Does Arkansas Act 1053 of 2021, which bans pharmacy steering using patient data, conflict with federal law for Federally Qualified Health Centers, and can FQHCs still tell patients about in-house pharmacy services?

Plain-English summary

Arkansas Act 1053 of 2021 made it illegal for certain healthcare entities, including Federally Qualified Health Centers (FQHCs), to "access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy." A state representative asked whether this restriction conflicted with federal law for FQHCs (which receive federal funding under the Public Health Service Act and have a federal duty to provide comprehensive primary care), and whether the law would block an FQHC from looking at patient data to figure out who could benefit from its in-house pharmacy and then telling those patients.

Attorney General Leslie Rutledge said no on both counts. The Arkansas statute bans a specific behavior, soliciting a transfer of a particular pharmacy patient. It does not ban an FQHC from informing its patients about in-house services as part of comprehensive care, which is what FQHCs are federally required to do.

On preemption: nothing in Public Health Service Act § 330, the FQHC grant regulations, HIPAA, or the Stark physician-self-referral law preempts the Arkansas restriction. HIPAA explicitly leaves room for stricter state privacy laws. Stark has no express preemption clause and does not impliedly preempt a more restrictive state law as long as compliance with both is possible. The Arkansas law is more restrictive in a way that fits cleanly inside that gap.

So an FQHC can still: provide patient education about in-house pharmacy options, fill prescriptions in-house when a patient walks in, and share information about what services are available. What it cannot do: mine patient records to identify someone whose prescription is filled elsewhere and contact them with a sales pitch to switch.

What this means for you

If you run a Federally Qualified Health Center pharmacy

Based on this opinion, you can keep doing the operational basics: filling prescriptions for patients who choose your in-house pharmacy, providing patient education materials about pharmacy services, and offering services as part of a comprehensive primary-care visit. None of those involve "soliciting transfer."

Where the line falls: use of patient information to solicit a pharmacy transfer. If you use chart or billing data to contact patients and ask them to move their prescriptions to your pharmacy, that is what § 17-92-413(2) prohibits. The opinion permits giving patients information about in-house pharmacy services without asking them to transfer their prescriptions.

Review the purpose and content of patient outreach. The opinion does not create an exception based on whether a diagnosis, appointment reminder, or prescription record triggered contact. Its statutory analysis turns on using patient information to contact patients in order to solicit a transfer to a particular pharmacy.

If you are a hospital, rural health center, or pharmacy benefits manager

The same statute also covers your operations. The behavior banned is narrow but specific: using patient information to contact patients and solicit pharmacy transfers. Make sure your marketing teams (and any vendor who works with claims data) understand the line.

If you are a state legislator

The AG identified no conflict with the federal laws examined: the Public Health Service Act, HIPAA, and Stark. The opinion addresses Act 1053 as written and does not evaluate a broader restriction.

If you are a patient

If a covered entity uses your patient information to contact you and ask you to transfer a prescription to a particular pharmacy, that is the conduct the AG identified as prohibited. The opinion does not address complaint procedures.

Common questions

Q: Can my FQHC still tell me about its pharmacy at my regular appointment? A: Yes. The opinion treats general patient education about available services as part of comprehensive care, not solicitation. A flyer in the waiting room, a verbal mention by your provider, or an explanation of the pharmacy as a service option is fine.

Q: What is the actual prohibition?
A: "Not access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy." § 17-92-413(2).

Q: Why does HIPAA not preempt this?
A: HIPAA's preemption clause says federal law supersedes contrary state law, but explicitly carves out state laws that are "more stringent" than HIPAA on privacy. A state law that further restricts how patient data may be used is more stringent, so HIPAA leaves it standing. The relevant rules are at 42 U.S.C. § 1320d-7(a)(1) and 45 C.F.R. §§ 160.202 and 160.203.

Q: Does the Stark law affect this?
A: No. Stark covers physician self-referrals for designated health services payable by Medicare or Medicaid. It does not have an express preemption clause, and the Eleventh Circuit's decision in Fresenius Medical Care Holdings, Inc. v. Tucker, 704 F.3d 935 (11th Cir. 2013), confirmed Stark does not impliedly preempt a more restrictive state law where compliance with both is possible. Same logic applies in Arkansas.

Q: What does "solicit" mean here?
A: The AG used Black's Law Dictionary's "request" or "petition" definition, citing Brock v. Townsell, 2009 Ark. 224, 309 S.W.3d 179, for the rule that statutes are construed by the ordinary and accepted meaning of their words. Asking the patient to move their prescription is solicitation. Telling them what services exist is not.

