AMARILLO, TX – There are 78 million Baby Boomers who are retiring at the rate of 10,000 per day. As part of the Woodstock generation, Boomers want to stay active for as long as possible. Boomers are willing to pay cash for top-of-the-line products as opposed to having Medicare pay the DME supplier on an assignment basis for products of lesser quality.

This dynamic is motivating DME suppliers to promote the sale, for cash, of high end products to beneficiaries who in prior years might have been satisfied with receiving lower end products. As a DME supplier expands into the cash market, there are a number of legal issues that must be addressed. One issue is whether the DME supplier can cross market high end products to the supplier’s existing patient base. The short answer is “yes”… but the devil is in the details.

HIPAA
The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA) outline the restrictions and requirements for the use and disclosure of protected health information (PHI) by a covered entity or business associate. PHI is defined as “a subset of health information, including demographic information collected from an individual” that (1) can identify the individual; (2) is created or received by a health care provider or health plan; (3) relates to the past, present, or future physical or mental health or condition of an individual; and (4) is transmitted or maintained by electronic media or otherwise.

A covered entity includes a health care provider “who transmits any health information in electronic form in connection with a transaction covered [by HIPAA].” A business associate is an individual or an entity that performs certain services for or on behalf of a covered entity and that, pursuant to such services, requires access to the covered entity’s PHI. A DME supplier is a “covered entity” as defined by HIPAA.

Generally, unless an exception applies, covered entities are prohibited from “using” or “disclosing” a patient’s PHI unless the covered entity obtains a HIPAA compliant authorization for such disclosure. Prohibitions on use or disclosure of PHI extend to using or disclosing PHI for marketing purposes. Marketing is defined as any communication “about a product or service that encourages recipients of the communication to purchase or use the product or service.” The law excepts the following marketing communications from the requirement to obtain a HIPAA authorization:

• A face-to-face communication by the covered entity to an individual.
• A nominal-value promotional gift provided by the covered entity.

As another exception to the marketing restriction, HIPAA allows communications made by the covered entity to patients to describe a “health-related product or service” provided by the covered entity.

Sale of Cash Items Under Existing Tax ID Number
Assume that ABC Medical Equipment, Inc. decides not to set up a separate legal entity – but rather – to promote the sale of cash items under its existing Tax ID Number. If the cash products that ABC Medical offers are “health related,” then ABC Medical may contact its existing customers and educate them regarding ABC Medical’s cash products. For example, ABC Medical can (i) mail hard copy literature to its customers, (ii) send an email to its customers, and even (iii) under certain conditions, call its customers.

Sale of Cash Items by a Separate Legal Entity
Now let us change the facts and assume that the owner of ABC Medical decides to set up a new legal entity (“ABC Retail, Inc.”) that will sell the cash products. ABC Retail will have a different Tax ID # from ABC Medical. Assume that ABC Medical desires to cross market ABC Retail’s cash products to ABC Medical’s customers. The challenge is that if ABC Medical communicates to its customers about products offered by a different legal entity (ABC Retail), then the exception discussed above (i.e., describing a health-related product provided by the covered entity) does not apply. ABC Medical is not describing a health-related product provided by ABC Medical … but rather … is describing a product provided by another entity. In this case, before ABC Medical can communicate to its customers information about cash products offered by ABC Retail, ABC Medical must obtain a HIPAA authorization from the patients.

A HIPAA authorization can be obtained via email, in writing, or verbally. Verbal authorization would require ABC Medical to retain a written transcript of its call with the customer so that it can provide the customer with a written copy of the authorization, if requested.  HIPAA authorizations require certain core elements, including (1) a meaningful description of the information that will be used or disclosed; (2) the names of the parties that are disclosing the information and that are requesting disclosure of the information; (3) a description of the purpose of the disclosure; (4) an expiration date of the disclosure; and (5) the signature of the individual and date the authorization is signed.  A full description of the requirements of a HIPAA-compliant authorization can be found on the Office for Civil Rights (“OCR”) website and at 45 C.F.R. §164.508(c).

And so if ABC Retail is created, ABC Medical will be required to obtain a HIPAA authorization to:

• Call or send emails or mailers to ABC Medical customers regarding ABC Retail.
• Talk to ABC Medical customers over the phone about ABC Retail.
• Disclose PHI to ABC Retail in order for ABC Retail to contact ABC Medical’s customers.

A HIPAA authorization can be obtained by ABC Medical during a phone call initiated by a customer. ABC Medical should not initiate calls to customers for the sole purpose of obtaining a HIPAA authorization for marketing purposes. If a customer calls ABC Medical, or if ABC Medical calls a patient, about a reorder or other items and services, then an ABC Medical customer service representative (“CSR”) may be able to ask the customer if s/he would like to receive information about products and services offered by an affiliated company.

If the customers says “yes,” then the CSR can obtain the HIPAA authorization at that time. But, note that if a customer complains to the Office for Civil Rights (“OCR”), there is a risk that this conversation could be viewed as a “use” of PHI for marketing purposes.  In order to reduce this risk, if ABC Medical attempts to obtain HIPAA authorizations during calls with patients, the messaging should be carefully tailored to ensure that the CSR just requests an authorization, and if the patient says “no,” then no further marketing or messaging is provided.

ABC Medical is not required to obtain a HIPAA authorization to:

• Advertise ABC Retail on ABC Medical’s website. This may take the form of (i) a link between the websites and/or (ii) an ABC Retail banner on ABC Medical’s website.
• Direct patients to ABC Medical’s website that, in turn, advertises ABC Retail.

ABC Medical is not required to obtain a HIPAA authorization to send patients promotional gifts of nominal value printed with ABC Retail’s information. The regulations and available guidance do not specifically state whether the promotional gift must advertise the covered entity (i.e., ABC Medical). Absent published guidance to the contrary, it is likely acceptable for ABC Medical to send ABC Medical’s customers a promotional gift printed with ABC Retail’s information. However, ABC Medical would not be permitted to include any other information with the gift (i.e., no letter, flyer, or any other explanatory information).

In addition to HIPAA, ABC Medical should be mindful of other laws such as the CAN-SPAM Act, the Telephone Consumer Protection Act (“TCPA”), HIPAA security rules for securing PHI, and any analogous state laws addressing the same topics.

Lastly, ABC Medical’s commercial insurance contracts (e.g., Medicare Advantage contracts) likely require ABC Medical to take assignment when it sells a product, covered by the contract, to a contract enrollee. Assume, for example, that Mr. Smith is covered by a United Healthcare (UHC) Medicare Advantage (MA) contract. Assume that Mr. Smith wants to pay cash to ABC Medical for a product covered by the UHC MA contract. The contract likely prohibits ABC Medical from accepting such a cash payment from Mr. Smith. Rather, the contract likely requires ABC Medical to take assignment and bill UHC.

Jeffrey S. Baird, Esq., is chairman of the Health Care Group at Brown & Fortunato, a law firm with a national health care practice based in Texas. He represents pharmacies, infusion companies, HME companies, manufacturers, and other health care providers throughout the United States. Baird is Board Certified in Health Law by the Texas Board of Legal Specialization and can be reached at (806) 345-6320 or [email protected].