Yesterday, the United States Supreme Court struck down a Vermont law that limited the sale of physician-identifiable prescription data for marketing purposes. In a 6-3 decision in Sorrell v. IMS Health, the Court held that the law was a violation of the First Amendment's free speech protections. The decision is a huge disappointment to legislators who have sought to protect the confidentiality of private prescription records, not limited to the states of Vermont, New Hampshire and Maine, that have already adopted such laws, or Massachusetts which has considered adopting protections.
The information Vermont tried to protect comes from private medical records. It is being used to profile doctors to help drug companies in their marketing efforts. These records are not used in speech nor is the data in these records 'speech' as we have come to understand the term. The expansive decision by the U.S. Supreme Court, which extends new protections to commercial speech, should be a concern to anyone interested in keeping private information private.
Sean Fiil-Flynn, Associate Director of the Program on Information Justice and Intellectual Property at the Washington College of Law, served as counsel for amici NLARx and AARP in the case. Prof. Fiil-Flynn stated: "For the first time in the Court's history it has extended heightened First Amendment protection to the commercial trading of information that is neither from the public sphere nor destined for it. Vermont regulated only the commercial trade in prescription records that were purely for the purpose of targeting marketing to doctors to alter prescriptions toward more profitable outcomes." Read Prof. Fiil-Flynn's full statement.
What does this mean for the future of data privacy? This decision raises concerns that extend well beyond medical records. EPIC, the Electronic Privacy Information Center, filed a brief in the case focusing on the vulnerability of patient data to exposure despite the measures taken to de-identity records. The case is getting attention from internet privacy bloggers as well.
All may not be lost, at least with respect to medical records. Boston University law professor Kevin Outterson, who represented medical association amici in Sorrell, says in his blog "the Vermont statute suffered from self-inflicted wounds, namely some incautious comments in the preamble" and that "Vermont can fix the statute quite easily with the guidance given by the Court." He suggests one option would be to make the statute a narrow extension of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), giving the privacy right exclusively to the patient and a confidentiality right directly to the physician. Alternatively, he suggests, "Vermont can ban data mining by contract with participating pharmacies through Green Mountain Care," its newly-enacted single payer health program. Finally, Outterson suggests, Vermont could also clarify that pharmacies collect this information only as a state-mandated record.
Prof. Flynn agrees the Supremes may have left room for states and the federal government to address this issue though more targeted medical records laws, saying "The bright spot in the Court's opinion is its recognition that there is, in fact, an interest of governments in protecting the confidentiality of prescription records," and its reference to HIPAA, "which bans many commercial and other uses of medical records, but does not extend its protection to prescriber-identified prescriptions." His advice is to pass laws that "extend the protections of HIPAA to prescriber identified prescription (and other medical) records."
Interestingly, states already are going down this path as they look to implement electronic medical records. New Hampshire law says medical records are deemed the property of patient (§332-I:1) and Maine just enacted Public Law 2011, chapter 347, which gives patients the right to opt out of its electronic health records system. Both of these laws would need amendment to eliminate the loopholes that infect HIPPA, but they show states are already thinking about patient-centered control of medical records.
For more information on Sorrell v. IMS, including Supreme Court Briefs and the full text of the decision, please go here.
