Flu season is in full effect, and pharmacies want to make prerecorded calls to remind customers to get the flu shot. The Telephone Consumer Protection Act (“TCPA”) bans most advertisement or telemarketing calls using an automatic telephone dialing system (“ATDS”) or prerecorded voice to call cell phones without prior express written signed consent. 47 C.F.R. § 64.1200(a)(2). Most prerecorded calls to residential numbers are allowed only with prior express written signed consent. Id. at (a)(3).
However, the Federal Communications Commission (“FCC”) adopted an exemption for certain ATDS and prerecorded health care calls to residential lines made by or on behalf of a covered entity or its business associates regulated by the Health Insurance Portability and Accountability Act (“HIPAA”). Id. at (a)(3)(v). The Federal Trade Commission (“FTC”) also exempts health care related messages from the restrictions in the Telemarketing Sales Rule. 73 Fed. Reg. 51164, 51191 (Aug. 29, 2008).
HIPAA regulations control whether or how an individual’s protected health care information is disclosed. See 45 C.F.R. § 164.508. HIPAA protects all “individually identifiable health information” held or transmitted by a covered entity or business associate, in any form or media, whether electronic, paper or oral. Id. at § 160.103. A “covered entity” is defined as:
- A health plan.
- A health care clearinghouse.
- A healthcare provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
Id. at § 160.103. A “business associate” means a person who, on behalf of a covered entity, maintains or transmits health information. Id.
ATDS or prerecorded calls made by or on behalf of a health care provider are subject to HIPAA because the calls have the potential to inadvertently disclose individually identifiable health information. Thus, companies must be aware of what types of calls are permitted under HIPAA. If the calls to residential lines are made solely for the provision of health care and contain information relating to care, services, or supplies related to the health of an individual, the calls are permitted under HIPAA. Id. at § 160.103.
In general, a covered entity may not use or disclose protected health care information for marketing purposes. Id. at § 164.502. However, ATDS or prerecorded calls to residential lines made by or on behalf of a covered entity that describe a health-related product or service that is included in a plan by the covered entity, calls for the treatment of an individual, or calls for case management or care for the individual are not considered marketing calls and are permitted under HIPAA. Id. at § 164.501.
The FCC and FTC addressed HIPAA and discussed whether “immunization reminders, health screening reminders, medical supply renewal requests, and generic drug migration recommendations would constitute inducements to purchase goods or services” and thus, violate the TCPA and TSR. 77 Fed. Reg. 34233, 34241 (June 11, 2012); 73 Fed. Reg. 51164, 51192 (Aug. 29, 2008).
The FCC, agreeing with the FTC’s approach under the TSR, stated:
the HIPAA privacy regulations are rigorous and reflect a statutory mission to protect privacy rights … enforcement measures of HIPAA discourage abuse because these measures include civil and criminal penalties. The FCC therefore adopts an exemption from its TCPA rules for prerecorded health care-related calls to residential lines that are subject to HIPAA.
77 Fed. Reg. at 34241.
It is important to note that the TCPA’s exemption for calls regulated by HIPAA only extends to ATDS or prerecorded calls made to residential lines. ATDS or prerecorded calls to cell phones, even though they would otherwise be regulated by HIPAA, still require prior express oral or written consent. See 47 C.F.R. §§ 64.1200(a)(1), (a)(2).
While HIPAA provides minimum protection for calls into all states, if there is a conflict between HIPAA and state law, HIPAA prevails. 45 C.F.R. § 160.203. States can, however, impose additional restrictions related to the privacy of individually identifiable health information. Id. at (b).
Thus, HIPAA permits ATDS or prerecorded calls to residential lines made by or on behalf of covered entities as long as the calls are not made for marketing purposes or there is prior written authorization. Id. at § 164.501. The calls must describe a health-related product or service included in a plan by the covered entity, be for the treatment of an individual, or relate to case management or care for the individual.
As the flu season rages on, pharmacies are free to make ATDS or prerecorded flu shot reminder calls to customers’ residential lines without prior express consent, but ATDS or prerecorded flu shot reminder calls to cell phones, even though they would otherwise be regulated by HIPAA, still require prior express oral or written consent.
HIPAA requirements and regulations are complicated. This article is a brief overview of how they relate to telemarketing law and does not cover how to comply with HIPAA. This article is not to be used as substitute for legal counsel.