82582 clozaril national reg.bro

Clozaril®
(clozapine)
National
Registry
Monitoring and Reporting
under the HIPAA Privacy Rule
What is HIPAA?
Who is covered under the HIPAA
HIPAA stands for the Health Insurance Portability Privacy Rule?
and Accountability Act. The Privacy Rule section of HIPAA applies to “covered entities”, which are the Act was issued in its current form by the US health plans, health clearinghouses, or health care Department of Health and Human Services (HHS) providers that transmit health information electroni- on August 14, 2002. It creates, for the first time in cally when conducting certain insurance-related the United States, a national minimum standard for transactions. Virtually all practicing doctors, hospi- privacy protection of health information.
tals and pharmacists are covered entities.
When did compliance with the HIPAA
What type of information is covered
Privacy Rule become mandatory?
under the HIPAA Privacy Rule?
Compliance became mandatory as of April 14, The Privacy Rule applies to "protected health infor- mation" (PHI) that at some point has been received,maintained or transmitted by a covered entity or acovered entity’s business associate. The Privacy Why was HIPAA enacted?
Rule applies regardless of the form in which the PHI HIPAA was enacted to promote the transferability is maintained or transmitted (e.g., paper, electronic, or "portability" of health insurance coverage for verbal), and regardless of whether it is transferred people who change or lose their jobs. It is also intended to reduce health care administrative costs, reduce health care fraud and abuse, andmake administrative transactions relating to health What is Protected Health Information?
care more efficient, secure, and patient-oriented.
Protected health information (PHI) is individuallyidentifiable information that relates to the past,present or future physical or mental health of a per- What new rights and responsibilities
son, the provision of healthcare, or the past, pres- are provided by the HIPAA Privacy Rule?
ent or future payment of a provision of healthcare.
✦ Greater privacy over health information In order to be considered PHI, it must contain one ✦ Individual choice as to whether health informa- or more of the 18 identifiers1 specified in thePrivacy Rule. If such information is stripped of all tion is used for purposes other than health care 18 identifiers specified in the Rule, it qualifies as ✦ Balancing public needs for disclosure against pri- “de-identified” information and is no longer affect- ed by the Privacy Rule. Only PHI that comes from a ✦ Security over health information in the posses- covered entity or its business associate is covered by HIPAA. Also, PHI that is contained in employ- ✦ Accountability of parties who mishandle person- ment records is not covered by HIPAA.
1The 18 identifiers that qualify as PHI are: name; geographic subdivisions smallerthan a state (including zip code); all elements of dates (except year) for dates relat-ing to an individual (e.g., birth date); telephone and fax numbers; e-mail address-es; social security numbers; medical record numbers; health plan numbers; accountnumbers; certificate/license numbers; vehicle identifiers; device identifiers and seri-al numbers; URL and IP addresses; biometric identifiers; full face photos; and anyother unique identifying number, code or characteristic.
How does the Privacy Rule protect
What are business associates?
health information?
Business associates are companies or individuals In general, the Privacy Rule requires that covered that meet the following three requirements: entities obtain written authorization from the indi- ✦ retained or engaged by the covered entity vidual who is the subject of the information, for all ✦ to perform a service or function on behalf of the uses and disclosures of PHI, unless the disclosure relates to “treatment, payment, or health care oper- ✦ that involves the necessary (i.e., not inadvertent) ations”, as those terms are defined in the PrivacyRule. There are a number of exceptions specified in transfer or review of protected health information.
Examples of business associates are external auditors, accountants and attorneys of the What are the exceptions to the
requirement for obtaining patient
authorizations?
What are business associate agreements?
The Privacy Rule permits uses and disclosures Business associate agreements are a specific type of of PHI without patient authorizations for limited written agreement between a covered entity and its purposes, and only under certain conditions, business associate, which are intended to bind the business associate to many of the substantive requirements of the Privacy Rule. In general, these ✦ Adverse event and quality complaint reporting agreements prevent the business associate from using, maintaining or disclosing protected health Public health, health oversight and regulatory information provided by the covered entity in any manner which would not be allowed by the cov- ✦ Judicial and administrative proceedings ✦ Law enforcement investigations✦ Identification of, or funeral arrangements for, Are all individuals who have business
interactions with covered entities
✦ To prevent serious threats to health or safety “business associates” of the covered
No. Only those individuals or companies that meet the Privacy Rule’s special definition of a “businessassociate” are business associates for purposes of the Are covered entities the only parties
Privacy Rule. Many individuals that interact with a affected by the Privacy Rule?
covered entity for business purposes are not businessassociates. For example, patients, family members or No. Many other parties are also affected. For friends of patients who accompany them to office example, covered entities bind their “business visits, and many individuals who help coordinate associates” through written contracts to abide treatment or participate in health care operations by many of the substantive provisions of the with covered entities are not business associates.
What is Clozaril®?
Why is it important to enroll patients
Clozaril® (clozapine) is an atypical antipsychotic in the Clozaril National Registry?
indicated for the treatment of recurrent suicidal All patients for whom the physician wishes to behavior in people with schizophrenia or prescribe Clozaril—not only new patients but schizoeffective disorder. Clozaril is also indicted anyone who has taken Clozaril before—must be for treatment-resistant schizophrenia. Because of enrolled (initials, social security number, date of the risk of agranulocytosis, the FDA has restricted birth, gender, zip code). This is to ensure that no the distribution of Clozaril since its introduction to patient is given Clozaril who has been on the drug the market. The drug is only available through a previously and had it discontinued due to adverse distribution channel that requires either weekly or effects, or whose pretreatment WBC is not within every-other-week white blood count (WBC) testing the acceptable limits. The success of the Clozaril prior to the dispensing of the next supply of National Registry has led to a reduction in the medication. A patient is eligible for WBC testing incidence of agranulocytosis in Clozaril patients.
every other week if he or she has been continuouslytreated with Clozaril for 6 months with no abnormalblood event. Please refer to the Clozaril package Does the Privacy Rule require patient
insert for more information and see black box authorizations in order to report infor-
warning contained inside back cover of this booklet.
mation to the Clozaril National Registry?
