Supreme Court Case on Rx Data Mining Requires Nuanced Understanding of Privacy

On April 26, the U.S. Supreme Court will hear arguments in a case that could have significant implications for patient privacy. Sorrell v. IMS Health, Inc., et al. challenges the constitutionality of a Vermont statute that prohibits the use of drug prescribing information for the purpose of marketing drugs to physicians and other prescribers, without the consent of the prescriber. The case has the potential to do real damage to privacy protections, but understanding the various risks posed by the case requires some careful unpacking of the ways in which "privacy" is -- and is not -- at issue.

Vermont legislators wanted to control the costs associated with increased prescribing of brand-name drugs and to address safety issues related to increasing off-label drug uses. So they adopted a law saying that drug companies cannot obtain data about doctors' prescribing habits and use the information to market drugs to prescribers unless the doctors have consented.

The data at issue contain doctors' names but do not include patient names. The data are "patient de-identified" pursuant to standards established under the HIPAA privacy rule. HIPAA already prohibits the sale of patient-identified data for marketing to patients or to doctors. Vermont relied on the HIPAA standards and instead targeted the use of prescriber identifiable data for marketing purposes.

Read more.

SCOTUS Blog on Sorrell v. IMS Health