Protecting privacy and enabling pharmaceutical sales on the Internet: a comparative analysis of the United States and Canada.

• Author: Rothstein, Nicole A.

1. INTRODUCTION

   The Internet offers the potential to revolutionize the manner in which people receive health information and treat their health conditions. More than 40.9 million Americans were expected to use the Internet in the year 2000 for health care.(1) "According to Investors Business Daily, 43 percent of [W]eb surfers access health care data online each year. Health concerns are the sixth most common reason that people use the Internet, and according to the market research firm, Cyber Dialogue Inc., this number is growing by 70 percent a year."(2)

   Even without the growth of the Internet, the twentieth century has seen an incredible proliferation of health care services. Rather than simply consulting a single family physician for all health-related matters, patients now seek counsel from many individuals about needed services. The Internet offers an easy, fast, and potentially more robust source of health care delivery. Nonetheless, this incredible new medium also has the potential to defraud consumers seeking health information and services in a manner that probably would not have occurred had they simply consulted their familiar--and trusted--licensed medical practitioners.

   Generally, the health care industry has lagged behind other sectors in the use of information technology services and solutions.(3) In the modern health care arena, however, sharing information is increasingly important to facilitate patient diagnosis and treatment, insurance and benefit claim evaluation and payment, public health monitoring, research, and health care education and training. To respond to widespread consumer use of the Internet for health-related reasons, health care organizations and services must migrate from their traditional "bricks-and-mortar"(4) establishments to the Internet.(5) Until two years ago, even Kaiser Permanente, the country's largest health-maintenance organization ("HMO"), kept paper files for its patients' and shipped records around the country by traditional truck delivery.(6) Today, Kaiser and many other HMOs and health care professionals use the Internet to facilitate anything from individual account access, communication between the patient and health care provider, storage and transmission of patient data, to advice and discussion among health professionals, drug and disease research, and product ordering.(7) Before Internet health services overtake their bricks-and-mortar counterparts, the law must ensure an adequate level of confidentiality and control over consumers' personal health information; reliability of online information; and direct redress for invasions of privacy and unfair, deceptive, and fraudulent trade practices.

   While online health care delivery raises many important issues, this Comment offers a comparison of the American and Canadian legal approaches to informational health privacy and Internet pharmacy sales. The United States and Canada have taken different approaches to the general protection of privacy, and this difference remains consistent between the two nations' treatment of Internet medical privacy. While the United States offers a patchwork of industry-specific privacy laws and encourages industry self-regulation, Canada has recently enacted a comprehensive privacy protection law that covers actions of both public and private actors and gives consumers a private right of action. Nonetheless, the United States has recently enacted a detailed medical privacy law. While this industry-specific law covers actions of both public and private actors, it does not give consumers a private right of action. This U.S. law is likely more comprehensive in terms of medical privacy protections because of its pinpoint focus, but it does not offer an industry-neutral, umbrella privacy protection and individual redress that the Canadian law promises. The advent of the Internet pharmacy, however, has caught both countries off guard; thus, there likely will be more consistency and cross-country cooperation in the future regulations of Internet pharmacy sales.

   The Internet poses enhanced and unique concerns relative to informational health privacy and pharmacy sales. As technology advances and the Internet changes the way people obtain their medical services and products, protecting health information and consumers in online pharmaceutical transactions is paramount. Part II of this Comment explores the existing legal frameworks in the United States and Canada relative to informational health privacy and provides a comparative analysis of these frameworks. Part III then examines, analyzes, and compares the existing legal frameworks with regard to Internet pharmacy sales. This Comment concludes in Part IV that while the highly sensitive nature of personal medical information calls for a uniquely tailored law, a baseline umbrella privacy standard should be adopted at the federal level to provide consumers with meaningful protection and redress for all personally identifiable information. To embrace the benefits of pharmaceutical transactions via Internet and allow the medium to flourish, there should be national standards for licensure, as well as continued strict enforcement for rogue Web site operators.

2. ENHANCED AND UNIQUE CONCERNS ARISING FROM THE INTERNET

   Consumer health care delivery via the Internet has moved from an embryonic idea to a pubescent reality. For purposes of this Comment, health care delivery means advice and discussion between a patient and a health care provider, access to patient and account data, and research on drags and diseases. Consumers should be aware that this new medium for health care delivery presents unique and often hidden harms.

   From a privacy protection standpoint, the architectural structure of the Internet itself presents concerns because it is a global "network of computer networks,"(8) and digital information often passes through dozens of computers before reaching its intended destination. Thus, an individual's health care information shared over the Internet is potentially more vulnerable to unauthorized access, distribution, disclosure, and general misuse than if this information had simply remained in paper form in one location. The ease with which information is created and shared over the Internet makes this grave threat of invasion of medical privacy a very real and constant concern in today's electronic age. When all records were maintained in paper form only and kept in the locked filing cabinet of a single physician, it was much harder to share these records with third parties and easier to guard against unauthorized access.

   The advent of "cookie" technology,(9) "Web bugs," and other tracking software presents additional concerns unique to the Internet.(10) It is not far-fetched to imagine an environment where one's health insurance provider, employer, or educational institution monitors the Web sites that one visits. This would enable the insurance provider either directly or via employer tracking to have knowledge about "risky" sites an individual visits, such as HIV-positive support sites, cancer support sites, alcoholism support sites, Internet gambling sites, or pornography sites. With this knowledge, the provider may cancel coverage or simply place the individual in a higher risk category of medical coverage. Even without any overt action, the mere possession of this information by a third party, without disclosure or consent, constitutes an invasion of privacy.

   Internet pharmacies present a potential for abuse that is not present, or nearly as prevalent, in traditional "bricks-and-mortar" pharmacies. The majority of medical experts agree that the Internet today offers a hodgepodge of useless and misleading information mixed in with very relevant and reliable medical information." It is fair to characterize some health information on the Internet as being delivered by the snake-oil salespeople of the electronic age.(12) For example, an Internet pharmacy may heavily advertise a particular drug without disclosing that it is receiving a commission from the drug's manufacturer for every online sale of that drug. In addition, the Internet pharmacy may have chat rooms on its sites where company representatives tout the advantages of the drug, without disclosing their relationship to the Web site or the manufacturer. This mix of content and commercial purpose presents a great danger to the unsuspecting consumer.(13)

   It might also be considerably easier to obtain prescription drugs in an online world than in an offline environment. Consumers and Web site operators might join together in this illegal activity. For example, authorities recently discovered that a Web site was selling narcotics to consumers without prescriptions or the accompanying "prescription hassles."(14) Such a scheme likely appeals to those who would like to obtain strong painkillers without going through a valid prescription process. Moreover, a rogue Internet pharmacy site may sell drugs that are not authorized in the United States or that are counterfeit reproductions of legally approved drugs. Consumers must be enabled to avoid known and unknown risks and unfair business practices in their searches for prescription drugs and other health care services on the Internet. Providing responsible and dependable health care over the Internet requires protecting personal health information, guarding against unauthorized surveillance of Web site activity, empowering consumers to find reliable and credible information and drugs via Internet pharmacies, and establishing national licensure standards for Internet pharmacies.

   1. Health Privacy

      Health care information is generally considered to be among the most intimate and sensitive of personal information. Even with this sensitivity, health-oriented Web sites have access to an unprecedented amount of personal information about individual consumers. For example, health-related Web sites potentially have access to...