Does Arkansas Act 1053 of 2021, which bans pharmacy steering using patient data, conflict with federal law for Federally Qualified Health Centers, and can FQHCs still tell patients about in-house pharmacy services?
Apply this to your situation
This page answers the general question as of 2021. Ezel answers yours: what it means for your facts, under current Arkansas law, with citations.
Plain-English summary
Arkansas Act 1053 of 2021 made it illegal for certain healthcare entities, including Federally Qualified Health Centers (FQHCs), to "access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy." A state representative asked whether this restriction conflicted with federal law for FQHCs (which receive federal funding under the Public Health Service Act and have a federal duty to provide comprehensive primary care), and whether the law would block an FQHC from looking at patient data to figure out who could benefit from its in-house pharmacy and then telling those patients.
Attorney General Leslie Rutledge said no on both counts. The Arkansas statute bans a specific behavior, soliciting a transfer of a particular pharmacy patient. It does not ban an FQHC from informing its patients about in-house services as part of comprehensive care, which is what FQHCs are federally required to do.
On preemption: nothing in Public Health Service Act § 330, the FQHC grant regulations, HIPAA, or the Stark physician-self-referral law preempts the Arkansas restriction. HIPAA explicitly leaves room for stricter state privacy laws. Stark has no express preemption clause and does not impliedly preempt a more restrictive state law as long as compliance with both is possible. The Arkansas law is more restrictive in a way that fits cleanly inside that gap.
So an FQHC can still: provide patient education about in-house pharmacy options, fill prescriptions in-house when a patient walks in, and share information about what services are available. What it cannot do: mine patient records to identify someone whose prescription is filled elsewhere and contact them with a sales pitch to switch.
What this means for you
If you run a Federally Qualified Health Center pharmacy
Based on this opinion, you can keep doing the operational basics: filling prescriptions for patients who choose your in-house pharmacy, providing patient education materials about pharmacy services, and offering services as part of a comprehensive primary-care visit. None of those involve "soliciting transfer."
Where the line falls: data-driven outreach. If you build a patient list from the EHR or billing data showing patients who fill at outside pharmacies, and you contact them specifically to suggest moving the prescription to your pharmacy, that is what § 17-92-413(2) prohibits. The fix is to stop the targeted-by-prescription outreach. General notification (a newsletter to all patients about pharmacy services) is fine because it is not "to solicit the transfer of the patient" identified through data mining.
Document your compliance posture. Tag your patient-outreach campaigns by data source: if outreach is triggered by a non-prescription characteristic (a new diagnosis, a routine check-up reminder), it is outside the statute. If it is triggered by knowing the patient's current pharmacy from claims data, it is at the heart of what the statute targets.
If you are a hospital, rural health center, or pharmacy benefits manager
The same statute also covers your operations. The behavior banned is narrow but specific: using patient information to contact patients and solicit pharmacy transfers. Make sure your marketing teams (and any vendor who works with claims data) understand the line.
If you are a state legislator
The opinion is a clean walk through the federal-law side: the AG identified no preemption from PHS Act, HIPAA, or Stark. That conclusion supports leaving Act 1053 in force without amendment. If a future legislature wants to broaden the restriction (for example, to bar all FQHC-pharmacy marketing, not just data-driven solicitation), the analysis would change, especially around the FQHC's federal duty to provide patient education on available services.
If you are a patient
If you've been approached by a clinic or PBM saying you should fill prescriptions at their pharmacy and they used your data to find you, that is the kind of conduct Act 1053 targets. Complaints can go to the Arkansas State Board of Pharmacy or the AG's consumer protection division.
Common questions
Q: Can my FQHC still tell me about its pharmacy at my regular appointment?
A: Yes. The opinion treats general patient education about available services as part of comprehensive care, not solicitation. A flyer in the waiting room, a verbal mention by your provider, or an explanation of the pharmacy as a service option is fine.
Q: What is the actual prohibition?
A: "Not access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy." § 17-92-413(2).
Q: Why does HIPAA not preempt this?
A: HIPAA's preemption clause says federal law supersedes contrary state law, but explicitly carves out state laws that are "more stringent" than HIPAA on privacy. A state law that further restricts how patient data may be used is more stringent, so HIPAA leaves it standing. The relevant rules are at 42 U.S.C. § 1320d-7(a)(1) and 45 C.F.R. §§ 160.202 and 160.203.
Q: Does the Stark law affect this?
A: No. Stark covers physician self-referrals for designated health services payable by Medicare or Medicaid. It does not have an express preemption clause, and the Eleventh Circuit's decision in Fresenius Medical Care Holdings, Inc. v. Tucker, 704 F.3d 935 (11th Cir. 2013), confirmed Stark does not impliedly preempt a more restrictive state law where compliance with both is possible. Same logic applies in Arkansas.
Q: What does "solicit" mean here?
A: The AG used Black's Law Dictionary's "request" or "petition" definition, citing Brock v. Townsell, 2009 Ark. 224, 309 S.W.3d 179, for the rule that statutes are construed by the ordinary and accepted meaning of their words. Asking the patient to move their prescription is solicitation. Telling them what services exist is not.
