:: Data Mining Coalition Battles For Prescription Data
In IMS Health Inc. v. Ayotte, 550 F.3d 42 (1st Cir. N.H. 2008), cert. den., 129 S. Ct. 2864 (2009) the First Circuit upheld a Hampshire law that among other things prohibited certain transfers of physicians’ prescribing histories for use in marketing drugs to physicians.
A similar battle is now underway in the Second Circuit Court of Appeals over a Vermont statute. In IMS et al v. Sorrells a coalition of data mining entities seek to overturn an decision by the district court (IMS Health Inc. v. Sorrell, 2009 U.S. Dist. LEXIS 35594 (D. Vt.) (2009)) upholding the Vermont law. The Electronic Privacy Information Center (EPIC) has filed an amicus brief urging the Second Circuit to affirm the decision.
I have previously noted the use of data mining and some of the issues associated with the practice. HIPAA permits covered entities to share protected health information for purposes of treatment, payment and health care operations. The core health care activities of “Treatment,” “Payment,” and “Health Care Operations” are defined in the Privacy Rule at 45 CFR 164.501.
Aside from the scope of these exceptions, which has not really been tested, there is the additional constraint of state law privacy rights. Generally speaking, HIPAA does not preempt state privacy laws that address privacy of individually identifiable health information and provide greater privacy protections or privacy rights with respect to such information.
Any plan fiduciary responsible for protection of medical information privacy should give careful consideration to these issues as the sharing of heath information through data mining and analysis proliferates.
