Focusing public attention on emerging privacy and civil liberties issues

IMS Health v. Sorrell

Concerning the Use of Prescriber-Identifiable Data for Targeted Marketing

Latest News

  • EPIC Urges Appeals Court to Protect Prescription Data: EPIC filed a friend of the court brief in the Court of Appeals for the Second Circuit today, urging the judges to uphold a Vermont law that regulates companies that sell or use prescriber-identifiable data for marketing. Several data-mining companies challenged the law after it was upheld by a district court. EPIC's amicus brief supports the district court's conclusion. The EPIC brief argues that Vermont has a substantial state interest in privacy protection and that the data miners' de-identification practices do not, in fact, protect patient privacy. For more, see IMS Health v. Sorrell and EPIC Medical Privacy. (Sep. 15, 2009)
  • Vermont Postpones Effective Date of Prescription Privacy Law. The Vermont Legislature postponed the effective date of the state's recently-enacted prescription privacy law until July 1, 2009. The Vermont law is the subject of litigation, and is similar to the New Hampshire Prescription Confidentiality Act. (March 5, 2008)
  • Vermont Attorney General Postpones Enforcement of Prescription Privacy Law. The Vermont Office of the Attorney General announced today that it will delay enforcement of the state's recently-enacted prescription privacy law until September 1, 2008. The delay is intended to provide time for state agencies to develop rules and procedures for implementation. The Vermont law is the subject of litigation, and is similar to the New Hampshire Prescription Confidentiality Act. (September 27, 2007)
  • Data Miners Challenge Prescription Privacy Laws in Maine and Vermont. Today, several data miners, including IMS Health and Verispan, filed suits in Vermont (IMS v. Sorrell) and Maine (IMS v. Rowe) challenging recently-passed patient privacy laws. The Maine and Vermont laws are similar to the New Hampshire Prescription Confidentiality Act. (August 29, 2007)

Introduction

In 2007, the Vermont legislature passed the “Act Relating to Increasing Transparency of Prescription Drug Pricing and Information”, Vt. Stat. Ann. tit. 18, § 4631 (2007), ("Vermont Statute"), aimed at protecting public health and containing prescription drug costs. The law prohibits regulated entities from selling or using prescriber-identifiable data for marketing or promoting prescription drugs unless the prescriber consents (opts-in). The Act also created a consumer fraud cause of action for advertisements printed, distributed or sold in Vermont that violate federal law, and created an evidence-based education program for health care professionals concerning the therapeutic and cost-effective utilization of prescription drugs, as funded by a fee paid by pharmaceutical manfacturers. In cases where prescribers fail to opt-in, the law bars the use of prescriber-identifiable data for "physician detailing." IMS Health Inc. defines "physician detailing" as a practice commonly employed by pharmaceutical sales representatives to tailor their sales pitches to individual physicians based on their past prescription writing habits. The Vermont Statute explicitly permits the use of data for such non-commercial purposes as research and education. The legislative intent in passing the Vermont statute, as stated in Section 17(d), was to "protect[] the privacy of prescribers and prescribing information." Section 17(c) prohibits health insurers, self-insured employers, electronic transmission intermediary, pharmacies, or similar entities from selling, licensing, exchanging for value regulated records containing prescriber-identifiable information for marketing or promoting a prescription drug, unless the prescriber consents.

The plaintiffs, IMS Health Incorporated and Verispan, LLC, are both data mining companies that purchase and compile prescription information in order to sell the data to private companies, law enforcement agencies, and research institutions. Their biggest clients by far are pharmaceutical companies, which use the data extensively for detailing, they said. The case was consolidated with an analogous suit filed by the Pharmaceutical Research and Manufacturers of America (PhRMA). PhRMA has several member companies it represents in litigation. The plaintiffs filed suit against the State, alleging that the new Act violated their First Amendment right to free speech. Specifically, they argued that: (1) Section 17(d) of the Vermont Act restricted the speech of pharmaceutical companies in violation of the First and Fourteenth Amendments; (2) Section 21(c) of the Vermont Act was preempted by federal law because it obstructs the ability of FDA to achieve its regulatory objectives; (3) Section 21(c) of the Vermont Act violates the Commerce Clause of the U.S. Constitution by regulating almost exclusively out-of-state commerce; and (4) Section 20 of the Vermont Act violates the First and Fourteenth Amendments by forcing pharmaceutical companies to subsidize speech favoring competitors’ products.

