Ims Health, Inc. v. Ayotte: Small Step for Privacy, Giant Leap Still Needed for Prescription Data Privacy

• Publication year: 2008
• Citation: Vol. 10 No. 2008

Kathryn M. Marchesini⁰

Electronic data use in United States industries provides a means by which businesses aggregate, track, and manage consumer information. In the health care industry, data mining companies, pharmacies, and pharmaceutical manufacturers have adopted electronic data use with prescription information. The use of electronic prescription data as a commodity raises privacy concerns which have prompted the formation of state laws restricting its use. Data mining companies recently challenged a New Hampshire law restricting the commercial use of prescription data. In IMS Health, Inc. and Verispan, L.L.C. v. Kelly A. Ayotte the First Circuit held that a state has the right to prohibit the transfer, sale, and use of patient and prescriber-identifiable drug data for commercial purposes. This Recent Development examines the authority of and need for Congress to enact federal legislation to achieve effective prescription data privacy, augmenting New Hampshire's law and ensuring privacy throughout the country. This analysis considers the effects of the court's narrow statutory interpretation and extent to which states can curtail the commercial use of prescription data. Moreover, existing federal health information privacy protections do not go far enough to protect prescriber-identifiable data, and federal law should address the gap, especially as the health care industry transforms and data management becomes borderless.

I. Introduction

Many United States industries, including health care, use electronic personal data to provide business intelligence.¹ Using technology, companies gather, store, and analyze data to assist business operations.² For example, regardless of how retail pharmacies³ obtain information to fill prescriptions,⁴ most pharmacies electronically store prescription data in databases.⁵ Not only does this stored data contain the type and brand of drug, dosage, and quantity dispensed, it includes the patient's name and the prescriber's identity.⁶ Data mining companies⁷ purchase electronically stored prescription data from pharmacies and aggregate, manipulate, and sell the modified prescription data to pharmaceutical manufacturers.⁸ Through a business practice known as "detailing,"⁹ pharmaceutical sales representatives use prescription data to conduct target marketing toward specific doctors.¹⁰

Federal privacy protections provided by the Privacy Rule,¹¹ promulgated under the Health Insurance Portability and Accountability Act (HIPAA),¹² govern patients' protected health information ("PHI").¹³ Pharmacies are not allowed to disclose PHI to a third party,¹⁴ except as expressly permitted by the Privacy Rule.¹⁵ The HIPAA Privacy Rule, however, does not prevent pharmacies from disclosing prescriber-identifiable prescription data.¹⁶ Therefore, data-miners can purchase and sell prescriber-identifiable prescription data from pharmacies, allowing for detailing to occur.

Although the sale of electronic prescription data is a lucrative business¹⁷ and drug companies consider this data an invaluable resource,¹⁸ the data's transfer and use have implications for a prescriber's privacy. Prescribers have the right to be left alone.¹⁹ Privacy is an individual's ability to decide "when, how, and to what extent information about [him or her] is communicated to others."²⁰ In essence, once a pharmacy fills a prescription, prescriber privacy rights seem to disappear because pharmacies essentially make this information "public" when they sell prescription data.

Many groups have identified problems associated with health data mining and have taken steps to minimize the commercial use of prescription data.²¹ In 2006, New Hampshire enacted a Prescription Information Law, specifically prohibiting certain in-state licenses, sales, uses, or transfers of patient and prescriber-identifiable prescription data for use in detailing.²² The law was the first of its kind in the nation. The First Circuit's recent decision in IMS Health, Inc. v. Ayotte²³ upheld the controversial Prescription Information Law when challenged by two data mining companies on constitutional grounds. The court held that the law did not violate the First Amendment²⁴ because the law regulates conduct²⁵ and did not violate the Commerce Clause²⁶ because it affects only in-state transactions.²⁷

Even though the state law aims to restrict disclosure and use of prescriber-identifiable prescription data, loopholes exist that allow the occurrence of these state-prohibited commercial activities.²⁸ In turn, Congress should enact a federal law to achieve effective prescription data privacy. Part II of this Recent Development focuses on the New Hampshire Prescription Information Law at issue in the IMS Health decision, discussing privacy concerns and the court's overall decision regarding the law's constitutionality. Part III argues that although the IMS Health decision constitutes precedent to uphold state laws curbing commercial use of prescriber-identifiable data, even in light of existing federal statutes and regulations protecting health information, threats to privacy remain. Part IV proposes that federal legislation should address this overarching issue, as data mining and pharmaceutical companies are multi-state enterprises by which electronic data exchanges often occur outside the state's borders. Finally, with the increased use of health information technology ("health IT") in the United States, Part V highlights the general need for oversight of and safeguards for prescriber-identifiable data protection.