Background and statutory framework

Act 1053 of 2021 created two new code sections, Ark. Code Ann. §§ 17-92-118 and 17-92-413. The provision relevant to the AG's analysis is subsection 17-92-413(2):

A pharmacy, pharmacist, physician, employee, or entity who owns or controls, is owned or controlled by, or is under ownership or control with an insurance company, health clinic, hospital, rural health center, federally qualified health center, pharmacy benefits manager, pharmaceutical manufacturer, pharmaceutical wholesaler, or pharmacy benefits manager that provides a pharmacy benefits plan or program, including prescription drug coverage, or contracts with a third party for prescription drug services under a health benefit plan shall:

(2) Not access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy.

The federal-side context:

• Public Health Service Act § 330 (42 U.S.C. § 254b) is the funding statute for FQHCs and requires them to provide "primary health services," with patient education listed as a required primary-health-service activity.
• HIPAA (Pub. L. 104-191; rules at 45 C.F.R. Parts 160, 164) regulates use and disclosure of protected health information. The preemption framework at 42 U.S.C. § 1320d-7(a)(1) and 45 C.F.R. §§ 160.202, 160.203 expressly preserves "more stringent" state privacy laws.
• Stark law (42 U.S.C. § 1395nn) regulates physician self-referrals. It has no express preemption clause and does not impliedly preempt more restrictive state law where dual compliance is possible (Fresenius Med. Care Holdings, Inc. v. Tucker).

Citations

• Act 1053 of 2021 (creating Ark. Code Ann. §§ 17-92-118 and 17-92-413)
• Ark. Code Ann. § 17-92-413(2) (the solicitation prohibition)
• Public Health Service Act § 330, 42 U.S.C. § 254b
• 42 U.S.C. § 1396d (FQHC definition cross-reference)
• 42 U.S.C. § 1320d-7(a)(1) (HIPAA preemption)
• 45 C.F.R. §§ 160.202, 160.203 (HIPAA "more stringent" carve-out)
• 42 U.S.C. § 1395nn (Stark law)
• 42 C.F.R. Parts 51c, 491; 45 C.F.R. Part 75 (FQHC and grant regulations)
• Brock v. Townsell, 2009 Ark. 224, 309 S.W.3d 179 (statutory construction by ordinary meaning)
• Fresenius Med. Care Holdings, Inc. v. Tucker, 704 F.3d 935 (11th Cir. 2013) (Stark non-preemption)
• National Abortion Federation v. Ashcroft, 2004 WL 555701 (S.D.N.Y. 2004) (HIPAA preemption only of less stringent state laws)

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2021-046
August 20, 2021
STATE OF ARKANSAS
ATTORNEY GENERAL
LESLIE RUTLEDGE
The Honorable Aaron Pilkington
State Representative
264 Private Road 2611
Knoxville, AR 72845-8607
Dear Representative Pilkington:

This is in response to your request for an opinion regarding legislation recently passed during the Regular Session of the 93rd General Assembly.

Your letter states that Act 1053 of 2021 is an act to require written consent of a patient to transfer a prescription from a pharmacy, to require certain disclosures of ownership interest or possible conflicts of interest, and to prohibit data mining of patient information. Your request also states that Federally Qualified Health Centers collect patient data to provide in-house services, including but not limited to pharmacy services.

In light of the foregoing background information, you have asked the following questions:

1. Does Act 1053 conflict with any current federal laws or requirements
   regarding Federally Qualified Health Centers' obligation to provide comprehensive health services to its patients, when it owns its own pharmacy?

2. Can a state law prohibit a Federally Qualified Health Center from
   accessing its own patient data to ascertain which patients would benefit from its pharmacy services and then notifying its patients of the same?

RESPONSE

On your first question, I have not identified any provision of federal law that would preempt Act 1053; the answer to your question therefore appears to be no. With respect to your second question, Act 1053 does not prohibit an FQHC from accessing patient data and giving patients information about its pharmacy services. Rather, FQHCs and other entities covered by the Act are only prohibited from accessing and utilizing patient information "to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy." Thus, the activity you mention does not fall within the scope of Act 1053.

DISCUSSION

A general overview of the applicable law may be helpful before turning to your specific questions. The U.S. Department of Health and Human Services defines Federally Qualified Health Centers (FQHCs) as "community-based health care providers that receive funds from the [Health Resources & Services Administration] Health Center Program to provide primary care services in underserved areas." In keeping with their mission to provide comprehensive primary and preventative care services to medically underserved populations and communities, some FQHCs house licensed, on-site pharmacies.