In the State's defense, the Attorney General argued (pdf): 1) that the law did not implicate the First Amendment because it did not regulate speech; and even if the Act did implicate speech, 2) the law should survive intermediate scrutiny under Central Hudson because it advanced the State's substantial interests in promoting public health, controlling health care costs and protecting the privacy of patients and doctors, while still allowing the data to be used for non-commercial purposes; (3) the statute did not violate the commerce clause because the statute purely regulates Vermont transactions and businesses. As the Attorney-General stated, "Prescriber-identifiable data is used as a tool for aggressive, targeted marketing campaigns that influence doctors to prescribe new, expensive drugs. . . . Use of the data gives pharmaceutical sales representatives a powerful advantage in trying to sway doctors’ prescribing practices. It allows them to target doctors [and] target messages . . . . And these techniques work, to the advantage of pharmaceutical companies . . . but to the disadvantage of doctors, the patients they treat, and the state of Vermont. Allowing doctors to prevent the use of their data for marketing . . . will reduce Vermont’s spending and give Vermonters greater access to affordable health care."

In an opinion issued on April 23, 2009, District Court Judge John Garvan Murtha held that the Act restricted speech. However, the court determined that the speech implicated by the release of prescriber-identifiable data was not fully-protected speech under the Constitution. Rather, the speech in this case was commercial speech and was subject to intermediate scrutiny. Accordingly, the Court utilized the four-part intermediate scrutiny test to evaluate the law under Central Hudson Gas & Electric Corp. v. Public Service Comm. of New York, 447 U.S. 557 (1980). Under Central Hudson, commercial speech can only be limited if it: is 1) truthful and non-misleading; 2) is in support of a substantial government interest; 3) directly advances the government interest asserted; and 4) is not more extensive than necessary to serve that interest.

The District Court generally agreed with the attorney general's arguments, finding that the "law is sustainable on the State's cost containment and public health interests, which are substantial . . . ." Therefore, the court held that the law's restrictions on data disclosure were "in reasonable proportion to the State's interests." Although the court did not believe that "prescriber privacy [was] a sufficient interest to justify the law," it did not fully consider the merits of the State's privacy claim.

On May 4, IMS Health appealed (pdf) to the Second Circuit Court of Appeals. The Second Circuit will hear oral arguments during the week of October 12, 2009. Briefs are currently being submitted to the court by both the parties and amici.

EPIC's Interest

There are approximately 1.4 million health care providers in the United States. These providers write billions of prescriptions each year for more than 8,000 different pharmaceutical products. These prescriptions are filled at 54,000 retail pharmacies throughout the country. The retail pharmacies acquire records for every prescription they fill. These records include: patient name; prescriber identification; drug name; dosage requirement; quantity; and date filled. In order to comply with federal and state privacy laws, patient identifying information is encrypted and de-identified, often with software installed by the data mining companies themselves. The rest of the prescription record remains intact. Thus, a patient's entire drug history is correlated, and each provider can be identified along with their prescribing habits. This practice raises privacy concerns for both patients and health care providers.

Although patient information is encrypted and de-identified, encryption is not a foolproof method to protect privacy. Security breaches are common, and with relatively little information, it is possible to re-identify patients. See Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923, 929 (7th Cir. 2004). This represents an alarming loss of privacy which could have greater implications for patients. For example, patients may be less likely to fill prescriptions for certain conditions, or they may be less likely to seek initial health care.

Physicians also have an interest in keeping their prescription writing habits confidential. According to evidence introduced at trial, disclosure of such information is used to target physicians and may influence the medicines prescribed to their patients. According to a 2002 Kaiser Family Foundation study, 74 percent of doctors disapprove of drug companies accessing prescription information. Additionally, doctors also have a professional responsibility to ensure the privacy of their patient population.