II. New Hampshire Prescription Information Law and the IMS Health Decision

The New Hampshire Prescription Information Law states "[r]ecords relative to prescription information containing patient-identifiable and prescriber-identifiable data shall not be licensed, transferred, used, or sold by any pharmacy benefits manager, insurance company, electronic transmission intermediary, retail, mail order, or Internet pharmacy or other similar entity, for any commercial purpose,"²⁹ except for certain limited purposes.³⁰ The state justifies the law by arguing that it has a substantial interest in protecting the privacy interests of its constituents, safeguarding patient health, and promoting containment of prescription drug costs.³¹ The foremost concern of this Recent Development is privacy interests.

A. Privacy Interests, Threats, and Harms

The aggregation, insecurity, and secondary use of prescription data are forms of information processing that pose a risk to patients and prescribers.³² While prescription data must be de-identified³³ to protect patient privacy,³⁴ the risk of re-identification remains.³⁵ For instance, the potential secondary use³⁶ and sharing of prescription data with a data-miner could cause harm to the dignity of a patient or prescriber.³⁷ This Recent Development focuses on the privacy interests of prescribers.³⁸

In addition to the health care industry's cultural norms and the sensitive nature of health information, prescribers have no desire for data-miners and/or detailers to have access to their prescribing behavior.³⁹ Government officials, as third parties, do have access to prescriber-identifiable data for specific public health reasons.⁴⁰ However, disclosing data to third-party data-miners for commercial purposes invades a prescriber's privacy.⁴¹ The data provides details about prescribers' prescription behavior, enabling detailers "to zero in on physicians who regularly prescribe competitors' drugs, . . . large quantities of drugs for particular conditions, . . . and 'early adopters.'"⁴² Moreover, under the doctor-patient relationship,⁴³ patients likely consider prescription data as private.⁴⁴ In turn, prescribers could suffer reputational harm because patients may question whether a prescriber's overall basis for prescribing a particular brand-name drug is a medical reason, or a preference resulting from a personal solicitation. New Hampshire's concern is the exploitation of the mined data by pharmaceutical detailers that utilize the massive collection of prescription data in marketing brand-name drugs to prescribers.⁴⁵

B. IMS Health Decision

IMS Health, Inc. and Verispan, L.L.C., companies in the health data mining business, challenged the Prescription Information Law on First Amendment and Commerce Clause grounds, claiming that the law infringed on commercial free speech⁴⁶ and regulated activity wholly outside New Hampshire.⁴⁷ As the Commerce Clause prevents state governments from burdening the free flow of goods from one state to another,⁴⁸ a law that purports to regulate conduct occurring wholly outside the enacting state "outstrips the limits of the enacting state's constitutional authority and, therefore, is per se invalid."⁴⁹ Although the law does not provide explicit geographic limitations, the court narrowly interpreted the law's scope to be the regulation of in-state transactions.⁵⁰ Since the Prescription Information Law only regulates in-state commercial conduct,⁵¹ the majority held that the law did not violate the Commerce Clause.⁵²

On the contrary, in IMS Health, Judge Kermit Lipez dissented from the majority's Commerce Clause holding, and noted that due to the law's narrow construction, the law's impact in New Hampshire appears "negligible."⁵³ If the law does not apply outside the state, the law "loses all of its force and effectiveness" because a retail pharmacy in New Hampshire could transfer prescriber-identifiable prescription data to its parent company in another state.⁵⁴ The parent company could transfer this data to data-miners outside New Hampshire.⁵⁵ No barriers to the use of this data exist for data-miners and detailers.⁵⁶ Thus, Judge Lipez would have remanded the issue for further fact-finding regarding the flow of prescriber-identifiable data⁵⁷ to determine whether the law violates the dormant Commerce Clause.⁵⁸

III. State Law Addresses Only a Subset of a Nationwide Data Privacy Issue

A. Effect...