Health Information Compliance Alert

Prescription Drugs:

PRIVACY PROJECT SLAMS PRESCRIPTION PLAN

A proposed rule creating a Medicare discount drug card doesn't live up to privacy-related promises in its preamble.

That's the opinion of the Health Privacy Project on the Centers for Medicare & Medicaid Services proposed rule published March 6 that details the process by which sponsors of prescription drug card programs can obtain Medicare endorsement from CMS.

"The only limit in the actual text of the proposed regulation on how sponsors (e.g., pharmacy benefit managers) use and disclose protected health information is that they cannot 'send or otherwise direct market to beneficiaries materials unrelated to the Medicare-endorsed prescription drug card program, unless the beneficiary provides prior written consent to receive these materials,'"says the HPP in a March 20 statement.

However, the text of the rule never explains how such consent is to be obtained, the privacy group claims. Nor is there any ban on requiring consent as a condition for enrollment in a discount drug program.

Additionally, the HPP points out that under the proposed rule, sponsors are allowed to share beneficiary information with each other "under the rubric of an administrative consortium." The rule, however, provides:

  • no limits on what beneficiary information will go to the consortium;

  • no limits on how the consortium or its members use beneficiary information; and

  • no security requirements that the consortium or its members must meet.

    Indeed, according to HPP's analysis, prescription drug card sponsors face only the "vague requirements" that they "protect the privacy and confidentiality" of plan beneficiaries, and keep written privacy policies that specify how they will notify beneficiaries of the intended uses of their information.

    The HPP also worries that it is not yet clear that drug card sponsors would be governed by the Health Insurance Portability and Accountability Act's privacy rule. But that may yet change as the CMS is receiving comments on the proposed rule until May 6.

    Editors note: To see HPP's summary of the proposed program, go to www.healthprivacy.org/usr_doc/Rx_Program_Summary.pdf.

  • Other Articles in this issue of

    Health Information Compliance Alert

    View All