Will Supreme Court Tie States' Hands in Medical Records Privacy Efforts?

Yesterday, the United States Supreme Court struck down a Vermont law that limited the sale of physician-identifiable prescription data for marketing purposes. In a 6-3 decision in Sorrell v. IMS Health, the Court held that the law was a violation of the First Amendment's free speech protections. The decision is a huge disappointment to legislators who have sought to protect the confidentiality of private prescription records, not limited to the states of Vermont, New Hampshire and Maine, that have already adopted such laws, or Massachusetts which has considered adopting protections.

The information Vermont tried to protect comes from private medical records. It is being used to profile doctors to help drug companies in their marketing efforts. These records are not used in speech nor is the data in these records 'speech' as we have come to understand the term. The expansive decision by the U.S. Supreme Court, which extends new protections to commercial speech, should be a concern to anyone interested in keeping private information private.

Sean Fiil-Flynn, Associate Director of the Program on Information Justice and Intellectual Property at the Washington College of Law, served as counsel for amici NLARx and AARP in the case. Prof. Fiil-Flynn stated: "For the first time in the Court's history it has extended heightened First Amendment protection to the commercial trading of information that is neither from the public sphere nor destined for it. Vermont regulated only the commercial trade in prescription records that were purely for the purpose of targeting marketing to doctors to alter prescriptions toward more profitable outcomes." Read Prof. Fiil-Flynn's full statement.

What does this mean for the future of data privacy? This decision raises concerns that extend well beyond medical records. EPIC, the Electronic Privacy Information Center, filed a brief in the case focusing on the vulnerability of patient data to exposure despite the measures taken to de-identity records. The case is getting attention from internet privacy bloggers as well.

All may not be lost, at least with respect to medical records. Boston University law professor Kevin Outterson, who represented medical association amici in Sorrell, says in his blog "the Vermont statute suffered from self-inflicted wounds, namely some incautious comments in the preamble" and that "Vermont can fix the statute quite easily with the guidance given by the Court." He suggests one option would be to make the statute a narrow extension of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), giving the privacy right exclusively to the patient and a confidentiality right directly to the physician. Alternatively, he suggests, "Vermont can ban data mining by contract with participating pharmacies through Green Mountain Care," its newly-enacted single payer health program. Finally, Outterson suggests, Vermont could also clarify that pharmacies collect this information only as a state-mandated record.

Prof. Flynn agrees the Supremes may have left room for states and the federal government to address this issue though more targeted medical records laws, saying "The bright spot in the Court's opinion is its recognition that there is, in fact, an interest of governments in protecting the confidentiality of prescription records," and its reference to HIPAA, "which bans many commercial and other uses of medical records, but does not extend its protection to prescriber-identified prescriptions." His advice is to pass laws that "extend the protections of HIPAA to prescriber identified prescription (and other medical) records."

Interestingly, states already are going down this path as they look to implement electronic medical records. New Hampshire law says medical records are deemed the property of patient (§332-I:1) and Maine just enacted Public Law 2011, chapter 347, which gives patients the right to opt out of its electronic health records system. Both of these laws would need amendment to eliminate the loopholes that infect HIPPA, but they show states are already thinking about patient-centered control of medical records.

For more information on Sorrell v. IMS, including Supreme Court Briefs and the full text of the decision, please go here.

Data Mining: Could Furnace Info Really be More Protected Than Health Records?

Prescription Records Data Mining Case Could Have Broad & Counterintuitive Implications

by Sharon Treat, NLARx Executive Director

Is it possible that the U.S. Supreme Court could give greater deference to privacy, and greater protection from marketing uses, for records about who has gas furnaces in their homes, than for sensitive prescription records maintained by pharmacies pursuant to government directive?

It seems that could be the counterintuitive (nonsensical?) result if the Supreme Court upholds the Second Circuit decision in Sorrell v. IMS Health invalidating the Vermont prescription records privacy law. I attended the argument Tuesday where the Justices seemed to be voicing support of a prior decision shielding furnace records maintained for public safety purposes from being used for marketing, yet questioning the constitutionality of a Vermont law giving doctors the right to opt to have their prescribing records kept confidential and not used for marketing. Read the transcript of the argument.

You would think that doctors' privacy interest in medical records would clearly have a level of sensitivity and significance at least comparable with records of who has gas furnaces in their home. The distinction that one set of records is maintained by a government entity and the other by pharmacies at the command of government is as they say, a distinction without a difference. In this era of privatization and electronic health records, are we really saying that the only way government can act to protect its citizens' privacy interest in restricting the use of sensitive and personal information for marketing purposes is to directly carry out all functions that require the maintenance of records containing personal data?

Such a construction flies in the face of other privacy statutes including HIPPA and sounds like... socialized medicine.

It is also worth noting that much was made in the Supreme Court oral argument by IMS attorney Tom Goldstein that industry drug salespersons or detailers are conveying "100 percent" "truthful" information. Statements were also made that all communications are approved by the FDA. This is just not the case. It is ironic that these assertions seemed to be taken at face value when the record in the case showed otherwise, and on a day when newspapers reported on a trial involving misleading and illegal off-label marketing and FDA allegations of attorney coverups. Read about the case involving GlaxiSmithKline.

NLARx has sided with Vermont in the data mining case and submitted, with AARP, our own amicus brief supporting the Vermont law.

Here's what our counsel Sean Flynn has to say about the Oral Argument of Sorrel v. IMS Health in the Supreme Court: (This statement may be quoted or reprinted in part or full with attribution.)

April 27, 2011

"From the argument yesterday, it appears that a key issue in the case is whether regulation of access to government-mandated and government-possessed information are the treated the same under the First Amendment. Under the LAPD decision, the Court upheld a law that restricted access to identifying information in government records for marketing purposes, but not other purposes. The Court showed no inclination to question that holding in this case. IMS argued yesterday that the singling out of commercial marketing for access restrictions in Vermont’s law makes the law illegally discriminatory. Tom Goldstein, the IMS attorney, argued that the distinguishing factor from the LAPD case is that there the government held the information itself whereas in this case prescription records are merely government mandated but privately held. To fall under the LAPD standard allowing the government to block access to government information, including specific restraints from use for marketing, the prescription would have to be held at a government-owned pharmacy, Goldstein argued.

The IMS standard does not square with other federal data confidentiality laws. The Driver Privacy Protection Act, for example, forbids the trade of information from DMV records (government mandated information) even by third parties who later come in possession of the information.

The other big issue appears to be how the intent of the legislature figures. The Court appeared convinced that a primary purpose of the law was to restrain runaway drug prices caused by undue influence of pharmaceutical marketing. Can the state serve this goal through a law that deprives marketers of access to certain non-public information used as a marketing tool? The answer to that question turns on whether use of information to target marketing, as opposed to sharing the information itself, is a form of “speech.” If it is not speech, then the government can regulate it as economic activity for a variety of reasons, including to reduce overall health expenditures.

There was little discussion in oral argument of whether the use of confidential data to target marketing is itself speech. Many of the members of Court appeared to assume that it was, or at least that speech was effected by the law in such a way as to trigger First Amendment scrutiny. But this is new ground for the Court. that the But that issue is likely to figure prominently in any opinion. If every use of information is speech, a very broad range of information confidentiality protections could be threatened by the decision."

Fore more information contact:

Sean M Fiil Flynn

Associate Director

Program on Information Justice and Intellectual Property (PIJIP)

American University Washington College of Law
4801 Massachusetts Ave., NW
Washington, D.C. 20016
(202) 274-4157

202-294-5749 (cell)