82582 clozaril national reg.bro
Monitoring and Reporting
under the HIPAA Privacy Rule
What is HIPAA?
Who is covered under the HIPAA
HIPAA stands for the Health Insurance Portability
and Accountability Act. The Privacy Rule section of
HIPAA applies to “covered entities”, which are
the Act was issued in its current form by the US
health plans, health clearinghouses, or health care
Department of Health and Human Services (HHS)
providers that transmit health information electroni-
on August 14, 2002. It creates, for the first time in
cally when conducting certain insurance-related
the United States, a national minimum standard for
transactions. Virtually all practicing doctors, hospi-
privacy protection of health information.
tals and pharmacists are covered entities.
When did compliance with the HIPAA
What type of information is covered
Privacy Rule become mandatory?
under the HIPAA Privacy Rule?
Compliance became mandatory as of April 14,
The Privacy Rule applies to "protected health infor-
mation" (PHI) that at some point has been received,maintained or transmitted by a covered entity or acovered entity’s business associate. The Privacy
Why was HIPAA enacted?
Rule applies regardless of the form in which the PHI
HIPAA was enacted to promote the transferability
is maintained or transmitted (e.g., paper, electronic,
or "portability" of health insurance coverage for
verbal), and regardless of whether it is transferred
people who change or lose their jobs. It is also
intended to reduce health care administrative costs, reduce health care fraud and abuse, andmake administrative transactions relating to health
What is Protected Health Information?
care more efficient, secure, and patient-oriented.
Protected health information (PHI) is individuallyidentifiable information that relates to the past,present or future physical or mental health of a per-
What new rights and responsibilities
son, the provision of healthcare, or the past, pres-
are provided by the HIPAA Privacy Rule?
ent or future payment of a provision of healthcare.
✦ Greater privacy over health information
In order to be considered PHI, it must contain one
✦ Individual choice as to whether health informa-
or more of the 18 identifiers1 specified in thePrivacy Rule. If such information is stripped of all
tion is used for purposes other than health care
18 identifiers specified in the Rule, it qualifies as
✦ Balancing public needs for disclosure against pri-
“de-identified” information and is no longer affect-
ed by the Privacy Rule. Only PHI that comes from a
✦ Security over health information in the posses-
covered entity or its business associate is covered
by HIPAA. Also, PHI that is contained in employ-
✦ Accountability of parties who mishandle person-
ment records is not covered by HIPAA.
1The 18 identifiers that qualify as PHI are: name; geographic subdivisions smallerthan a state (including zip code); all elements of dates (except year) for dates relat-ing to an individual (e.g., birth date); telephone and fax numbers; e-mail address-es; social security numbers; medical record numbers; health plan numbers; accountnumbers; certificate/license numbers; vehicle identifiers; device identifiers and seri-al numbers; URL and IP addresses; biometric identifiers; full face photos; and anyother unique identifying number, code or characteristic.
How does the Privacy Rule protect
What are business associates?
Business associates are companies or individuals
In general, the Privacy Rule requires that covered
that meet the following three requirements:
entities obtain written authorization from the indi-
✦ retained or engaged by the covered entity
vidual who is the subject of the information, for all
✦ to perform a service or function on behalf of the
uses and disclosures of PHI, unless the disclosure
relates to “treatment, payment, or health care oper-
✦ that involves the necessary (i.e., not inadvertent)
ations”, as those terms are defined in the PrivacyRule. There are a number of exceptions specified in
transfer or review of protected health information.
Examples of business associates are external auditors, accountants and attorneys of the
What are the exceptions to the
requirement for obtaining patient
What are business associate agreements?
