Is “Data Mining” of Prescription and Patient Records Protected By the First Amendment?

A year ago, I wrote about how pharmaceutical companies are increasingly paying third parties like IMS Health or CVS-Caremark to provide them with the prescribing records and identification information for individual doctors. Armed with this information, drug companies—sometimes taking on the role of “concerned experts”—can tailor their marketing directly to these doctors; visiting their offices and sending them letters and informational material suggesting that they use a different (usually newer and more expensive) medication for certain patients or suggest that they adjust dosages. 

This practice, called data-mining, is a highly lucrative business (In 2005, data mining provided IMS alone with revenues of $1.75 billion) that is rapidly replacing direct-to-consumer advertising as the preferred form of pharmaceutical marketing. Data miners will have an even easier time amassing the information they sell to companies as more physicians and practices adopt electronic health records. Prescribing information about patients is coming from other sources too: Websites designed to help patients connect with others suffering from the same disease (breast cancer, Parkinson’s disease, fibromyalgia, etc.) have also started selling information about which medications their members use to drug companies. And even the American Medical Association is in on the game; last year the group garnered $44 million in profits by selling physician profile information that data miners like IMS use to blend with prescribing records to help drug companies target individual doctors.

As this field has been expanding, so have the legal challenges. New Hampshire, Maine and Vermont passed laws in 2007 that prevent the sale or transmission of doctor’s prescribing information without the express consent of the prescribing physician. New Hampshire’s law was upheld by a federal appeals court in 2008 after data mining firms filed suit claiming that the law represented a constitutional challenge to free speech. In this case, IMS vs. Ayotte, the court ruled that the state’s Prescription Information Law regulates conduct, not free speech. In their decision, the majority writes ; “this is a situation in which information itself has become a commodity. The plaintiffs, who are in the business of harvesting, refining, and selling this commodity, ask us in essence to rule that because their product is information instead of, say, beef jerky, any regulation constitutes a restriction of speech. We think that such an interpretation stretches the fabric of the First Amendment beyond any rational measure."

Maine’s law has also been upheld; most recently by the First Circuit Court this past August. In this case, the court also ruled that “the statute regulates conduct, not speech,” but added that, “even if it regulates commercial speech, that regulation satisfies constitutional standards.” The reason: The court found that prescriber information was used almost solely for marketing purposes. “During their one-on-one visits to prescribers, detailers distribute upwards of $1 million worth of free product samples per year, along with branded promotional materials and pamphlets about the different conditions their particular products can be used to treat. Detailers use prescriber-identifying data to do these things more effectively; every sales pitch can be tailored to what the detailer knows of the prescriber based on her prescribing history. The central objective is to get prescribers to adopt the pharmaceutical product the detailer is marketing and to build brand loyalty. This goal is not only explicit; it is how detailers earn bonuses.”

Unfortunately, the issue of data mining is far from settled. On Nov. 23, Vermont’s law, which prohibits both pharmacies and data-mining firms from selling prescription drug information (including name and address of prescriber, which drugs they prescribe, dosages, where the prescription is filled and the gender and age of patients) for commercial marketing purposes, was ruled unconstitutional on free speech grounds by a federal appeals court in New York. The Vermont law, like the statutes in Maine and New Hampshire, was challenged by three health care research firms who conduct data mining—IMS Health, SDI (parent company of Verispan), Wolters Kluwer Health—as well as by the PhRMA trade group. In this latest decision (which was 2-1), the majority found that the state did not provide evidence that data mining of prescriber information has had “any effect on the integrity of the prescribing process or the trust patients have in their doctors.” They added, "the state’s asserted interest in medical privacy is too speculative to qualify as a substantial state interest" and "The state has not demonstrated that its interests in protecting public health and containing health care costs could not be as well served by a more limited restriction on speech."

According to the Washington Post:  “Vermont officials say drug companies were using the information as a ‘covert marketing tool’ and believe that restricting it helps protect medical privacy, control health care costs by promoting generic drugs and improve public health.”

