By MARGALIT GUR ARIE

A new lawsuit has been filed this month in an attempt to curtail the unconsented and currently legal traffic of de-identified medical records, this time against pharmacy giant Walgreens. The class action suit brought by Todd Murphy, a citizen of the State of California, on behalf of his children, is alleging that the company’s sale of prescription histories to data mining companies, servicing the marketing efforts of pharmaceutical companies, is an unfair, unlawful and deceptive business practice allowing Walgreen Co. to unjustly enrich itself while depriving the rightful owners of the data of their ability to benefit from the commercial value of their prescription records. There is no mention of privacy violations anywhere in the brief, and this is what makes this legal action very unique and potentially a landmark in the effort to control unauthorized sales of medical records.

The deceptive business practices are pretty straight forward to understand, since it seems that Walgreens makes all customers sign a privacy notice stating unequivocally that the company will not disclose patient information without first obtaining authorization from the patient. Furthermore California law prohibits pharmacists from disclosing prescription information to unauthorized third parties, which arguably makes the sale of data also unlawful. The bulk of the brief is describing the injury to plaintiffs caused by “detailing”, i.e. targeted in-person marketing by pharmaceutical reps to physicians, which is substantially aided by information extracted from plaintiffs prescription patterns. Detailing is portrayed as a ruthless drug company strategy to increase sales of newer and more expensive brand-name drugs, thus increasing the costs of health care, endangering patients and harming the doctor-patient relationship.

And here is where the complaint gets interesting.

The plaintiffs are arguing that “As a direct and proximate result of Defendant’s unfair business practices related to the sale of Plaintiff and the Class’ prescriptions as outlined above, Plaintiff and the Class have suffered injury in fact, lost money and/or property by paying money to Walgreens to fill their prescriptions, and been deprived of the commercial value and business opportunity inherent in the contents of Plaintiff and the Class’ prescriptions.” First, tangible injury is (hopefully) established. Second, if prescription data indeed has monetary value, and according to Walgreens SEC filling it is worth about three quarters of a billion dollars, then that money really belongs to the plaintiffs, which are seeking “That Defendant pay restitution, damages and / or disgorgement as proven for Walgreen’s conversion of Plaintiff’s prescription, and/or for restitution of monies paid Walgreen for filling prescriptions, and/or profits to be disgorged as unjust enrichment, and/or for the amount found to be due from defendant to plaintiff as a result of the accounting and interest on that amount from and after filing suit.”  If this action is successful, and it is established that medical data, whether identified or de-identified, is the property of the patient, and any proceeds from the sale of such data should flow back to the rightful owners, there will be very little incentive for Walgreen or any other medical records hosting entities to engage in wholesale of electronic health records.

The State of Vermont has a different opinion regarding data ownership. After a US Appeals Court ruled Vermont’s ban on the sale of prescription data unconstitutional on grounds of First Amendment violation, the US Supreme Court agreed to review the case. Vermont’s main concern is the sale of Prescriber Identifiable (PI) data and the ill effects of the resulting “detailing” on cost of care, physician privacy and doctor-patient relationship. Several “friend of the court” briefs filed in support of Vermont’s plea are also raising patient privacy issues and pointing out that de-identification, as performed by data-mining companies, is very likely reversible. Just like the recent Maine and New Hampshire laws, Vermont’s ban on prescription data sales to data-mining companies is enforced at the prescriber level (New Hampshire has a complete ban on sales, Maine allows prescribers to opt-out and Vermont proposes to allow doctors to opt-in).  While both Maine and Vermont laws assign control of PI prescription data to physicians, neither one proposes actual ownership, including commercial value compensation, to anyone other than those collecting the data in the first place. New Hampshire’s total ban on sales for detailing purposes implies that the State is in control of the data and nullifies any commercial value associated with this type of activity.

While the US Supreme Court review of the Vermont case is most certainly welcome, I don’t believe it will settle the general questions surrounding ownership of medical records. Watching Murphy v. Walgreen Co. winding its way through the various courts, as it certainly will unless summarily dismissed in San Diego County, should provide better intelligence, particularly regarding a legally acceptable definition of injury which is paramount to the success of this lawsuit. Hopefully others will bring similar actions and expand the scope beyond just prescription data. Physicians in particular would be well advised to consider the unjust enrichment of technology companies packaging and selling medical records composed by physicians who are investing large sums of money in the technology itself and are experiencing revenue losses due to decline in productivity and other software mishaps, all under threat of regulatory government penalties in the very near future. If this does not qualify as injury in a court of law, I don’t know what would.