Chapter 10: Physician Marketing - Legal & Compliance Considerations

Chapter 10: Physician Marketing - Legal & Compliance Considerations

Allison Shuren & Nikki Leon, Arnold & Porter Kaye Scholer LLP

Legal Overview

[Ed. Note: Federal and state laws and regulations are dynamic. While most of the information in this chapter still holds true, it has not been updated since our first edition, so be sure to confer with your legal counsel if you are unsure prior to launching a new marketing campaign.]

If you are a creative person, the possibilities for marketing your practice can be very exciting. There are many ways to spread the word about your services—through radio, television, print advertisements, professional websites, and even social media. You may also be hoping to engage directly with your community, promoting your practice not only through ads, but also via public events, face-to-face interaction with other medical providers and suppliers, charitable activities, online promotion (through patient surveys, reviews, or public tweets), and other means of engaging patients or community partners.

As a physician, or as a physician practice, you have more to consider than the average service provider. The legal standards that apply to your marketing activities are multiplied: your advertising or marketing is subject to consumer protection laws (as would be the case for anyone engaged in advertising or marketing) and your activity is also governed by state and federal laws that relate to patient privacy, fraud and abuse, and the professional practice of medicine. We have seen firsthand, through our experience representing physician practices, just how severe the risks can be. Violations of these laws can result in criminal charges, hefty civil penalties, heightened risk of private litigation, and permanent exclusion from participation in federal healthcare programs.

Not to worry. While we can’t give you specific legal advice about your current approach to marketing, this chapter will equip you with important tools: in reading this, you will learn what laws apply to marketing a physician practice and how to recognize some common pitfalls. If this overview feels overwhelming, focus on these key principles:

This chapter can’t possibly cover every question, but the best rule of thumb is to seek advice from an attorney who has significant experience with the legal issues we discuss in this chapter. At the very least, reading our overview will make you a better consumer when you go looking for legal counsel.

I. The FTC Act and State Consumer Protection Laws

Let’s start with the basics. As a person engaged in marketing or advertising, you are subject to consumer protection laws. The major federal consumer protection law you should know about is the Federal Trade Commission Act (“FTC Act”). States also have their own consumer protection laws that may apply to you depending on where you practice. As you will see, these laws deal with what you can say about your services and how you can say it:

The FTC Act is a federal law that prohibits “unfair” or “deceptive” advertising in any medium.[1] The law can be applied to any form of physician advertising. It is enforced by the Federal Trade Commission (FTC), a federal government agency. Although the FTC Act is not a criminal law (i.e. it doesn’t provide for criminal conviction, jail time, or criminal penalties), the FTC can still pursue an injunction (an order preventing the illegal advertising or marketing), and monetary penalties.[2]

Under the FTC act, an advertisement is “deceptive” if it is likely to mislead a consumer under the circumstances and if it is “material,” that is, important to the person’s decision to buy or use the product or service. An advertisement is “unfair” if it causes or is likely to cause substantial consumer injury that a consumer could not reasonably avoid, and is not outweighed by the benefit to the consumer. The law also requires that claims be “substantiated.” This means there must be a “reasonable basis” for the claim. What a “reasonable basis” means depends on the nature of the claim.[3]

Advertising by physicians is allowed so long as it is not false, deceptive, or misleading. You are responsible under the FTC Act for any claims that are reasonably implied from your statements. Thus, even if your advertisement doesn’t contain an outright falsity, it may still violate the FTC act if it creates unjustified expectations about you or your services. Unlike the laws in some states, Federal law does not prohibit patient testimonials, but testimonials are subject to the same standard (cannot be unfair or deceptive) as any other advertising.

States have consumer protection laws that are very similar to the federal FTC Act. That is, they are designed to protect consumers against unfair and deceptive (or “false and misleading”) advertising. In Florida, for example, the state law is modeled directly on the FTC Act and directs state courts to give great weight to FTC and federal court decisions under the FTC Act when applying state law.[4] Most states allow private citizens to bring a lawsuit directly against people or businesses who commit deceptive or unfair trade practices within the state.[5] Although these laws are not always worded in a way that directly references physicians, a number of courts have held that state consumer protection laws apply to physician practices.

II. AMA Ethics Opinions, AAO, FSMB and State Boards

Major medical societies, including the American Medical Association (AMA) and the American Academy of Ophthalmology (AAO), have provided guidance about physician marketing and advertising. These publications are not binding (in fact, the AMA once tried to regulate physician marketing more actively, but the FTC sued it for violating antitrust laws[9]). That said, following AMA, AAO and other guidelines is well-advised. Their publications give in-depth analysis that applies specifically to physicians (and in the case of AAO, to ophthalmologists). Following these recommendations may also help you stay compliant with respect to other laws, as the guidance touches on several important general principles (such as those against misleading advertising).

