Prescriber Data Aggregation Goes Mainstream

Thanks to a recent Los Angeles Times editorial, Your Rx or your privacy, the somewhat esoteric world of prescribing data aggregation shows signs of going mainstream. If you've been following the litigation you'll know that Maine, New Hampshire and Vermont adopted laws that in various ways regulate the use or alienability of prescribing information. Data aggregators purchase the information from pharmacists, de-identify, otherwise process and aggregate it, before selling it on to pharmaceutical manufacturers who use it to tune their detailers' interactions with physicians. The three statutes are not identical, varying in details such as whether physician consent to data collection uses an opt-in or opt-out model.

in 2008 in IMS Health Inc. v. Ayotte, 550 F.3d 42 (1st Cir. 2008), the First Circuit upheld the New Hampshire statute. The Supreme Court showed a lack of interest and denied cert. Two years later in August 2010 a different panel of the First Circuit upheld the Maine statute, IMS Health Inc. v. Mills, 616 F.3d 7 (1st Cir. 2010). Both opinions rotated around finding that the statutes prohibited certain conduct and so did not implicate protected speech. In November 2010 the Second Circuit in IMS Health Inc. v. Sorrell, 2010 WL 4723183 (2nd Cir. 2010) disagreed, applied a commercial speech analysis, and held that the Vermont statute failed to survive intermediate scrutiny, notwithstanding a Physicians Amicus Brief submitted in the Second Circuit case and written by Kevin Outterson, Christopher Robertson, and fellow blogger David Orentlicher (available on SSRN).

Given the industry interests involved and the new circuit split it was no great surprise when the Supreme Court granted cert. (Sorrell v. IMS Health Inc., U.S., January 7, 2011). But, Supreme Court interest notwithstanding, is this brouhaha anything more than a somewhat esoteric objection to drug detailing by a few New England doctors or a mainstream privacy issue? The Los Angeles Times thinks the latter. Two classic privacy arguments seem to inform that opinion. First, there is the question of proportionality limits on data collection; these records are collected to further law enforcement interests. The use of such data should be limited to that stated purpose. Second, the specter of re-identification hangs over this data. Patient information may be removed but how close to what would be protected health information (if held by a covered entity) does this data get after its processing by sophisticated data aggregators? Nic Terry.