You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

IMS Health v. Sorrell

Concerning the Use of Prescriber-Identifiable Data for Targeted Marketing

Latest News

  • Supreme Court Strikes Down Prescription Privacy Law: In a 6-3 decision, the Supreme Court struck down Vermont's prescription privacy law. IMS Health, Inc. v. Sorrell held that the Vermont statute, which bars disclosure of prescription data for marketing purposes, violates data mining firms' free speech rights. Vermont "burdened a form of protected expression that it found too persuasive. At the same time, the State has left unburdened those speakers whose messages are in accord with its own views. This the State cannot do." the Court wrote. The Court suggested that a more privacy-protective statute might have withstood Constitutional scrutiny, writing "the State might have advanced its asserted privacy interest by allowing the information’s sale or disclosure in only a few narrow and well-justified circumstances. A statute of that type would present quite a different case than the one presented here." EPIC filed an amicus brief on behalf of 27 technical experts and legal scholars, as well as nine consumer and privacy groups, arguing that the privacy interest in safeguarding medical records is substantial and that the "de-identification" techniques adopted by data-mining firms do not protect patient privacy. For more information, see EPIC: IMS Health v. Sorrell. (Jun. 23, 2011)
  • In Data Mining Case, Supreme Court Explores Privacy: A spirited dialogue about the right of privacy dominated oral argument in a Supreme Court case on medical record data mining. Justice Breyer implied that the Federal Trade Commission could prevent existing commercial uses of private medical data by deeming the practices to be unfair and deceptive. Justices Sotomayor and Kennedy both pressured the data mining companies to focus on the constitutionality of preventing the spread of sensitive medical information. Justice Scalia even challenged the Vermont Medical Privacy Statute under review as insufficiently dedicated to protecting prescriber privacy. EPIC filed an amicus brief on behalf of 27 technical experts and legal scholars, as well as nine consumer and privacy groups, arguing that the privacy interest in safeguarding medical records is substantial and that the de-identification techniques adopted by data mining firms do not protect patient privacy. For more information, see EPIC: IMS Health v. Sorrell. (Apr. 27, 2011)
  • Supreme Court to Hear Arguments in Medical Record Data-mining Case: Oral argument for IMS Health, Inc. v. Sorrell will take place in the Supreme Court on Tuesday, April 26, 2011. The case concerns a state privacy law that seeks to regulate data-mining of prescription records for commercial purposes. EPIC filed an amicus brief on behalf of 27 technical experts and legal scholars, as well as nine consumer and privacy groups, arguing that the privacy interest in safeguarding medical records is substantial and that the "de-identification" techniques adopted by data-mining firms do not protect patient privacy. For more information, see EPIC: IMS Health v. Sorrell. (Apr. 25, 2011)
  • EPIC Files Amicus Brief on Risk of "Reidentification," Urges US Supreme Court to Uphold Vermont Privacy Law: EPIC has filed an amicus brief in Sorrell v. IMS Health, a case now before the US Supreme Court concerning a state privacy law that seeks to regulate datamining of prescription records for commercial purposes. Datamining companies have challenged the Vermont law, arguing that it violates the First Amendment and also that there is no privacy interest in the transfer of "deidentified" prescriber records. The EPIC brief, filed on behalf of 27 technical experts and legal scholars, as well as 9 consumer and privacy groups, argues that the privacy interest in safeguarding medical records is substantial and that the "deidentification" techniques adopted by data-mining firms do not protect patient privacy. EPIC's amicus brief for the lower appellate court was cited in the opinion of Judge Deborah Ann Livingston. As Judge Livingston explained, "neither appellants nor the majority advances any serious argument that the state does not have a legitimate and substantial interest in medical privacy . . . " For more information, see EPIC: IMS Health, Inc. v. Sorrell. (Feb. 28, 2011)
  • Supreme Court to Hear Medical Privacy Case: The Supreme Court granted review of Sorrell v. IMS Health Inc., after the Second Circuit Court of Appeal's decision to strike down Vermont's prescription confidentiality law. The law regulates data mining companies that sell or use doctors' prescribing records containing personal information on patients. The Court of Appeals' decision, which relied on the First Amendment, diverged significantly from other decisions upholding similar laws. EPIC filed a "friend of the court" brief in support of the Vermont law, arguing that the state has a substantial interest in protecting the privacy of medial records and that the data miners' de-identification practices do not, in fact, protect patient privacy. For more, see EPIC: IMS Health v. Sorrell, EPIC: IMS Health v. Ayotte, and EPIC: Medical Privacy. (Jan. 7, 2011)
