Post by: Justin Samuel and Qianqian Zhao
There is a commercial market for data about which prescription medications have been prescribed and by whom. In a practice known as “physician detailing,” pharmacies in the United States sell this information to data mining companies who in turn sell their data and additional analysis to drug companies. Drug companies use this information in order to more effectively market their products to individual doctors.
In order to be compliant with federal law, pharmacies “de-identify” the patient information. De-identification is performed by removing information such as the patient’s name from the prescription records. A unique identifier (e.g. 39148) is then assigned to each patient. The patient identifier allows a single patient’s prescription history to be linked together without their name, though the identity of the prescriber remains intact. The way in which the data is de-identified still allows a purchaser of the information to know that, for example, “a 50-year-old woman who lives in Central Vermont; has prescriptions filled in Montpelier; [and] is a patient of Dr. Jones in Montpelier . . . regularly takes an antidepressant and a cholesterol-lowering drug” [Vermont brief]. The de-identified data thus allows correlating records based on patient identifier, product, prescriber, and pharmacy. Pharmacies sell this information without the consent of prescribers (e.g. doctors, nurse practitioners, etc.) or patients.
This practice of selling a patient’s prescription information creates serious privacy concerns for patients and doctors. Medical information is highly sensitive personal data and many believe the sale of this prescription data should be prohibited. Compounding the ethical concern is the possibility that the de-identified patients can later be re-identified.
Recognizing the severity of these privacy problems as well as raising additional concerns about the increased health care costs associated with the usage of this data for marketing, multiple states have regulated or prohibited the commercial sale of prescription information. However, the states have been met with a fight. The drug companies and data miners that profit off of the commercial usage of this information are a powerful force that consistently challenge state regulatory laws. These companies claim that prescription information is protected speech under the First Amendment and that these laws discriminate against certain types of companies.
One of these cases has recently gone before the Supreme Court.
Sorrell v. IMS Health
In 2007, the Vermont legislature passed a law which prohibits the sale and use of data that identifies the prescriber when a) the data is is used for marketing of prescription drugs, and b) the prescriber did not consent to the use of the data.
Before the law took effect, IMS Health, a pharmaceutical data mining company, filed suit against Vermont. IMS Health claimed that the Vermont law violated their constitutionally protected right to free speech. As commercial speech can be regulated, IMS Health asserted that the information itself is noncommercial regardless of how the information is used. Thus, regulating the exchange of this information based on specific ways it could be used was not only restricting free speech but also targeting a speech restriction at a specific group whose message the state of Vermont did not like.
Further, the data-mining companies argued that “neither pharmacies nor [data miners] publish prescriber information solely for their economic interests. They publish this information because they believe it substantially improves public health by allowing for the detection of prescription practices that are not in the best interest of patients and the efficient distribution of information to prescribers concerning best prescription practices. Indeed, plaintiffs perform the same historic function as newspapers.” (emphasis added)
The District Court upheld the Vermont law. The court found that the speech of releasing prescriber-identifiable information was not protected by the First Amendment because it was commercial speech. Therefore, according to Central Hudson, it can be regulated if regulation supports a substantial government interest, directly advances that interest, and is not more extensive than necessary. However, the District Court did not find the prescriber privacy arguments sufficient to justify the law. Rather, the court felt that Vermont’s other reasons for enacting the law—promoting public health and containing state health care costs—were substantial state interests.
IMS Health appealed. The Court of Appeals overturned the District Court’s decision and struck down the law. The Court of Appeals asserted that the Vermont law did not protect physician privacy because it still allowed the data to be used in most circumstances (just not for marketing), that the state’s claimed interest in medical privacy is too speculative to qualify as a substantial state interest, and that there is no evidence that the use of this data damages doctor-patient relationships due to the privacy concerns of patients.
Vermont petitioned the Supreme Court and the Court agreed to hear the case this year. In a 6-3 decision, the Supreme Court upheld the Court of Appeals’ decision, thus striking down Vermont’s law. The Supreme Court considered this a free speech issue and found that the Vermont law violated IMS Health’s First Amendment rights. The Court stated that “the creation and dissemination of information are speech for First Amendment purposes.” However, the Court also said that “the State might have advanced its asserted privacy interest by allowing the information’s sale or disclosure in only a few narrow and well-justified circumstances. A statute of that type would present quite a different case than the one presented here.”
