The buying and selling of information about the prescribing practices of physicians may be the next health care privacy battleground, as evidenced in a New Hampshire federal district court decision handed down in April 2007. The District Court held unconstitutional a state law which banned the sale and use of prescription and prescriber data. The court ruled that the law was an improper restriction under the First Amendment on commercial speech. The issue is not finally resolved, however; the New Hampshire Attorney General says she will appeal the decision.
While most health care professionals and their patients are well versed now on the rules protecting the privacy of patients’ health information, courtesy primarily of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing privacy regulations, the concept of privacy protection for prescriptions written by physicians and other prescribers is new. At issue is whether prescribers have any protected privacy interest in information which identifies them and the drugs they prescribe.
The New Hampshire federal court in IMS Health Incorporated v. Ayotte addresses practices engaged in by so-called data mining companies (in particular IMS and Verispan, LLC) which were the impetus for New Hampshire’s Prescription Information Law, signed into law on June 30, 2006. This Law prohibits the licensing, transfer, use, or sale for certain commercial purposes of prescription records containing patient-identifiable and prescriber-identifiable data. (The restriction on transmission and use of patient-identifiable information were not the subject of the lawsuit.). The Law defines “commercial purpose” to include advertising, marketing, promotion or any activity which could be used to influence sales or market share of a pharmaceutical product, to influence or evaluate prescribing behavior of a health care professional, or evaluate the effectiveness of a pharmaceutical company’s detailing sales representatives. Transmitting or using the data for law enforcement, research, educational, compliance review, or other non-commercial purposes were not restricted.
Data mining
To understand the basis for the Law and the subsequent litigation, some background on the practice of prescription data mining is useful. Data mining companies buy prescription data from pharmacies and other sources (including the drug name, dosage prescribed and the identity of the prescriber) and combine it with physicians’ demographic and other professional data (including the prescriber’s name, address, specialty, and license number). Using this data, the companies link specific individual physicians with their prescription information in a profile of their prescribing practices. Information which identifies patients is removed from the prescription data. The profiles are sold to pharmaceutical companies which use them to market their brand-name drugs to the physicians.
Prescriber privacy
Of particular interest in the context of “prescriber privacy,” the New Hampshire Attorney General argued to the Court that the Prescription Information Law is a permissible restriction on commercial speech, since it promotes public health. The “prescriber privacy” argument was based on the State’s interest in protecting the decision-making process of prescribers from manipulation by pharmaceutical manufacturers and in shielding the doctor-patient relationship from intrusion. The Court rejected this argument. While accepting the State’s premise that pharmaceutical companies use prescriberidentifiable data to make their marketing more persuasive, the Court did not agree that this undermined the public health. Since the Attorney General had not argued that the information furnished by sales representatives about their drugs was false or misleading, the Court concluded that health care providers, being highly trained professionals, are more able than the general public to evaluate these “truthful pharmaceutical marketing messages” and did not need to be shielded from sales techniques which “enhance the effectiveness of truthful and non-misleading marketing information”.
Other legislative actions and industry initiatives
New Hampshire’s Prescription Information Law is the first ban on data mining of prescription data, but it is by no means the only recent legislative action addressing prescription data confidentiality. According to the National Conference of State Legislatures, legislation has been introduced this year to directly prohibit sale or transfer of prescription information to third parties in more than ten states, including California, Illinois, Maryland, Massachusetts, New York, Texas, and West Virginia. Among these bills, some restrict such activities for prescription information containing prescriber-identifiable data (Illinois, Maryland, Nevada, New York, Texas, and West Virginia) and some have adopted similar language to that used in the New Hampshire Law. None of these legislative initiatives have been adopted. Other proposed state legislation addresses detailing, by requiring pharmaceutical manufacturers to disclose benefits which they provide to prescribers (including Hawaii, Illinois, Massachusetts, Mississippi, Nevada, Ohio, Oregon, Washington, Wisconsin). Legislation proposed in Oklahoma would require registration of pharmaceutical sales representatives. There has been no legislative activity in Kentucky on prescription data mining.
Other initiatives have been taken outside state legislatures. In California, a pilot program by the California Medical Association (CMA) has been negotiated by the CMA, the AMA, and IMS. It establishes an opt out mechanism for physicians to choose whether they will permit access by pharmaceutical companies to their specific data.
Another opt-out program is the Physician Data Restriction Program (PDRP) started by the AMA in 2006, which permits physicians to opt out of having their prescribing data released to pharmaceutical company representatives. Pharmaceutical companies must check the opt-out lists at least quarterly and have ninety days to comply with the request. The AMA enforces the terms of the PDRP through its license agreements with the data mining companies. Additionally, physicians may report specific instances of inappropriate behavior by pharmaceutical sales representatives or companies.
A new privacy right?
Laws such as New Hampshire’s and similar legislation proposed in other states are introducing the concept of a privacy interest in prescriber data apart from privacy rights accorded to patient-identifiable data. This privacy interest belongs to the prescribing professional, not the patient, and is limited, at least in many of the proposed bills, to protecting the profile which identifies individual prescribers with the prescriptions they write; individual practitioners’ personal information (demographics, practice specialty and so forth) alone is not protected.
The initial success of IMS and Verispan in the recent New Hampshire court case may ultimately prove to be a pivotal point in the establishment of a privacy right for prescriber-identifiable data as physicians, patients, payors and legislators become aware of the uses made of mined data by pharmaceutical companies and possible costs associated with these uses. Whether the Court’s decision in New Hampshire will affect similar legislative efforts elsewhere remains to be seen. The appeal of the IMS Health Incorporated decision will provide a new opportunity for prescriber privacy to be analyzed and discussed on a national stage. The effectiveness of the opt-out programs now in use may be an additional factor in the development of a right of privacy for prescribers.