The AMA Code of Medical Ethics contains Section 9.6: “Physician Promotion & Marketing Practices.”[10] This section provides relevant guidance on advertising and publicity, patient incentives, and physician self-referral. Section 9.6 also provides guidance relating to gifts from industry, sale of products (health related or non-health related), issues related to prescribing and dispensing drugs and devices, direct-to-consumer advertising, and direct-to-consumer diagnostic imaging tests.

Here is a quick summary of the AMA guidance on the most relevant topics:

Incentives to Patients for Referrals:[12]

This AMA guidance could be relevant if you are thinking of encouraging your patients to recommend you to their friends and families or to provide online reviews or your practice. You should also consider these points if you are considering any promotional activities that involve “freebies” or discounts:

Physician Self-Referral:[13]

The AAO has issued Rule 13, on communications to the public. This is what the complete rule says (we have highlighted important parts):

Communications to the public must be accurate. They must not convey false, untrue, deceptive, or misleading information through statements, testimonials, photographs, graphics or other means. They must not omit material information without which the communications would be deceptive. Communications must not appeal to an individual's anxiety in an excessive or unfair way; and they must not create unjustified expectations of results. If communications refer to benefits or other attributes of ophthalmic procedures that involve significant risks, realistic assessments of their safety and efficacy must also be included, as well as the availability of alternatives and, where necessary to avoid deception, descriptions and/or assessments of the benefits or other attributes of those alternatives. Communications must not misrepresent an ophthalmologist's credentials, training, experience or ability, and must not contain material claims of superiority that cannot be substantiated. If a communication results from payment by an ophthalmologist, this must be disclosed unless the nature, format or medium makes it apparent.[14]

The AAO has issued an advisory opinion explaining the rule, which you should read on its website (check out the footnote below).[15] The issues addressed in the opinion include: (1) what modes of communication to the public are addressed by the Code of Ethics, (2) how is it determined whether communications are objectionable under the Code, and (3) to what degree must adverse information (e.g., risk) be disclosed in a communication to the public.

FSMB also provides guidance for state medical boards on the topics of physician advertising and social media use. The advertising guidance is similar to the AMA standard, cautioning against any advertising claims that are intentionally false or misleading. The social media guidance encourages professionalism on social media (including cautioning physicians against personal networking with current and former patients online), preservation of patient privacy. Remember that FSMB guidance, like the guidance published by AMA and AAO does not carry the force of law, but it outlines good rules to abide by when marketing your practice.[16]

Check the website of your state’s medical board to see if there are specific rules or guidelines that could apply to your practice. Unlike AMA and other professional associations, state medical boards DO have the authority to sanction physicians for advertising as well as social media use. This is because they are given authority under state law to regulate licensure and the practice of medicine. Thus, it is a good idea to see what rules and state board advisory opinions or comments may apply.

III. State Professional Codes

Please refer to your legal counsel regarding state professional codes, specifically as it relates to patient testimonials, claims about surgical results, and promotions and gifts which may be considered inducements for surgery.

IV. HIPAA, HITECH and Other State Laws on Privacy

HIPAA was passed in 2009 to implement health standards relating to privacy, security, national identifiers, and transaction and code set standards.[19] HIPAA’s provisions were further strengthened by the HITECH act, which expanded the scope of HIPAA and the businesses to which HIPAA applies.[20]

Who needs to comply with HIPAA? The law applies to both “Covered Entities” and “Business Associates.” Under HIPAA (45 C.F.R. § 160.103), covered entities are health plans, health care clearinghouses, and providers transmitting any electronic health information in connection with a HIPAA-covered transaction. Business Associates are those who provide services to Covered Entities and as a necessary part of providing that service or function, necessarily must have access to Protected Health Information (for example, your third party billing company is a Business Associate under HIPAA). Protected Health Information (“PHI”) means individually identifiable health information handled by a Covered Entity or Business Associate.

The Privacy Rule dictates when Covered Entities are required to disclose, and when physicians may disclose, PHI. Physicians, as Covered Entities, must disclose PHI at the request of the individual (or their representative) or when requested by HHS for the purposes of investigation or enforcement. Physicians may disclose PHI without additional authorization: to the individual; to the parent of a minor, unless the minor (1) is the one who consents to care and parental consent is not legally required, (2) a court has directed that the minor obtain care, and (3) the parent agrees the minor may have a confidential relationship with the health care provider;[25] for treatment, payment, and health care operations purposes; in certain other situations where the individual is provided opportunity to object; when disclosure is incidental to otherwise permitted use and disclosure; for public interest and benefit activities (for example, to avert an imminent threat to public safety); and in limited data sets for research, public health, or health care operation purposes.[26]

The Privacy Rule defines “marketing” as making “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.”[27] In general, HIPAA requires that the Covered Entity obtain authorization from the individual for this kind of communication to occur. However, two types of interactions are explicitly defined as not marketing under HIPAA: a face-to-face communication made by a covered entity to an individual; or a promotional gift of nominal value provided by the covered entity.[28] Examples of “nominal value” gifts that would not require the provider to seek authorization include pens, note-pads, and cups embossed with a logo.[29] The face-to-face exception also allows physicians to leave general circulation materials for patient pick up during office visits.[30] Physicians may also give patients free pharmaceutical samples without needing to receive authorization under HIPAA.[31] It is important to remember that other state and federal laws still apply, however—for example, such gifts should not be provided for the purpose of generating referrals (see our discussion of Fraud and Abuse laws).