Background and statutory framework
Act 1053 of 2021 created two new code sections, Ark. Code Ann. §§ 17-92-118 and 17-92-413. The provision relevant to the AG's analysis is subsection 17-92-413(2):
A pharmacy, pharmacist, physician, employee, or entity who owns or controls, is owned or controlled by, or is under ownership or control with an insurance company, health clinic, hospital, rural health center, federally qualified health center, pharmacy benefits manager, pharmaceutical manufacturer, pharmaceutical wholesaler, or pharmacy benefits manager that provides a pharmacy benefits plan or program, including prescription drug coverage, or contracts with a third party for prescription drug services under a health benefit plan shall:
(2) Not access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy.
The federal-side context:
- Public Health Service Act § 330 (42 U.S.C. § 254b) is the funding statute for FQHCs and requires them to provide "primary health services," with patient education listed as a required primary-health-service activity.
- HIPAA (Pub. L. 104-191; rules at 45 C.F.R. Parts 160, 164) regulates use and disclosure of protected health information. The preemption framework at 42 U.S.C. § 1320d-7(a)(1) and 45 C.F.R. §§ 160.202, 160.203 expressly preserves "more stringent" state privacy laws.
- Stark law (42 U.S.C. § 1395nn) regulates physician self-referrals. It has no express preemption clause and does not impliedly preempt more restrictive state law where dual compliance is possible (Fresenius Med. Care Holdings, Inc. v. Tucker).
Citations
- Act 1053 of 2021 (creating Ark. Code Ann. §§ 17-92-118 and 17-92-413)
- Ark. Code Ann. § 17-92-413(2) (the solicitation prohibition)
- Public Health Service Act § 330, 42 U.S.C. § 254b
- 42 U.S.C. § 1396d (FQHC definition cross-reference)
- 42 U.S.C. § 1320d-7(a)(1) (HIPAA preemption)
- 45 C.F.R. §§ 160.202, 160.203 (HIPAA "more stringent" carve-out)
- 42 U.S.C. § 1395nn (Stark law)
- 42 C.F.R. Parts 51c, 491; 45 C.F.R. Part 75 (FQHC and grant regulations)
- Brock v. Townsell, 2009 Ark. 224, 309 S.W.3d 179 (statutory construction by ordinary meaning)
- Fresenius Med. Care Holdings, Inc. v. Tucker, 704 F.3d 935 (11th Cir. 2013) (Stark non-preemption)
- National Abortion Federation v. Ashcroft, 2004 WL 555701 (S.D.N.Y. 2004) (HIPAA preemption only of less stringent state laws)
Source
Original opinion text
Opinion No. 2021-046
August 20, 2021
STATE OF ARKANSAS
ATTORNEY GENERAL
LESLIE RUTLEDGE
The Honorable Aaron Pilkington
State Representative
264 Private Road 2611
Knoxville, AR 72845-8607
Dear Representative Pilkington:
This is in response to your request for an opinion regarding legislation recently
passed during the Regular Session of the 93rd General Assembly.
Your letter states that Act 1053 of 2021 is an act to require written consent of a
patient to transfer a prescription from a pharmacy, to require certain disclosures of
ownership interest or possible conflicts of interest, and to prohibit data mining of
patient information. Your request also states that Federally Qualified Health
Centers collect patient data to provide in-house services, including but not limited
to pharmacy services.
In light of the foregoing background information, you have asked the following
questions:
-
Does Act 1053 conflict with any current federal laws or requirements
regarding Federally Qualified Health Centers' obligation to provide
comprehensive health services to its patients, when it owns its own
pharmacy? -
Can a state law prohibit a Federally Qualified Health Center from
accessing its own patient data to ascertain which patients would benefit
from its pharmacy services and then notifying its patients of the same?
RESPONSE
On your first question, I have not identified any provision of federal law that would
preempt Act 1053; the answer to your question therefore appears to be no. With
respect to your second question, Act 1053 does not prohibit an FQHC from
accessing patient data and giving patients information about its pharmacy services.
Rather, FQHCs and other entities covered by the Act are only prohibited from
accessing and utilizing patient information "to market or contact patients in order
to solicit the transfer of the patient to a particular pharmacy." Thus, the activity
you mention does not fall within the scope of Act 1053.
DISCUSSION
A general overview of the applicable law may be helpful before turning to your
specific questions. The U.S. Department of Health and Human Services defines
Federally Qualified Health Centers (FQHCs) as "community-based health care
providers that receive funds from the [Health Resources & Services Administration]
Health Center Program to provide primary care services in underserved areas." In
keeping with their mission to provide comprehensive primary and preventative care
services to medically underserved populations and communities, some FQHCs
house licensed, on-site pharmacies.