The Privacy Rule permits uses and disclosures
Business associate agreements are a specific type of
of PHI without patient authorizations for limited
written agreement between a covered entity and its
purposes, and only under certain conditions,
business associate, which are intended to bind the
business associate to many of the substantive
requirements of the Privacy Rule. In general, these
✦ Adverse event and quality complaint reporting
agreements prevent the business associate from
using, maintaining or disclosing protected health
Public health, health oversight and regulatory
information provided by the covered entity in any
manner which would not be allowed by the cov-
✦ Judicial and administrative proceedings
✦ Law enforcement investigations✦ Identification of, or funeral arrangements for,
Are all individuals who have business
interactions with covered entities
✦ To prevent serious threats to health or safety
“business associates” of the covered
No. Only those individuals or companies that meet
the Privacy Rule’s special definition of a “businessassociate” are business associates for purposes of the
Are covered entities the only parties
Privacy Rule. Many individuals that interact with a
affected by the Privacy Rule?
covered entity for business purposes are not businessassociates. For example, patients, family members or
No. Many other parties are also affected. For
friends of patients who accompany them to office
example, covered entities bind their “business
visits, and many individuals who help coordinate
associates” through written contracts to abide
treatment or participate in health care operations
by many of the substantive provisions of the
with covered entities are not business associates.
What is Clozaril®?
Why is it important to enroll patients
Clozaril® (clozapine) is an atypical antipsychotic
in the Clozaril National Registry?
indicated for the treatment of recurrent suicidal
All patients for whom the physician wishes to
behavior in people with schizophrenia or
prescribe Clozaril—not only new patients but
schizoeffective disorder. Clozaril is also indicted
anyone who has taken Clozaril before—must be
for treatment-resistant schizophrenia. Because of
enrolled (initials, social security number, date of
the risk of agranulocytosis, the FDA has restricted
birth, gender, zip code). This is to ensure that no
the distribution of Clozaril since its introduction to
patient is given Clozaril who has been on the drug
the market. The drug is only available through a
previously and had it discontinued due to adverse
distribution channel that requires either weekly or
effects, or whose pretreatment WBC is not within
every-other-week white blood count (WBC) testing
the acceptable limits. The success of the Clozaril
prior to the dispensing of the next supply of
National Registry has led to a reduction in the
medication. A patient is eligible for WBC testing
incidence of agranulocytosis in Clozaril patients.
every other week if he or she has been continuouslytreated with Clozaril for 6 months with no abnormalblood event. Please refer to the Clozaril package
Does the Privacy Rule require patient
insert for more information and see black box
authorizations in order to report infor-
warning contained inside back cover of this booklet.
mation to the Clozaril National Registry?
No. Although the Privacy Rule generally prohibits a
What is the Novartis Clozaril
covered entity (such as a physician, hospital or
pharmacist) from disclosing protected health infor-mation without an individual authorization, the Rule
The Novartis Clozaril National Registry (CNR) is a
provides certain exceptions to that Rule. One of
mandatory registry established by Novartis which
those exceptions relates to disclosures for “public
provides a white blood count monitoring system
health” purposes, which includes reporting to
for patients on Clozaril. The purpose of the registry
mandatory registries, such as the Clozaril National
is to establish an ongoing monitoring system to
alert physicians and pharmacists to drops in whiteblood counts in their Clozaril patients. Since 1997,
The Health and Human Services comments to the
the CNR has also included a confidential National
Privacy Rule specifically state that disclosures made
Non-Rechallenge Masterfile for all clozapine manu-
for purposes of reporting to a mandatory registry,
facturers, which is a single national database that
such as the Clozaril National Registry, fall within the
provides a list of all Clozaril or clozapine patients
public health exception and do not require an
who experienced severe leucopenia (a drop in
their WBC count). Regardless of the manufacturer
“The provisions under Sec. 164.512(b)(iii) are
of the product that the patient was taking at the
intended to allow the disclosure of information to
time of emergence of severe leucopenia, key iden-
FDA-regulated entities for the limited purpose of
tification data is taken to ensure that the patient is
conducting public health activities to ensure the
not rechallenged with Clozaril by any manufacturer.
quality, safety, or effectiveness of FDA-regulatedproducts, including drugs, medical devices, biological products, and food.The Privacy Rule permits covered entities to disclose protectedhealth information to a registry… if such disclosure:is required by law…”
Does the Privacy Rule require some
What other requirements are imposed
other type of confidentiality agreement
by the HIPAA Privacy Rule on covered
with Novartis in order to report infor-
mation to the Clozaril National Registry?