If the marketing involves “remuneration” from a third party, this must be disclosed to the individual.[32] Remuneration means direct or indirect payment, other than payment for treatment of an individual, that is made from or on behalf of a third party whose product or services is being described.[33] However, if there is no “remuneration” involved, the following activities are also not considered marketing: (1) refill reminders; (2) case management or care coordination communications; and (3) communications describing the product or service (or payments for the product or service) that a Covered Entity (i.e. you, as a physician or physician practice) provide.

Beyond all of these HIPAA considerations, you should remember that many states have their own laws about patient privacy and protected information, and these could apply in addition to HIPAA requirements. It is a good idea to learn about the law in your state by consulting experienced local counsel.

There are several good practices you can employ in your marketing strategy with regard to HIPAA compliance, patient privacy, and state laws. For example, exercise caution in using testimonials (these can raise compliance issues under the FTC Act and state consumer protection laws as well). Make sure you are observing legal requirements to seek and receive authorization when using or disclosing patient information. Keep “marketing” activities within the HIPAA exceptions described above, if possible, or else do not target or communicate with patients in any way that might involve PHI. And, most importantly, seek advice from a specialist in HIPAA and other privacy laws.

V. Fraud and Abuse Laws

Federal healthcare fraud and abuse laws include the Stark Law and the Federal Anti-Kickback statute. States tend to have their own versions of these laws. Your advertising will be governed by the Federal laws as well as the state laws. And, if you are advertising across state lines, the fraud and abuse laws of another state could potentially apply, if you are advertising to government healthcare program beneficiaries living in another state (Medicare, VA, Medicaid).

In brief, the Stark law (Section 1877 of the Social Security Act, 42 U.S.C. 1395nn) pertains to ethics in patient referrals under Medicare. It is implicated when a physician makes a referral to another entity for certain designated health services where the physician or a family member has a financial relationship with the entity. Designated health services, which are listed in full under the law, include clinical laboratory services, outpatient prescription drugs, DME and supplies, and radiology services. Stark is a strict liability statute, which means that specific proof of intent is not required to show a violation of the law.

The Federal Anti-Kickback Statute (“AKS”) (42 U.S.C. 1320a-7b(b)) is a criminal law that prohibits the knowing and willful offer, receipt, payment, or solicitation of “remuneration” in exchange for patient referrals or the generation of business payable by a Federal healthcare program. There are certain exceptions to the statute, as well as regulatory “safe harbors” created by HHS; such arrangements are protected. However, the arrangement must meet all elements defined under the statute or regulatory safe harbor to be protected.

In addition to criminal penalties associated with the AKS, violations constitute a violation of the Civil False Claims Act (31 U.S.C. §§ 3729-3733), which is associated with civil monetary penalties and treble damages. The Department of Health and Human Services Office of the Inspector General can also enforce the Civil Monetary Penalties Law (42 U.S.C. 1320a-7a) against those who knowingly make, or cause to be presented, “false” claims for payment or approval to the federal government.

Practitioners who have violated the laws described can be excluded from federal healthcare programs--a serious consequence.

So, when do you need to worry about these laws? Be cautious if you are thinking about any promotional activities that involve financial incentives, “freebies,” gifts, or any exchange of value. Enforcement agencies will care about whether there is any possibility that these incentives could influence the generation of referrals, either among your patients (including incentives that could steer federal healthcare beneficiaries to “self-refer”) or among your community partners, including other providers or suppliers who might be a referral source.

Even something as innocuous as a holiday gift can be subject to regulators’ scrutiny if it looks like there was intent to induce a referral: in one notable 2016 settlement with the Department of Health and Human Services Office of Inspector General, for example, the Massachusetts-based ophthalmology group Boston University Eye Associates, Inc. (BUEA) agreed to pay $50,000 for allegedly violating the Civil Monetary Penalties Law provisions when it provided “improper remuneration” in the form of holiday gifts (candy and other small food items) to physicians and physician practices who were referral sources.[37]

VI. Social Media and Terms of Service

If you have a profile on any social media sites that may provide for patient reviews, consult the terms of use of those sites.

Share this guide on your social media account with the buttons below