The state legislation you have asked about, Act 1053, creates two new code sections,
Ark. Code Ann. §§ 17-92-118 and 17-92-413. The provision most relevant to your
inquiry is subsection 17-92-413(2), which states:
A pharmacy, pharmacist, physician, employee, or entity who owns or
controls, is owned or controlled by, or is under ownership or control
with an insurance company, health clinic, hospital, rural health center,
federally qualified health center, pharmacy benefits manager,
pharmaceutical manufacturer, pharmaceutical wholesaler, or
pharmacy benefits manager that provides a pharmacy benefits plan or
program, including prescription drug coverage, or contracts with a
third party for prescription drug services under a health benefit plan
shall:
(2) Not access and utilize patient information including either medical
information in patient charts or billing claims information to market
or contact patients in order to solicit the transfer of the patient to a
particular pharmacy.
With this general overview of the law in mind, I turn to your specific questions.
Question 1: Does Act 1053 conflict with any current federal laws or requirements
regarding Federally Qualified Health Centers' obligation to provide
comprehensive health services to its patients, when it owns its own pharmacy?
Section 330 of the Public Health Service Act is the authorizing statute for the Health
Center Program, which provides federal funding for FQHCs. Under the terms of
the statute, there are a number of requirements FQHCs must meet. One of these
requirements, which you have mentioned, is to provide comprehensive primary care
services to patients. However, in my opinion, there is no conflict between Act 1053
and Section 330 of the Public Health Service Act. Act 1053's newly created Ark.
Code Ann. § 17-92-413(2) prohibits a very specific, narrow action, that is,
"access[ing] and utiliz[ing] patient information including either medical
information in patient charts or billing claims information to market or contact
patients in order to solicit the transfer of the patient to a particular pharmacy." And
while the word, "solicit," is not defined in this context, its "ordinary and usually
accepted meaning" is to "request" or "petition." Thus, subsection 17-92-413(2)
does not interfere with an FQHC's duty to provide comprehensive care to its
patients, which would necessarily include giving patients information about any in-
house pharmacy services that may be available to them. Rather, it merely prohibits
an FQHC from accessing and utilizing patient data to contact a patient and then
requesting or petitioning the transfer of that patient to a particular pharmacy.
In addition to this authorizing legislation, FQHCs must comply with a number of
other federal regulatory and policy requirements. These include Health Center
Program regulations and grant regulations, as well as any specific award-related
requirements. However, according to my research, none of these other authorities
would require an FQHC to engage in the conduct prohibited by subsection 17-92-413(2).
With respect to other federal statutes, there are a couple of laws whose subject
matter may overlap with that of Act 1053. One is the Health Insurance Portability
and Accountability Act of 1996 ("HIPAA") and its rules, which, inter alia, regulate
the use and disclosure of protected health information by certain covered entities.
Although HIPAA contains a preemption provision stating that the statute and its
regulations "shall supersede any contrary provision of State law," there is an
exception if the state law "relates to the privacy of individually identifiable health
information and is more stringent" than HIPAA's requirements. In other words,
HIPAA provides a floor of privacy protection, not a ceiling. Thus, a state statute
such as Ark. Code Ann. § 17-92-413(2), which restricts the access and utilization of
patient information for the purposes of marketing or contacting the patient in order
to solicit the transfer of the patient to a particular pharmacy, is not preempted by
HIPAA.
The second related federal law is the Physician Self-Referral Law (commonly
referred to as "the Stark law" or "Stark"). The Stark law is a strict-liability statute
that, with some exceptions, generally prohibits physicians from referring patients to
entities for certain "designated health services" payable by Medicare or Medicaid if
the physician or an immediate family member has a financial relationship with the
entity. Unlike HIPAA, Stark does not contain an express preemption clause. And
Stark does not impliedly preempt a more restrictive state law if it is possible to
comply with both state and federal laws and the state law does not frustrate the
purposes of Stark. Thus, Stark would not serve as a barrier to implementation of
subsection 17-92-413(2) either.
Therefore, Act 1053's prohibition of certain conduct, as set forth in Ark. Code Ann.
§ 17-92-413(2), does not appear to conflict with federal law.
Question 2: Can a state law prohibit a Federally Qualified Health Center from
accessing its own patient data to ascertain which patients would benefit from its
pharmacy services and then notifying its patients of the same?
The activity your second question contemplates does not fall within the scope of
conduct prohibited by Act 1053. Therefore, an answer to your question as written
is not necessary. As discussed above, subsection 17-92-413(2) simply states that
the enumerated entities may not "access and utilize patient information including
either medical information in patient charts or billing claims information to market
or contact patients in order to solicit the transfer of the patient to a particular
pharmacy." Thus, as applicable to your question, an FQHC could not access its
patients' data and then use that data to contact those patients and attempt to persuade
them to transfer their prescriptions to the FQHC's in-house pharmacy (or any other
pharmacy). However, there is nothing in the statute that prevents an FQHC from
simply providing its patients with information about the FQHC's in-house
pharmacy services.
Sincerely,
LESLIE RUTLEDGE
Attorney General
Get today's answer for your situation
You just read a 2021 opinion on this question. Ezel checks the current Arkansas statutes and case law and answers your specific situation, with citations.
Opens in Ezel Pro. Every answer cites the law it relies on.