How Drug Companies Look at Your Private Medical Records Any Time They Want
It's kinda-sorta common knowledge that pharmacies sell their prescription data to drug companies so companies can use it to inform their marketing. But a new lawsuit alleges that CVS sold its lists to Eli Lilly (LLY), Merck (MRK), AstraZeneca (AZN) and Bayer (BAYRY) "by name, date of birth and medications taken." If true, that's sobering in terms of patient privacy -- do you really want Lilly knowing that you take Prozac? -- and probably illegal under federal law.
The U.S. Supreme Court has agreed to decide whether prescription data mining can be banned by state law to protect patient privacy or whether the transmission of such information comes under the First Amendment's free speech protections. The federal Health Insurance Portability and Accountability Act is supposed to limit the number of people who can read your medical records, and businesses are required to alert patients when their records are shipped to third parties. Two suits allege that CVS and Walgreens (WAG) may be violating that law.
One alleges that Walgreens failed to compensate patients for selling data that includes a patient's sex, age, state, the doctor's prescribing ID number, and the drug used. The other claims CVS had an "RxReview Program" which sold Rx data that drug companies used to target promotional mailings to doctors:
In the mailings funded by pharmaceutical manufacturers, Defendant CVS Caremark identified consumers by name, date of birth and medications taken by the consumer.Such a program would be in contravention of CVS's publicly stated privacy policies:
CVS/pharmacy wants you to know that nothing is more central to our operations than maintaining the privacy of your health information.CVS CEO Thomas Ryan once allegedly boasted:
We get the consumer. We have more information on the consumer and their behavior than anybody else, and we share it with our over-the-counter suppliers. We share it with our pharmacy suppliers. So we know how the consumer works.But it's not clear whether CVS still sells such information. Drug reps believe the company stopped doing so and IMS Health, a market research company that collects pharmaceutical data, is suing CVS to fulfill the unspecified terms of a drug data contract the two companies have.
Of course, CVS has a lousy history when it comes to patient data. In 2009 it paid the FTC a $2.25 million fine for improperly disposing of patient data in a Dumpster.
Related:
Image by Flickr user Daquella Manera, CC.