The state legislation you have asked about, Act 1053, creates two new code sections, Ark. Code Ann. §§ 17-92-118 and 17-92-413. The provision most relevant to your inquiry is subsection 17-92-413(2), which states:

A pharmacy, pharmacist, physician, employee, or entity who owns or controls, is owned or controlled by, or is under ownership or control with an insurance company, health clinic, hospital, rural health center, federally qualified health center, pharmacy benefits manager, pharmaceutical manufacturer, pharmaceutical wholesaler, or pharmacy benefits manager that provides a pharmacy benefits plan or program, including prescription drug coverage, or contracts with a third party for prescription drug services under a health benefit plan shall:

(2) Not access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy.

With this general overview of the law in mind, I turn to your specific questions.

Question 1: Does Act 1053 conflict with any current federal laws or requirements regarding Federally Qualified Health Centers' obligation to provide comprehensive health services to its patients, when it owns its own pharmacy?

Section 330 of the Public Health Service Act is the authorizing statute for the Health Center Program, which provides federal funding for FQHCs. Under the terms of the statute, there are a number of requirements FQHCs must meet. One of these requirements, which you have mentioned, is to provide comprehensive primary care services to patients. However, in my opinion, there is no conflict between Act 1053 and Section 330 of the Public Health Service Act. Act 1053's newly created Ark. Code Ann. § 17-92-413(2) prohibits a very specific, narrow action, that is, "access[ing] and utiliz[ing] patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy." And while the word, "solicit," is not defined in this context, its "ordinary and usually accepted meaning" is to "request" or "petition." Thus, subsection 17-92-413(2) does not interfere with an FQHC's duty to provide comprehensive care to its patients, which would necessarily include giving patients information about any in- house pharmacy services that may be available to them. Rather, it merely prohibits an FQHC from accessing and utilizing patient data to contact a patient and then requesting or petitioning the transfer of that patient to a particular pharmacy.

In addition to this authorizing legislation, FQHCs must comply with a number of other federal regulatory and policy requirements. These include Health Center Program regulations and grant regulations, as well as any specific award-related requirements. However, according to my research, none of these other authorities would require an FQHC to engage in the conduct prohibited by subsection 17-92-413(2).

With respect to other federal statutes, there are a couple of laws whose subject matter may overlap with that of Act 1053. One is the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its rules, which, inter alia, regulate the use and disclosure of protected health information by certain covered entities. Although HIPAA contains a preemption provision stating that the statute and its regulations "shall supersede any contrary provision of State law," there is an exception if the state law "relates to the privacy of individually identifiable health information and is more stringent" than HIPAA's requirements. In other words, HIPAA provides a floor of privacy protection, not a ceiling. Thus, a state statute such as Ark. Code Ann. § 17-92-413(2), which restricts the access and utilization of patient information for the purposes of marketing or contacting the patient in order to solicit the transfer of the patient to a particular pharmacy, is not preempted by HIPAA.

The second related federal law is the Physician Self-Referral Law (commonly referred to as "the Stark law" or "Stark"). The Stark law is a strict-liability statute that, with some exceptions, generally prohibits physicians from referring patients to entities for certain "designated health services" payable by Medicare or Medicaid if the physician or an immediate family member has a financial relationship with the entity. Unlike HIPAA, Stark does not contain an express preemption clause. And Stark does not impliedly preempt a more restrictive state law if it is possible to comply with both state and federal laws and the state law does not frustrate the purposes of Stark. Thus, Stark would not serve as a barrier to implementation of subsection 17-92-413(2) either.

Therefore, Act 1053's prohibition of certain conduct, as set forth in Ark. Code Ann.
§ 17-92-413(2), does not appear to conflict with federal law.

Question 2: Can a state law prohibit a Federally Qualified Health Center from accessing its own patient data to ascertain which patients would benefit from its pharmacy services and then notifying its patients of the same?

The activity your second question contemplates does not fall within the scope of conduct prohibited by Act 1053. Therefore, an answer to your question as written is not necessary. As discussed above, subsection 17-92-413(2) simply states that the enumerated entities may not "access and utilize patient information including either medical information in patient charts or billing claims information to market or contact patients in order to solicit the transfer of the patient to a particular pharmacy." Thus, as applicable to your question, an FQHC could not access its patients' data and then use that data to contact those patients and attempt to persuade them to transfer their prescriptions to the FQHC's in-house pharmacy (or any other pharmacy). However, there is nothing in the statute that prevents an FQHC from simply providing its patients with information about the FQHC's in-house pharmacy services.

Sincerely,
LESLIE RUTLEDGE
Attorney General