But the data mining companies countered that this kind of information about doctor prescribing habits actually promotes public health by allowing companies to conduct post-market surveillance of their drugs, helping them monitor the safety of new medications and measure treatment outcomes. They see the detailing process as educational for doctors who might not be up-to-date on the best treatment options for their patients.

"These types of laws [like Vermont’s data mining ban] do nothing to advance public health and in fact pose a risk to patients by arbitrarily delaying information on new medicine or warnings on existing medicines," Harvey Ashman, senior vice president and general counsel for IMS Health told the Post.

Several other states, including Hawaii, Maryland, Massachusetts, Nevada, New York, Washington, and the District of Columbia, have introduced legislation to limit prescriber and patient data mining. And now that clashing appellate decisions have been handed down in three states, the odds are better that the issue will end up in the Supreme Court. Last March, IMS Health and SDI filed a petition asking the Supreme Court to review the New Hampshire appeals court decision to uphold the Prescription Confidentiality Act. Other health-marketing firms filed a friend-of-the-court brief concurring with IMS and SDI's request for a review. Meanwhile the Electronic Privacy Information Center (EPIC) and 16 other experts in privacy and technology filed their own “friend-of-the-court” brief supporting New Hampshire’s law. In June the Supreme Court refused to hear the health-marketers challenge, but now that Vermont's law has been struck down, the Court might reconsider. 

Meanwhile, a similar legal showdown is ramping up over the issue of data-mining and other non-transparent health marketing practices that popular websites like Google, Everyday Health and WebMD use to collect personal information about patients, their health issues, and the medications they take. On November 23 (the same date as the Vermont decision), several consumer and privacy advocates including the Center for Digital Democracy, U.S. PIRG, Consumer Watchdog and the World Privacy Forum, filed a complaint with the Federal Trade Commission citing serious concerns about data mining and patient-profiling techniques used by these on-line health sites.
According to the complaint; “A far-reaching complex of health marketers has unleashed an arsenal of techniques to track and profile consumers, including so-called medical ‘condition targeting,’ to eavesdrop on their online discussions via social media data mining; to collect data on their actions through behavioral targeting; to use viral and so-called 'word-of-mouth' techniques online to drive interest in prescriptions, over-the counter drugs; and health remedies…”

The groups go on to charge that much of the Web's health marketing system, which will spend nearly $1 billion this year, is "deliberately structured" to collect personal information.

The privacy and public health concerns surrounding this issue cannot be overstated. Surveys estimate that 60-80% of Americans have used the internet to access health information; a percentage that rivals the portion of Americans who get health information from physicians. Health marketers can create extensive profiles of these on-line visitors (name, address, age, what stage of a disease they are at, which medications they take and even contact information on their doctors) to help drug companies tailor their marketing of new drugs and treatments to an individual patient's particular condition. Because of a lack of transparency, most consumers do not realize this data is being collected and many do not realize that that the disease-specific information they receive is marketing material. They may end up seeking drugs and treatment that they don’t need or that is more expensive than their current prescriptions.

The complaint also alleges that “Health consumers are being told that by using digital media services they have become empowered 'E-patients,' but they are not being informed about the privacy and potential health risks connected with the use of digital marketing of pharmaceuticals and health products.”

In one particularly egregious example, the website Everyday Health is “engaged in research” whose goal is to promote the use of brand-name pharmaceuticals to treat teen and adolescent depression. On-line health marketers use surveys filled out by parents and other caregivers to gather data on “fears and concerns” and “specific medications used” by their depressed teens or adolescents. They then use digital marketing strategies including “sequential messaging” to try and sell these often-desperate parents on brand-name drugs. This kind of approach represents deceptive marketing at its worst: Using deceitful techniques to take advantage of vulnerable consumers.