  • Vermont Urges Supreme Court to Overturn Second Circuit's Medical Privacy Decision: The State of Vermont has petitioned the Supreme Court to review a Court of Appeals decision striking down the state's prescription confidentiality law. The law regulates data mining companies that sell or use doctors' prescribing records containing personal information on patients. EPIC had filed a "friend of the court" brief in support of the law. The decision, issued by the Second Circuit, diverged significantly with two previous decisions upholding similar laws in the First Circuit. Vermont's brief emphasized the importance of consistency across state boundaries, listing twenty six other states considering proposed prescription confidentiality laws. The Vermont Attorney General wrote, "As the ability to amass volumes of information about prospective customers - including health care providers - grows, States and other regulators need guidance as to the scope of their ability to allow individual Americans to control access to and use of their information." For more information, see EPIC: IMS Health v. Sorrell and EPIC: IMS Health v. Ayotte. (Dec. 14, 2010)
  • Federal Appeals Court Overturns Vermont Medical Privacy Law: The Second Circuit Court of appeals has ruled that a Vermont privacy law violates the First Amendment. The law regulated data mining companies that sell or use doctors' prescribing records containing personal information on patients. EPIC, and several privacy technology experts, had filed a "friend of the court" brief in support of the law. Writing in dissent and siding with EPIC, Judge Debra Ann Livingston said that the majority reached the "wrong result," creating "precedent likely to have pernicious broader effects" on medical privacy case law. A similar medical privacy law was upheld by the First Circuit Court of Appeals. For more information, see EPIC: IMS Health v. Sorrell and EPIC: IMS Health v. Ayotte (Nov. 29, 2010)
  • Federal Appeals Court Upholds Maine Prescription Privacy Law: The First Circuit Court of Appeals has upheld a Maine law that bans the sale of prescriber-identifiable prescription drug data for marketing purposes. Data mining companies had challenged the law, claiming that the privacy measure violated their free speech rights, an argument that the court rejected because "the statute regulates conduct, not speech, and even if it regulates commercial speech, that regulation satisfies constitutional standards." The decision in IMS Health v. Mills followed a decision by a panel of the same court in IMS Health v. Ayotte, upholding a similar law in New Hampshire. In that case, as well as in a similar case regarding a Vermont law, EPIC and several privacy and technology experts filed "friend of the court" briefs arguing that there is a substantial state interest in privacy protection and that the data miners' de-identification practices do not, in fact, protect patient privacy. A decision in the Vermont case is expected soon. For more information, see IMS Health v. Ayotte, IMS Health v. Sorrell. (Aug. 9, 2010)
  • EPIC Urges Appeals Court to Protect Prescription Data: EPIC filed a friend of the court brief in the Court of Appeals for the Second Circuit today, urging the judges to uphold a Vermont law that regulates companies that sell or use prescriber-identifiable data for marketing. Several data-mining companies challenged the law after it was upheld by a district court. EPIC's amicus brief supports the district court's conclusion. The EPIC brief argues that Vermont has a substantial state interest in privacy protection and that the data miners' de-identification practices do not, in fact, protect patient privacy. For more, see IMS Health v. Sorrell and EPIC Medical Privacy. (Sep. 15, 2009)
  • Vermont Postpones Effective Date of Prescription Privacy Law. The Vermont Legislature postponed the effective date of the state's recently-enacted prescription privacy law until July 1, 2009. The Vermont law is the subject of litigation, and is similar to the New Hampshire Prescription Confidentiality Act. (March 5, 2008)
  • Vermont Attorney General Postpones Enforcement of Prescription Privacy Law. The Vermont Office of the Attorney General announced today that it will delay enforcement of the state's recently-enacted prescription privacy law until September 1, 2008. The delay is intended to provide time for state agencies to develop rules and procedures for implementation. The Vermont law is the subject of litigation, and is similar to the New Hampshire Prescription Confidentiality Act. (September 27, 2007)
  • Data Miners Challenge Prescription Privacy Laws in Maine and Vermont. Today, several data miners, including IMS Health and Verispan, filed suits in Vermont (IMS v. Sorrell) and Maine (IMS v. Rowe) challenging recently-passed patient privacy laws. The Maine and Vermont laws are similar to the New Hampshire Prescription Confidentiality Act. (August 29, 2007)

