On July 1, 2014, a new law will impose additional requirements on retailers operating pharmacy rewards programs (“covered retailers”) in Connecticut. Because the state law imposes requirements more stringent than that of HIPAA, those subject to the law should ensure compliance before the July 1 effective date, as a violation of the law also constitutes an unfair or deceptive act or practice under Connecticut law. Signed by the Governor of Connecticut on June 12, 2014, the law requires that before covered retailers can enroll consumers in a pharmacy rewards program, they must provide consumers with a written, plain language summary of the terms and conditions of that program. And if the consumer is required under HIPAA to sign a HIPAA authorization form to participate in the program, the law mandates that the covered retailer include certain information on that HIPAA authorization form, adjacent to the point where such form is to be signed. The information disclosed must include:
- The specific uses or disclosures of protected health information (“PHI”) the HIPAA authorization allows;
- Whether PHI obtained by the covered retailer will be disclosed to third parties and, if so, a warning that such information will not be protected by federal or state privacy laws;
- The identity of any third parties who will have access to the consumer’s PHI;
- How the consumer may revoke the HIPAA authorization; and
- That the consumer is entitled to a copy of the HIPAA authorization form once signed.
The Connecticut law imposes more stringent requirements than HIPAA because, among other things, it requires specific placement of certain information on the HIPAA authorization form and a specific disclosure that the consumer is entitled to a copy of the signed HIPAA authorization form.
Finally, the law requires that covered retailers define certain terms (e.g. “HIPAA” and “protected health information”), if the terms are used in promotional materials for the pharmacy rewards program, the plain language summary of the program’s terms and conditions, or the HIPAA authorization form.
With the July 1, 2014 deadline rapidly approaching, covered retailers should immediately review any pharmacy rewards programs operating in Connecticut and implement changes as necessary.
Photo by Bart from Flickr