In addition to the general authorization
requirement, covered entities must comply
confidentiality agreements to protect disclosures
made under an exception to the authorization
requirements. Disclosures to the Clozaril National
✦ Providing a Notice of Privacy Practices
Registry are made under the public health excep-
✦ Ensuring that only the “minimum necessary
Will Novartis nevertheless sign privacy
✦ Executing business associate agreements
commitments for information disclosed
with individuals or companies that meet the
to the Clozaril National Registry even
✦ Granting individuals access to their PHI
though doing so is not required by the
✦ Ensuring proper amendment and correction
At this time, to provide assurance to health care
✦ Adopting privacy policies and procedures
professionals about the treatment of patients’
protected health information, Novartis can provide
✦ Complying with privacy inspections by the
you with a signed privacy commitment, which
generally describes Novartis’ commitment not to
use or disclose protected health information
Retaining records of PHI disclosures made
outside of Novartis that may be disclosed to
Novartis for purposes of reporting to the Clozaril
✦ Mitigating harm from any known privacy
National Registry, except as may be required for
public health or safety purposes (such as reportingadverse events or quality complaints), or asrequired by law.
Where can I obtain additional
information about the HIPAA
If I report information to the Clozaril
National Registry, am I required to alert
patients to these disclosures under the
You should indicate in your Notice of PrivacyPractices to patients that your office practices may
for more information on the HHS guidance
include appropriate reporting to registries as
required by health authorities. You should alsoupdate your disclosure log to reflect those disclo-sures.
CLOZARIL® (clozapine) use is associated with asubstantial risk of seizure affecting 1% to 2% ofpatients at low doses (below 300 mg/day), 3% to 4% at moderate doses (300 mg/day to 600mg/day), and 5% at high doses (600 mg/day to900 mg/day). In clinical trials, CLOZARIL wasassociated with a 1% to 2% incidence of agranulocytosis, a potentially fatal blood disorder, which, if caught early, can be reversed.
Mandatory monitoring of white blood cell countsand drug dispensing as per the requirementsspecified in the package insert, provide an efficient means of determining developing agranulocytosis. Analysis of post-marketing safety databases suggests that CLOZARIL is associated with an increased risk of fatalmyocarditis, especially during, but not limited to, the first month of therapy. Orthostatichypotension may occur in some patients, especially during the initial phases of treatment,and can, in rare cases (approximate incidence of 1/3,000), be accompanied by collapse and/orcardiac arrest.
For more information on the HIPAA Privacy Rule:
The HIPAA Privacy Rule and HHS comments
can be viewed at:
The HHS guidance document issued on
December 3, 2002, can be viewed at:
Please see complete prescribing information for Clozaril®.
This booklet may be updated as new information or
guidances relating to the HIPAA Privacy Rule become
available. In addition, this booklet is not intended to provide
legal advice. Please consult with your own attorney for legal
advice relating to the HIPAA Privacy Rule.
Designed and Printed by Electronic Publishing and Printing
Novartis Pharmaceuticals CorporationOne Health PlazaEast Hanover, New Jersey 07936
Anaphylaxis is highly likely when any one of the following 3 criteria are fulfilled 1. Acute onset of an illness (minutes to several hours) with involvement of the skin, mucosal tissue, or both (e.g., generalized hives, pruritus or flushing, swollen lips / tongue / uvula) and at least one of the following: a. Respiratory compromise (e.g., dyspnea, wheeze / bronchospasm, stridor, reduced PEF,
L’adolescent entre psyché et soma lescent comme une tentative d’aménagerL’ part d’entre nous la véritable ren- ce nouvel espace familial ; et ceci du faittion du statut de celui-ci et de son appar-tenance. Jusqu’alors en effet, aussi essen-parricidaire avec les parents, qu’introduitl’organisation de la personnalité, le corpsmiliarisation est nécessaire pour intégrerfa