The problem is that this kind of marketing is becoming increasingly attractive to Big Pharma. It is clear that data mining—of both prescription records and on-line health sites—is a profitable and fast-growing industry. We may want to believe that filling a prescription at the pharmacy or surfing the web for health information are private activities, but it turns out that this couldn’t be farther from the truth. Our personal profiles, health information, and other details of our lives that we would like to keep confidential are currently fair game for health marketers. This is fundamentally wrong and invoking the Constitutional protection of free speech to justify such data-mining is, as several courts have found, unsupportable.

Prescriber privacy laws like those in Maine, New Hampshire and Vermont are important safeguards against data-mining and the resulting over-reaching sales tactics of drugs companies and other health marketers. These practices have little redeeming value; annoying doctors, leading to increased health care costs and sometimes promoting improper care. As other states pass similar laws and challenges work their way up through the legal system, this issue—as well as future restrictions on website data mining—may ultimately be decided by the Supreme Court.

9 thoughts on “Is “Data Mining” of Prescription and Patient Records Protected By the First Amendment?

  1. IMO, don ‘t get your hopes up that privacy issues will trump the desires of big business before the conservatives on the current Supreme Ct!

  2. Halfway down the slippery slope…
    Seems the next logical step in the digital era is linking specific drugs to specific individual targets. For example, someone with Medical Issue A just *happens* to see an advertisement in the Google or Facebook sidebar for Drug X which also just *happens* to be just what the person needs. Gee, what a co-incidence, no?
    Companies would argue, of course, that no one individual knows anything about any other particular individual since everything is jumbled data bits in a cyber basket. If no one knows anything about anyone then what’s the problem? **rolling eyes**
    And besides, since companies are now the legal equivalent of people (money is speech, you know) only the company knows identities so individual people are not accountable.

  3. Naomi
    Nice post. What are different about Maine/NH statutes vs Vermont’s that led to these opposing decisions.
    Appears in NH for example, crux was data repackaging efforts were a commodity not speech driven effort. Get it.
    In Vermont, instead, they used a medical privacy tact. Was it just a matter of state believing this was more sound approach? Seems like NH rationale could have won the day?
    Can you untangle a bit for me?

  4. @Brad F – Vermont defended the law on 3 grounds: health care costs, safety, and privacy. If you read the dissent in the 2nd Cir. case, you’ll see how this judge really liked the privacy argument.

  5. Brad,
    The Maine law is less restrictive than those in New Hampshire and Vermont in that it requires doctors to “opt-out” of the data mining process–kind of like putting yourself on a do-not-call list for telemarketers. The other difference is that both the Maine and NH challenges were heard in the same Boston circuit court, whereas the Vermont case was heard in NY. But Kevin is correct that there are actually two issues at play here; free speech and privacy. Courts will have to decide whether prescriber’s (and patient’s)right to privacy outrank protecting the “free commercial speech” of data miners.

  6. seems to be a thin line here between giving folks access to condition-specific sells and protecting their privacy or keeping them from more expensive and perhaps unneeded alternatives. can’t see myself what difference is from using gmail, which automatically calls up anti-acne drug ads when someone writes about their acne problem, or condition-specific websites that aggregate such data. at bottom seems to be a fear that consumers can’t intelligently process the resulting message which in turn challenges our respect for increasingly empowered patients

  7. The real problem with all of this is that the consuner of the drug, the patient, is not making the purchse decision or paying for the prescribed drug (in most cases). Therefore, data mining that identfies MDs that are heavy prescribers is very beneficial for drug company marketing programs, but so what?. Patients need to be more proactive in their treatment decisions… this would reduce the prescibing of expensive new drugs when cheaper older drugs are available or generic drugs are available with equivalent efficacy. How to do? The patient needs to have more at stake and discuss options w/ their doctor. The argument that these laws protect consumers is bogus, the same prescribing would continue because certain docs like to believe that they’re on the cutting edge by prescribing the newest meds (and usually the most expensive). These laws only empower the state to intrude into our lives more and more. Step back and critically evaluate anything the government does; do they do it well? No. We should not permit them to continue to tell us as individuals what to do. People need to educate themselves. Patients need skin in the game.