Summary

This case started in the United States District Court in the District of Vermont, which upheld Act 80. Then, on appeal, the United States Court of Appeals for the Second Circuit struck the law down. Writing in dissent and citing EPIC's amicus brief, Judge Debra Ann Livingston insisted that medical privacy was a substantial state interest in this case and argued that the law was constitutional under First Amendment case law.The Supreme Court agreed to review the Second Circuit's opinion on January 7, 2011. On June 23, 2011 the Court issued a 6-3 opinion striking down Vermont's law, suggesting that a more privacy-protective statute might have withstood Constitutional scrutiny.

Passage of the Vermont Prescription Confidentiality Act

In 2007, the Vermont legislature passed the “Act Relating to Increasing Transparency of Prescription Drug Pricing and Information”, Vt. Stat. Ann. tit. 18, § 4631 (2007), ("Vermont Statute"), aimed at protecting consumer privacy, enhancing public health, and containing prescription drug costs. The law prohibits regulated entities from selling or using prescriber-identifiable data for marketing or promoting prescription drugs unless the prescriber consents (opts-in). In cases where prescribers fail to opt-in, the law bars the use of prescriber-identifiable data for "physician detailing." IMS Health Inc. defines "physician detailing" as a practice commonly employed by pharmaceutical sales representatives to tailor their sales pitches to individual physicians based on their past prescription writing habits. The Vermont Statute explicitly permits the use of data for such non-commercial purposes as research and education.

The legislative intent in passing the Vermont statute, as stated in Section 17(d), was to "protect[] the privacy of prescribers and prescribing information." Section 17(c) prohibits health insurers, self-insured employers, electronic transmission intermediary, pharmacies, or similar entities from selling, licensing, exchanging for value regulated records containing prescriber-identifiable information for marketing or promoting a prescription drug, unless the prescriber consents.

District Court Upholds State Law

Plaintiffs filed suit against Vermont, alleging that the new Act violated their First Amendment right to free speech. There will be two sets of plaintiffs before the Supreme Court. Plaintiffs IMS Health Incorporated and Verispan, LLC, are both data mining companies that purchase and compile prescription information in order to sell the data to private companies, law enforcement agencies, and research institutions. Their biggest clients by far are pharmaceutical companies, which use the data extensively for detailing, they said. The case was consolidated with an analogous suit filed by the Pharmaceutical Research and Manufacturers of America (PhRMA). PhRMA has several member companies it represents in the litigation.

Before the district court, plaintiffs argued that: (1) Section 17(d) of the Vermont Act restricted the speech of pharmaceutical companies in violation of the First and Fourteenth Amendments; (2) Section 21(c) of the Vermont Act was preempted by federal law because it obstructs the ability of FDA to achieve its regulatory objectives; (3) Section 21(c) of the Vermont Act violates the Commerce Clause of the U.S. Constitution by regulating almost exclusively out-of-state commerce; and (4) Section 20 of the Vermont Act violates the First and Fourteenth Amendments by forcing pharmaceutical companies to subsidize speech favoring competitors’ products.

In the State's defense, the Attorney General argued (pdf): 1) that the law did not implicate the First Amendment because it did not regulate speech; and even if the Act did implicate speech, 2) the law should survive intermediate scrutiny under Central Hudson because it advanced the State's substantial interests in promoting public health, controlling health care costs and protecting the privacy of patients and doctors, while still allowing the data to be used for non-commercial purposes; (3) the statute did not violate the commerce clause because the statute purely regulates Vermont transactions and businesses.

In an opinion issued on April 23, 2009, District Court Judge John Garvan Murtha held that the Act restricted speech. However, the court determined that the speech implicated by the release of prescriber-identifiable data was not fully-protected speech under the Constitution. Rather, the speech in this case was commercial speech and was subject to intermediate scrutiny. Accordingly, the Court utilized the four-part intermediate scrutiny test to evaluate the law underCentral Hudson Gas & Electric Corp. v. Public Service Comm. of New York, 447 U.S. 557 (1980). Under Central Hudson, commercial speech can only be limited if it: is 1) truthful and non-misleading; 2) is in support of a substantial government interest; 3) directly advances the government interest asserted; and 4) is not more extensive than necessary to serve that interest.