Discussion
The Supreme Court’s decision in Sorrell v. IMS Health helps define what is considered free speech with respect to commercial data transfer and commercial speech. Additionally, this case raises many interesting questions.
Clearly, a primary question is when should commercial information exchange be considered fully-protected speech? However, a more subtle and possibly more fundamental question exists that is only hinted at by the majority opinion of the Supreme Court: “the creation and dissemination of information are speech for First Amendment purposes.” The Supreme Court seems to have assumed that prescription information collected by pharmacies is also created by pharmacies. Do the pharmacies really create the prescription information? Would it be more accurate to say that prescription information is created by the prescriber?
What implications does this case have for the commercial sale and usage of other personal information which certain companies are in a privileged position to acquire? The Supreme Court’s dissenting opinion did point out that “Vermont’s statute is directed toward information that exists only by virtue of government regulation. Under federal law, certain drugs can be dispensed only by a pharmacist operating under the orders of a medical practitioner.” Thus, not only is there a question of where information is actually created, there is also the question of whether information that only exists because of governmental regulation can itself be regulated.
The risk of patient re-identification was not a factor in any of the courts’ decisions. This is despite the issue having been discussed at length in various friend of the court briefs. In their brief, the EFF discussed that the combination of large amounts of processing power along with the existence of external data (e.g. public records, hospital discharge databases, and demographic information) that can be combined with de-identified data poses substantial risk of re-identification.
The EFF further stated that “‘[h]igh-dimensional’ data—data with many possible values—is especially useful because it reduces the likelihood that individuals are similar. … A total prescription history that includes purchase dates is highly likely to be unique.” Based on this risk of re-identification and on the apparent violation of doctor-patient confidentiality, patient trust may be undermined. This raises a concern similar to the chilling effect on readers when an individual’s book reading history is collected and shared without the individual’s consent, a concern raised by Privacy Authors And Publishers with respect to lack of reader privacy guarantees in the proposed settlement for Authors Guild, Inc., et al. v. Google Inc.
During oral arguments in Sorrell v. IMS Health, Supreme Court Justice Breyer pondered whether the FTC can regulate the marketing use of prescription information as an issue of potentially deceptive practices. Justice Breyer posed the following hypothetical question: “suppose that the Federal Trade Commission… finds… that when drugs are sold to doctors it is very important that the doctor find out what’s curable, what the drug does, how much it costs; and by the way, all those things apply no matter who the doctor is. Who the doctor is, is irrelevant. And therefore marketing that focuses upon who the doctor is and what his previous practices were is irrelevant and harmful and false; and therefore we find that it is a false and deceptive practice under section 5 of the Federal Trade Commission Act to use the following prior practices of the doctor in selling him new drugs, because it’s irrelevant and because it’s false and because it’s harmful. And they enact that as a — as a rule of the Federal Trade Commission. Does the Constitution of the United States forbid them, having made those findings in detail, from controlling advertising to prevent what they have determined is a false and misleading practice?”
The Supreme Court’s decision in this case may indicate a transfer of commerce regulating power from legislatures and regulatory bodies to the courts. The more willing the courts are to categorize commercial information not as commodities but as speech that is fully protected by the First Amendment, the less ability regulators have to ensure that commercial data transfer serves the interests of society.
Elsewhere, the Prescription Confidentiality Act was passed in New Hampshire in 2006, which prohibited prescription information records containing “patient or prescriber-identifiable data from being transferred, licensed, sold, or used for most commercial purposes.” In Maine, a similar law banned the sale of prescription information. Comparable arguments about free speech vs. state interests were made in the ensuing lawsuits.
Further information and opinions on Sorrell v. IMS Health:
https://epic.org/privacy/ims_sorrell
https://www.eff.org/cases/sorrell-v-ims-health
http://blogs.law.harvard.edu/infolaw/2011/06/23/sorell-ims-decision/