In IMS Health v. Ayotte, 550 F.3d 42 (1st Cir. 2008), cert. denied, 2009 U.S. LEXIS 4744 (2009), the Court of Appeals for the First Circuit upheld the New Hampshire law that bans the sale of prescriber-identifiable prescription drug data for marketing purposes. The New Hampshire legislature unanimously passed the Prescription Confidentiality Act preventing data brokers from collecting prescriber-identifiable and prescription information and selling such information to pharmaceutical companies to influence physicians' prescribing habits. The District Court held that the state's Prescription Confidentiality Act violated the First Amendment and improperly restricted commercial speech rights of data brokers and pharmaceutical companies. In an appeal to the First Circuit, EPIC and 16 privacy and technology experts submitted a friend of the Court brief urging a reversal of the lower court ruling. The EPIC brief argued that the substantial privacy interest in de-identified patient data was not considered by the lower court. The privacy interest, in part flows from the realities that data may not be, in fact, truly de-identified, and that de-identified data does impact actual individuals. In November 2008, the First Circuit reversed the ruling and in June 2009, the U.S. Supreme Court refused to hear the challenge to the Prescription Confidentiality Act.

Legal Documents

United States Court of Appeals for the Second Circuit

United States District Court for the District of Vermont

Amicus Briefs (all PDFs):

Maine and New Hampshire Legislation and Litigation

On June 30, 2006, the New Hampshire legislature unanimously passed The Prescription Confidentiality Act. The law prohibits prescription information records which contain patient- or prescriber-identifiable data from being transferred, licensed, sold, or used for most commercial purposes. This includes marketing, advertising, and other forms of promotion. The Act specifically bars the use of prescriber-identifiable data for "physician detailing." This law was upheld by the First Circuit in IMS v. Ayotte. In the summer of 2007, Maine enacted similar legislation. Several data miners, including IMS Health and Verispan, filed lawsuits in federal court challenging the law. In IMS v. Rowe, the district court struck down the Maine law, citing First Amendment concerns and referencing the trial court's opinion in IMS v. Ayotte. However, the IMS v. Ayotte decision casts substantial doubt on this ruling since Maine resides in the First Circuit.

Additional State Legislation

Each of these states has a strong interest in the outcome of IMS v. Sorrell.

  • Arizona: SB 1518 was introduced on January 30, 2007. The bill has not yet moved from committee.
  • District of Columbia: The SafeRx Act of 2007 (pdf) was introduced on November 16, 2007, and is in the D.C. Council Committee on Health.
  • Illinois: HB 1459 was introduced on February 21, 2007. The bill was referred to the Rules Committee on March 23, 2007.
  • Kansas: SB 229 (pdf) was introduced in the Kansas legislature on January 30, 2007.
  • Maine: LD 4 was enacted, and has been the subject of litigation. NOTE: Maine has passed MRSA 1711-E, which prohibits the sale of prescription drug information that identifies, directly or indirectly, patients or health care providers.
  • Maryland: SB 266 was introduced on January 30, 2007. No action has been taken since a Finance Committee hearing on March 12, 2007.
  • Massachusetts: SB 1275 is pending.
  • New York: The State Assembly is currently considering S2056 and S6992. S2056 was introduced on January 30, 2007 and referred to the Higher Education Committee on January 9, 2008. S6992 was introduced on March 23, 2007 and has been referred to the Health Committee.
  • North Carolina: SB159 was introduced on February 13, 2007, and has been referred to the Committee on Commerce, Small Business, and Entrepreneurship.
  • Rhode Island: S. 0653 (pdf) was introduced into the General Assembly during the January session. The bill was referred to the Senate Health and Human Services Committee on February 15, 2007.
  • Vermont: HB 92 was introduced into the House on January 23, 2007. The bill has not yet received a second reading.
  • Washington: HB 1850 (pdf) was introduced on January 30, 2007. The bill was returned to the Rules Committee for a second reading on March 15, 2007, and was automatically reintroduced for the 2008 session.
  • West Virginia: SB 434 was introduced on February 1, 2007. The bill was referred to the Committee on Health and Human Resources, and carries over into the 2008 session.

News Reports

Related Resources