The District Court generally agreed with the attorney general's arguments, finding that the "law is sustainable on the State's cost containment and public health interests, which are substantial . . . ." Therefore, the court held that the law's restrictions on data disclosure were "in reasonable proportion to the State's interests." Although the court did not believe that "prescriber privacy [was] a sufficient interest to justify the law," it did not fully consider the merits of Vermont's privacy claim.

Appellate Court Overturns District Court and Strikes Down State Law

On May 4, IMS Health appealed (pdf) to the Second Circuit Court of Appeals. The Second Circuit heard oral arguments during the week of October 12, 2009. On November 23, 2010, the Second Circuit held that the law violated the First Amendment, finding that the Act did not advance substantial state interests.

The most important excerpts of the Second Circuit opinion relate to medical privacy, which the Second Circuit found did not constitute a substantial state interest:

  • "[T]he statute plainly does not protect physician privacy . . . . Physician privacy might be protected if the statute prohibited the collection and aggregation of [prescriber-identifiable] data for any purpose, or if the use of such data were permitted in only rare and compelling circumstances." (Pg. 30)
  • "Vermont contemplates that the data will still be collected and used, albeit for purposes other than marketing. For example, the state acknowledges that the statute permits the use of [prescriber-identifiable] data for 'health care research, treatment, and safety-related uses.'" (Pg. 30)
  • "[W]hat the appellees refer to as 'medical privacy' is actually two distinct interests. The first is an interest in the integrity of the prescribing process itself, and the second is an interest in preserving patients' trust in their doctors by preventing patients from believing that their physicians are inappropriately influenced by [prescriber-identifiable] data-driven marketing . . . . However, the state's asserted interest in medical privacy is too speculative to qualify as a substantial state interest under Central Hudson." (Pg. 31)
  • "To the extent that the record might suggest [prescriber-identifiable] data has damaged the relationship between doctors and patients, the evidence is either speculative or merely indicates that some doctors do not approve of detailing or the use of PI data in detailing." (Pg. 32)
Writing in dissent and citing EPIC's amicus brief, Judge Debra Ann Livingston said that the majority reached the "wrong result," creating "precedent likely to have pernicious broader effects" on medical privacy case law. Judge Livingston insisted that medical privacy was a substantial state interest in the case before the court and argued that the law was constitutional under First Amendment case law.

Supreme Court Reviews Case

On December 13, 2010, Vermont petitioned the Supreme Court to review the Second Circuit's decision. Vermont's brief emphasized the importance of consistency across state boundaries, listing twenty six other states considering proposed prescription confidentiality laws. The Vermont Attorney General wrote, "As the ability to amass volumes of information about prospective customers - including health care providers - grows, States and other regulators need guidance as to the scope of their ability to allow individual Americans to control access to and use of their information."

On January 7, 2011 the Supreme Court granted certiorari. Oral argument took place on April 26, 2011. On June 23, 2011, the Court issued its final opinion. In a 6-3 decision, the Court struck down Vermont's prescription privacy law. The opinion held that the Vermont statute, which bars disclosure of prescription data for marketing purposes, violates data mining firms' free speech rights. Vermont "burdened a form of protected expression that it found too persuasive. At the same time, the State has left unburdened those speakers whose messages are in accord with its own views. This the State cannot do." the Court wrote.

The Court suggested that a more privacy-protective statute might have withstood Constitutional scrutiny, writing "the State might have advanced its asserted privacy interest by allowing the information’s sale or disclosure in only a few narrow and well-justified circumstances. A statute of that type would present quite a different case than the one presented here."

EPIC's Interest

There are approximately 1.4 million health care providers in the United States. These providers write billions of prescriptions each year for more than 8,000 different pharmaceutical products. These prescriptions are filled at 54,000 retail pharmacies throughout the country. The retail pharmacies acquire records for every prescription they fill. These records include: patient name; prescriber identification; drug name; dosage requirement; quantity; and date filled. In order to comply with federal and state privacy laws, patient identifying information is encrypted and de-identified, often with software installed by the data mining companies themselves. The rest of the prescription record remains intact. Thus, a patient's entire drug history is correlated, and each provider can be identified along with their prescribing habits. This practice raises privacy concerns for both patients and health care providers.