No. Although the Privacy Rule generally prohibits a What is the Novartis Clozaril
covered entity (such as a physician, hospital or National Registry?
pharmacist) from disclosing protected health infor-mation without an individual authorization, the Rule The Novartis Clozaril National Registry (CNR) is a provides certain exceptions to that Rule. One of mandatory registry established by Novartis which those exceptions relates to disclosures for “public provides a white blood count monitoring system health” purposes, which includes reporting to for patients on Clozaril. The purpose of the registry mandatory registries, such as the Clozaril National is to establish an ongoing monitoring system to alert physicians and pharmacists to drops in whiteblood counts in their Clozaril patients. Since 1997, The Health and Human Services comments to the the CNR has also included a confidential National Privacy Rule specifically state that disclosures made Non-Rechallenge Masterfile for all clozapine manu- for purposes of reporting to a mandatory registry, facturers, which is a single national database that such as the Clozaril National Registry, fall within the provides a list of all Clozaril or clozapine patients public health exception and do not require an who experienced severe leucopenia (a drop in their WBC count). Regardless of the manufacturer “The provisions under Sec. 164.512(b)(iii) are of the product that the patient was taking at the intended to allow the disclosure of information to time of emergence of severe leucopenia, key iden- FDA-regulated entities for the limited purpose of tification data is taken to ensure that the patient is conducting public health activities to ensure the not rechallenged with Clozaril by any manufacturer.
quality, safety, or effectiveness of FDA-regulatedproducts, including drugs, medical devices, biological products, and food.The Privacy Rule permits covered entities to disclose protectedhealth information to a registry… if such disclosure:is required by law…” Does the Privacy Rule require some
What other requirements are imposed
other type of confidentiality agreement
by the HIPAA Privacy Rule on covered
with Novartis in order to report infor-
entities?
mation to the Clozaril National Registry?
In addition to the general authorization requirement, covered entities must comply confidentiality agreements to protect disclosures made under an exception to the authorization requirements. Disclosures to the Clozaril National ✦ Providing a Notice of Privacy Practices Registry are made under the public health excep- ✦ Ensuring that only the “minimum necessary Will Novartis nevertheless sign privacy
✦ Executing business associate agreements commitments for information disclosed
with individuals or companies that meet the to the Clozaril National Registry even
✦ Granting individuals access to their PHI though doing so is not required by the
✦ Ensuring proper amendment and correction Privacy Rule?
At this time, to provide assurance to health care ✦ Adopting privacy policies and procedures professionals about the treatment of patients’ protected health information, Novartis can provide ✦ Complying with privacy inspections by the you with a signed privacy commitment, which generally describes Novartis’ commitment not to use or disclose protected health information Retaining records of PHI disclosures made outside of Novartis that may be disclosed to Novartis for purposes of reporting to the Clozaril ✦ Mitigating harm from any known privacy National Registry, except as may be required for public health or safety purposes (such as reportingadverse events or quality complaints), or asrequired by law.
Where can I obtain additional
information about the HIPAA
Privacy Rule?
If I report information to the Clozaril
National Registry, am I required to alert
patients to these disclosures under the
Privacy Rule?
www.hhh.gov.ocr/hipaa/privacy.html You should indicate in your Notice of PrivacyPractices to patients that your office practices may for more information on the HHS guidance include appropriate reporting to registries as required by health authorities. You should alsoupdate your disclosure log to reflect those disclo-sures.
CLOZARIL® (clozapine) use is associated with asubstantial risk of seizure affecting 1% to 2% ofpatients at low doses (below 300 mg/day), 3% to 4% at moderate doses (300 mg/day to 600mg/day), and 5% at high doses (600 mg/day to900 mg/day). In clinical trials, CLOZARIL wasassociated with a 1% to 2% incidence of agranulocytosis, a potentially fatal blood disorder, which, if caught early, can be reversed.
Mandatory monitoring of white blood cell countsand drug dispensing as per the requirementsspecified in the package insert, provide an efficient means of determining developing agranulocytosis. Analysis of post-marketing safety databases suggests that CLOZARIL is associated with an increased risk of fatalmyocarditis, especially during, but not limited to, the first month of therapy. Orthostatichypotension may occur in some patients, especially during the initial phases of treatment,and can, in rare cases (approximate incidence of 1/3,000), be accompanied by collapse and/orcardiac arrest.
For more information on the HIPAA Privacy Rule:
The HIPAA Privacy Rule and HHS comments
can be viewed at:
www.hhs.gov.ocr/hipaa
The HHS guidance document issued on
December 3, 2002, can be viewed at:
www.hhs.gov/ocr/hipaa/privacy.html
Please see complete prescribing information for Clozaril®.
This booklet may be updated as new information or
guidances relating to the HIPAA Privacy Rule become
available. In addition, this booklet is not intended to provide
legal advice. Please consult with your own attorney for legal
advice relating to the HIPAA Privacy Rule.
Designed and Printed by Electronic Publishing and Printing Novartis Pharmaceuticals CorporationOne Health PlazaEast Hanover, New Jersey 07936

Source: http://www.clozarilcare.com/care/CNR-HIPAA.pdf