* * *
The United States Senate approved the nomination of Kathleen Sebelius as Secretary of the Department of Health and Human Services (HHS) by a vote of 65 to 31, thus filling the final seat in President Obama’s Cabinet. Some Republicans challenged Sebelius’ nomination on a variety of bases, but amid the recent outbreak of swine flu and the threat of a global pandemic, objections to Sebelius faded. Sebelius became the Secretary of HHS upon taking the oath of office on April 28, 2009.
The U.S. Food and Drug Administration (FDA) issued Warning Letters to 14 drug manufacturers requiring the manufacturers to discontinue their use of short advertisements that appear as sponsored links on various Internet search engines, such as Google or Yahoo. Given the FDA’s detailed requirements for the content of promotional material, and the small number of characters that search engines permit to be included in sponsored links, it is nearly impossible for sponsored-link ads to be both useful and compliant with the law. The manufacturers believed that the ads complied with the law because of the “one-click rule.” That is, all of the FDA-required information was only “one click” away — no different, really, than having to turn the page of a magazine to read the risk information. However, as demonstrated by the agency’s issuance of these Warning Letters, the FDA has not actually adopted a one-click rule.
Unless or until the FDA institutes a rule similar to the one-click rule or issues some other form of guidance applicable to Internet marketing, the safest method to ensure compliance for companies wishing to take a more innovative approach to marketing is to request advisory comments from the FDA before publishing the promotional material.
Congress enacted the Ryan Haight Act (the “Act”), which amended existing laws regulating controlled substances, to prevent the illegal distribution and dispensing of controlled substances on the Internet. The Drug Enforcement Administration (DEA) recently promulgated regulations to implement the Act. Specifically, the Regulations closely track the Act, and impose two central requirements: (i) online pharmacies must modify their registration with DEA; and (ii) no controlled substance may be delivered, distributed, or dispensed by means of the Internet without a valid prescription — which requires an in-person medical evaluation. There are some exceptions to the requirement for an in-person medical evaluation, including an exception for special registration to practice telemedicine.
As required by the American Recovery and Reinvestment Act of 2009 (ARRA), the U.S. Government appointed 13 members to the Health Information Technology Policy Committee (“HIT Policy Committee”), a new advisory board established by ARRA. The HIT Policy Committee will be responsible for making policy recommendations to the appropriate HHS office responsible for health information technology implementation. The recommendations will be related to the adoption and implementation of a nationwide technology infrastructure that permits the electronic exchange and use of health information.
An additional seven members will be appointed by HHS and the U.S. Congress. The President can also appoint other members as representatives of relevant federal agencies.
The 13 members who were appointed across 10 different categories are:
Advocates for Patients or Consumers
1. Christine Bechtel, Washington, D.C. (3-year term) – Vice President, National Partnership for Women & Families
2. Arthur Davidson, M.D., Denver, Colorado (2-year term) – Denver Public Health Department; Director, Public Health Informatics; Director, Denver Center for Public Health Preparedness; medical epidemiologist; Director, HIV/AIDS Surveillance, City and County of Denver
3. Adam Clark, Ph.D., Austin, Texas (1-year term) – Director of Research and Policy, Lance Armstrong Foundation
Representatives of Health Care Providers, including one physician
4. Marc Probst, Salt Lake City, Utah (3-year term) – Chief Information Officer, Intermountain Healthcare
5. Paul Tang, M.D., Mountain View, California (2-year term) – Vice President and Chief Medical Information Officer, Palo Alto Medical Foundation
Labor Organization Representing Health Care Workers
6. Scott White, New York City, New York (1-year term) – Assistant Director, Technology Project Director, 1199 SEIU Training and Employment Fund
Expert in Health Information Privacy & Security
7. LaTanya Sweeney, Ph.D., Pittsburgh, Pennsylvania (3-year term) – Director, Data Privacy Lab, Associate Professor of Computer Science, Technology and Policy, Carnegie Mellon University
Expert in Improving the Health of Vulnerable Populations
8. Neil Calman, M.D., New York, New York (2-year term) – President and CEO, The Institute for Family Health, Inc.
Research Community
9. Connie Delaney, R.N., Ph.D., Minneapolis, Minnesota (1-year term) – Dean, School of Nursing, University of Minnesota
Representative of Health Plans or Other Third-Party Payers
10. Charles Kennedy, M.D., Camarillo, California (3-year term) – Vice President, Health Information Technology, Wellpoint, Inc.
Representative of Information Technology Vendors
11. Judith Faulkner, Verona, Wisconsin (2-year term) – Founder, CEO, President, and Chairman of the Board, Epic Systems Corporation
Representative of Purchasers or Employers
12. David Lansky, Ph.D., San Francisco, California (1-year term) – President and CEO, Pacific Business Group on Health
Expert in Health Care Quality Measurement and Reporting
13. David Bates, M.D., Boston, Massachusetts (3-year term) – Medical Director for Clinical and Quality Analysis, Chief of General Internal Medicine, Partners HealthCare/Brigham & Women’s Hospital
On April 17, 2009, the Federal Trade Commission (FTC) proposed new breach notification rules implementing Section 12407 of the American Recovery and Reinvestment Act of 2009 (ARRA). The rules apply to vendors of personal health records (PHRs) and providers of online applications that interact with PHRs or offer services through the website of a PHR vendor (“PHR-related entities”). PHRs are electronic compilations of identifiable health information that can be drawn from multiple sources and that are managed, shared, and controlled primarily by or on behalf of an individual. Examples of PHRs include GoogleHealth and Microsoft HealthVault. Examples of PHR-related entities include web-based applications that help consumers to manage medications or websites offering online personalized health checklists. The rules also apply to third parties providing services to PHRs and PHR-related entities.
The rules require vendors of PHRs and PHR-related entities to notify consumers when the security of their electronic health information is breached. The rules also require third-party service providers to notify PHR vendors or PHR-related entities of breaches, so that they may in turn notify consumers. A link to the new rules is here.
For assistance in this area, please contact one of the attorneys listed below or any member of your Mintz Levin client service team.
Susan W. Berson
Managing Member,
Washington, D.C. Office
SBerson@mintz.com
Robert D. Clark
Managing Member, Health Law Practice
RDClark@mintz.com
Hope S. Foster
HSFoster@mintz.com
Karen S. Lovitch
KSLovitch@mintz.com
Stephen R. Bentfield
SRBentfield@mintz.com
Theresa C. Carnegie
TCCarnegie@mintz.com
Lauren N. Haley
LNHaley@mintz.com
Sarah A. Kaput
SAKaput@mintz.com
Katina W. Lee
KLee@mintz.com
Carrie A. Roll
CARoll@mintz.com
Tara E. Swenson
TESwenson@mintz.com
Heather L. Westphal
HLWestphal@mintz.com
Jennifer E. Williams
JEWilliams@mintz.com