Prescription Drug Records and Privacy

As I have written about on this blog in the past, the reality that our most private prescription drug records are not in fact private, is beginning to sink in, both in the minds of consumers as well as some lawmakers.

For Californians, the good news is we have stricter protections against the selling and sharing of our prescription records than just about any other state (aside from New Hampshire, Maine and Vermont).

Before I get to an article detailing the latest prescription drug record revelations, particularly in relation to a case involving Eli Lilly and Co. and CVS Caremark, let me first discuss a battle that we (the Consumer Federation of California) just had in 2007 on this very issue.

The bill that we opposed - and which nearly passed the legislature - would have created an exception to California's Medical Information Act, and allowing the sharing of confidential patient drug prescription information among pharmacies, third party corporations and pharmaceutical companies without a patent's consent.

As we argued at the time, Californians expect that their private medical records will be held in confidence by their doctors and pharmacists. SB 1096 would have allowed pharmacies to share prescription information with businesses that provide mailings to the patient – ostensibly reminders that patients should continue to take their medications.

The reminder would appear to come from the pharmacy, but in fact it would be paid for by the drug manufacturer. The bill's main backer, Adheris Inc., was a subsidiary of inVentiv Health Inc., a drug marketing company currently being sued for privacy breaches related to patient prescription records.

Again, as we argued at the time, a patient’s doctor - not a third party marketing company - is the best source for informing a patient about how to manage his or her health condition. By intruding upon and confusing this relationship, this bill could have put patients’ health, as well as privacy, at risk.

For example, a physician might discontinue a prescription if a patient complained of an adverse reaction. Unaware of the changed course of treatment, the drug marketing company would continue sending reminders that appear to come from the drug store, urging the patient to keep taking the old prescription. Worse, the bill placed no liability on drug markets that provide bad information to patients.

The legislative battle was a fierce and contentious one, pitting privacy and consumer groups and physicians against drug store chains and drug marketers. Thanks to a significant public outcry against the legislation - with the help of some excellent reporting on the issue, the bill was defeated.

The San Francisco Chronicle interviewed me about the bill's defeat, in which I stated, "This is a victory for California consumers. It's also a victory for our state's Constitution, which explicitly protects the individual's right to privacy. When it comes to medical prescriptions, there is nothing more private. This bill crossed the line."

I think this California case study serves as a useful tool in understanding what remains at stake for patients privacy around the country, how close California came to losing the protections we enjoy, and, why Congress and the Obama Administration should strengthen our rather lax protections of our prescription records.

With that, let me direct you to an article I found yesterday on IndyStar.com by reporter John Russell, entitled "Think info about your Rx is private? Better think again."

Russell writes:

CVS Caremark, which handles more than 1 billion prescriptions a year, has made no secret that sharing such information is a cornerstone of its business.

...

In a case involving Eli Lilly and Co. and CVS Caremark, it remains unclear how much of a patient's information was switching hands.

CVS Caremark said it sent promotions for the Lilly drug Cymbalta to doctors "who are likely to treat patients with symptoms consistent with fibromyalgia." Lilly said it did not have any information on which patients were taking fibromyalgia drugs.

But in mailings funded by Merck, AstraZeneca and other drug makers, CVS Caremark identified patients by name, date of birth and medications taken. The letters stated that the patients were identified through CVS Caremark prescription claims data as having one or more prescriptions for a certain drug for a certain condition.

...

But is it a violation of patient privacy laws? That is less clear. The Health Insurance Portability and Accountability Act of 1996, commonly known as HIPPA, gives patients certain privacy rights over their medical information -- for example, protection against marketing campaigns.

But some privacy experts say the CVS Caremark mailings don't technically violate HIPPA regulations, because the letters are sent as educational materials to doctors, not as promotional campaigns.

...

CVS Caremark was formed two years ago when CVS, one of the nation's largest drugstore chains with about 7,000 pharmacies, bought pharmacy-benefits manager Caremark Rx for nearly $27 billion, making the combined companies the biggest U.S. buyer of pharmaceuticals.

Pharmacy benefits managers have huge influence over which drugs patients receive by choosing which drugs to place on their formularies. Yet the company's mailings on behalf of drug makers raise questions about where its loyalties lie.

...

According to a patient advocacy group, Change to Win, which represents workers in CVS Caremark plans that cover more than 10 million people, a benefits manager later bought by CVS had misrepresented to doctors and plans that the drugs were cheaper or more effective or both. Actually, the drugs it encouraged patients to use were more costly or less effective.

Click here to read the article in its entirety.

Even if one can make the case, and it holds up in court, that what pharmacies are doing here isn't a violation of HIPPA, by no stretch of the imagination does that make it alright...as clearly it violates the intent of the law. My point is, that if what these companies are doing isn't marketing, than I don't know what is!

But, if this argument can't be won in court, than we need to change the law. Could there be a better time to do this than while we're in the midst of a national debate about health care reform? I say no. As the reporter notes, this practice is beginning to create a backlash among physicians as well as consumers, and its not too much to ask from lawmakers that they push for more transparency.

On that note, the Senate is considering an amendment that would force such companies to disclose much more financial detail about their interactions with drug makers, including how much of the savings they negotiate with drug companies are passed on to consumers. This is a good start. But disclosure isn't enough. I say ban the practice. Period.