A new lawsuit has been filed this month in an attempt to curtail the unconsented and currently legal traffic of de-identified medical records, this time against pharmacy giant Walgreens. The class action suit brought by Todd Murphy, a citizen of the State of California, on behalf of his children, is alleging that the company’s sale of prescription histories to data mining companies, servicing the marketing efforts of pharmaceutical companies, is an unfair, unlawful and deceptive business practice allowing Walgreen Co. to unjustly enrich itself while depriving the rightful owners of the data of their ability to benefit from the commercial value of their prescription records. There is no mention of privacy violations anywhere in the brief, and this is what makes this legal action very unique and potentially a landmark in the effort to control unauthorized sales of medical records.
The deceptive business practices are pretty straight forward to understand, since it seems that Walgreens makes all customers sign a privacy notice stating unequivocally that the company will not disclose patient information without first obtaining authorization from the patient. Furthermore California law prohibits pharmacists from disclosing prescription information to unauthorized third parties, which arguably makes the sale of data also unlawful. The bulk of the brief is describing the injury to plaintiffs caused by “detailing”, i.e. targeted in-person marketing by pharmaceutical reps to physicians, which is substantially aided by information extracted from plaintiffs prescription patterns. Detailing is portrayed as a ruthless drug company strategy to increase sales of newer and more expensive brand-name drugs, thus increasing the costs of health care, endangering patients and harming the doctor-patient relationship.
And here is where the complaint gets interesting.
The plaintiffs are arguing that “As a direct and proximate result of Defendant’s unfair business practices related to the sale of Plaintiff and the Class’ prescriptions as outlined above, Plaintiff and the Class have suffered injury in fact, lost money and/or property by paying money to Walgreens to fill their prescriptions, and been deprived of the commercial value and business opportunity inherent in the contents of Plaintiff and the Class’ prescriptions.” First, tangible injury is (hopefully) established. Second, if prescription data indeed has monetary value, and according to Walgreens SEC filling it is worth about three quarters of a billion dollars, then that money really belongs to the plaintiffs, which are seeking “That Defendant pay restitution, damages and / or disgorgement as proven for Walgreen’s conversion of Plaintiff’s prescription, and/or for restitution of monies paid Walgreen for filling prescriptions, and/or profits to be disgorged as unjust enrichment, and/or for the amount found to be due from defendant to plaintiff as a result of the accounting and interest on that amount from and after filing suit.” If this action is successful, and it is established that medical data, whether identified or de-identified, is the property of the patient, and any proceeds from the sale of such data should flow back to the rightful owners, there will be very little incentive for Walgreen or any other medical records hosting entities to engage in wholesale of electronic health records.
The State of Vermont has a different opinion regarding data ownership. After a US Appeals Court ruled Vermont’s ban on the sale of prescription data unconstitutional on grounds of First Amendment violation, the US Supreme Court agreed to review the case. Vermont’s main concern is the sale of Prescriber Identifiable (PI) data and the ill effects of the resulting “detailing” on cost of care, physician privacy and doctor-patient relationship. Several “friend of the court” briefs filed in support of Vermont’s plea are also raising patient privacy issues and pointing out that de-identification, as performed by data-mining companies, is very likely reversible. Just like the recent Maine and New Hampshire laws, Vermont’s ban on prescription data sales to data-mining companies is enforced at the prescriber level (New Hampshire has a complete ban on sales, Maine allows prescribers to opt-out and Vermont proposes to allow doctors to opt-in). While both Maine and Vermont laws assign control of PI prescription data to physicians, neither one proposes actual ownership, including commercial value compensation, to anyone other than those collecting the data in the first place. New Hampshire’s total ban on sales for detailing purposes implies that the State is in control of the data and nullifies any commercial value associated with this type of activity.
