florida it's illegal for anyone to prescribe drugs to minors without consent of a parent or guardian.
In addition, subpoenas have already been issued to Eli Lilly, Walgreens and doctors involved in the mishap in order to investigate whether state laws were broken.
Eliminating Occurrences Such As This
One element of the HIPAA regulations (and proposed changes) deals with the release of confidential patient information for "marketing purposes." Basically, absent a specific okay from the patient, confidential information is not to be given to third parties who would use that information to sell their products. The intent here is to make a clear differentiation between information shared and appropriately used for patient care and information used to influence purchasing decisions - for "marketing."
A proposed change to the original HIPAA regulations makes it clear that a communication would be considered "marketing" (and, therefore, allowable only with a patient's authorization) if its purpose were to encourage recipients to purchase or use the item in question. Thus, the unsolicited shipment of a controlled substance and cover letter/marketing materials (especially, as in this case, one to treat a sensitive condition) would seem to be prohibited under the proposed HIPAA changes.
The HIPAA Police
If all along you've secured patient records from third parties that want the information only to increase their sales and market share, then you needn't worry. The HIPAA police won't be camped outside your office door on April 14, 2003, waiting to slap you with an expensive HIPAA violation. However, if you're not keeping those records secure, then the time to change is now - before it's mandated by HIPAA.
As you write your office policies for HIPAA compliance, be sure to include something about the release of confidential records for purposes other than "treatment, payment and operations" - the allowable triumvirate. Remember, your first responsibility is to protect patient confidentiality.
Gil Weber, a contributing editor for Skin & Aging, is a nationally recognized author, lecturer and practice management consultant to physicians and the managed care industry. He has also served as director of managed care for the American Academy of Ophthalmology.