While the US Supreme Court review of the Vermont case is most certainly welcome, I don’t believe it will settle the general questions surrounding ownership of medical records. Watching Murphy v. Walgreen Co. winding its way through the various courts, as it certainly will unless summarily dismissed in San Diego County, should provide better intelligence, particularly regarding a legally acceptable definition of injury which is paramount to the success of this lawsuit. Hopefully others will bring similar actions and expand the scope beyond just prescription data. Physicians in particular would be well advised to consider the unjust enrichment of technology companies packaging and selling medical records composed by physicians who are investing large sums of money in the technology itself and are experiencing revenue losses due to decline in productivity and other software mishaps, all under threat of regulatory government penalties in the very near future. If this does not qualify as injury in a court of law, I don’t know what would.
Categories: Uncategorized
Why are doctors foolish enough to buy systems of care that put their patients at risk while concomitantly disrupting their workflow? They ought to recognize the folly.
Thus: Don’t buy! Don’t buy! Don’t buy!
You, of course, have documentable, extensive scientific evidence of this (net additional) risk?
Anonymous: Regarding privacy, which I agree is a separate issue, multiple experts are in agreement that what vendors call “de-identification” is not really a good enough protection from re-identification (see the EFF brief cited above). With all due respect to HIPAA, it has a long way to go before real protection is achieved.
As to your other examples of selling information, this is exactly why legal action contending “unjust enrichment” must show that harm and injury are done to the buyer. There was a similar case brought against Chase in 2002, which failed because the plaintiffs could not establish that selling of data by Chase caused them any harm ( http://library.findlaw.com/2002/Jun/4/132458.html ).
In the Walgreen’s case the plaintiffs are contending that the sale of prescription data to drug companies for the purpose of detailing is causing their health care costs to increase, it is causing physicians to prescribe new and unproven drugs and perhaps harming patients in the process, and it is damaging the confidential doctor-patient relationship.
I am not arguing that these are slam-dunk arguments, and I think the road ahead is long and steep. I do agree with Dr. D, above, that physicians are extremely bothered by this practice, and perhaps will have an easier time proving harm in a court of law, and I hope someone will attempt to do just that.
I don’t want the money, I just want an end to the endless harassment by pharmaceutical reps who come to the office and quote statistics to my prescribing habit they should not know unless they ask me first!
And it is a violation of patient privacy even if big pharma does not get a specific name, because patients use the same pharmacy at least 80% of the time, and it is moreso because of geography, so it is not impossible to extrapolate who is getting meds if someone wanted to take some time and effort to figure out who is getting what meds if they can track it to the doctor first.
By the way, the analogy above about buying gas does not cut it in defending indefensibe behaviors. If you want information about a purchase, ask the customer if he/she wants to discuss their purchases. Otherwise, just focus on the seller what they sell, that is between the seller and the inquisitive party.
The more people try to legitimize what is illegitimate, it only aids and abets behaviors that do not have the party’s best interest being scrutinized. And as I repeat every so often here, those who defend and apologize for inappropriate actions are probably only protecting their own profit margins, if not at least keeping the door open to benefit from less than savory behaviors later!
Don’t mix privacy issues and the use of data mining on de-identified data for commercial purposes. Privacy issues are covered under HIPAA (and post-marketing surveillance by FDA-approved entities using de-identified data is a permitted use under HIPAA.)
If you remove bias against “ruthless” pharmaceutical companies, all you have is an ojection to the commercial use of consumer purchase information. It happens in every industry; information regarding the purchase of goods and services is sold to advertising companies, researchers, and more. It helps companies market more efficiently to their target consumer, make decisions on production forecasts, and on and on. And don’t expect companies to donate this information for free for the public good just because it is pharmacy data; it is a very expensive endeavour even just to store and manage all that information.
And I’m not being harmed by not getting a cut of the commercial value of my data. When I purchase gas at the pump, I don’t expect a discount because the gas company is selling information about my purchase to a data aggregator who then sells that data to OPEC and ultimately helps inform the management of the world’s oil supply. I expect companies to use that purchase information to manage supply and demand on a daily basis in the 21st century. When TiVo’s sells data on my tv viewing behavior to the networks and advertisers, I don’t expect a cut. I expect them to use the data to make decisions about what crappy progams to cancel and which programs have the most viewers who are likely to be light beer drinkers.