Although patient information is encrypted and de-identified, encryption is not a foolproof method to protect privacy. Security breaches are common, and with relatively little information, it is possible to re-identify patients. See Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923, 929 (7th Cir. 2004). This represents an alarming loss of privacy which could have greater implications for patients. For example, patients may be less likely to fill prescriptions for certain conditions, or they may be less likely to seek initial health care.

Physicians also have an interest in keeping their prescription writing habits confidential. According to evidence introduced at trial, disclosure of such information is used to target physicians and may influence the medicines prescribed to their patients. According to a 2002 Kaiser Family Foundation study, 74 percent of doctors disapprove of drug companies accessing prescription information. Additionally, doctors also have a professional responsibility to ensure the privacy of their patient population.

In IMS Health v. Ayotte, 550 F.3d 42 (1st Cir. 2008), cert. denied, 2009 U.S. LEXIS 4744 (2009), the Court of Appeals for the First Circuit upheld the New Hampshire law that bans the sale of prescriber-identifiable prescription drug data for marketing purposes. The New Hampshire legislature unanimously passed the Prescription Confidentiality Act preventing data brokers from collecting prescriber-identifiable and prescription information and selling such information to pharmaceutical companies to influence physicians' prescribing habits. The District Court held that the state's Prescription Confidentiality Act violated the First Amendment and improperly restricted commercial speech rights of data brokers and pharmaceutical companies. In an appeal to the First Circuit, EPIC and 16 privacy and technology experts submitted a friend of the Court brief urging a reversal of the lower court ruling. The EPIC brief argued that the substantial privacy interest in de-identified patient data was not considered by the lower court. The privacy interest, in part flows from the realities that data may not be, in fact, truly de-identified, and that de-identified data does impact actual individuals. In November 2008, the First Circuit reversed the ruling and in June 2009, the U.S. Supreme Court refused to hear the challenge to the Prescription Confidentiality Act.

Legal Documents

Supreme Court

Certiorari Stage Documents

United States Court of Appeals for the Second Circuit

United States District Court for the District of Vermont

Amicus Briefs (all PDFs):

Related Cases

IMS Health v. Ayotte

In IMS Health v. Ayotte, IMS Health Inc. v. Ayotte, 550 F.3d 42 (1st Cir. 2008), the Court of Appeals for the First Circuit upheld the New Hampshire law that bans the sale of prescriber-identifiable prescription drug data for marketing purposes. The New Hampshire legislature unanimously passed the Prescription Confidentiality Act, preventing data brokers from collecting prescriber-identifiable and prescription information and selling such information to pharmaceutical companies to influence physicians' prescribing habits. The District Court held(PDF) that the state's Prescription Confidentiality Act violated the First Amendment and improperly restricted commercial speech rights of data brokers and pharmaceutical companies. In an appeal to the First Circuit, EPIC and 16 privacy and technology experts submitted a "Friend of the Court" brief(PDF) urging a reversal of the lower court ruling. The EPIC brief argued that the substantial privacy interest in de-identified patient data was not considered by the lower court. The privacy interest, in part flows from the realities that data may not be, in fact, truly de-identified, and that de-identified data does impact actual individuals. In November 2008, the First Circuit reversed (PDF) the ruling and in June 2009, the U.S. Supreme Court refused to hear the challenge to the Prescription Confidentiality Act.

NASA v. Nelson

In NASA v. Nelson, ___ U.S. ___ (2011), the issue recently before the Supreme Court was whether the NASA scientists' right to "informational privacy" prohibits NASA from collecting information concerning the individuals' medical records as a condition of employment. Twenty-seven members of the EPIC Advisory Board urged the Court in EPIC’s “friend of the court” brief to protect the privacy of scientists working at NASA, arguing that compelled disclosure would risk exposing sensitive, personal health information that is insufficiently protected by NASA. The Supreme Court found that NASA's inquiries implicate "a privacy interest of Constitutional significance," but that the requests were reasonable and that the information would be protected under the Privacy Act. The Court declined to decide whether there actually is a constitutional right to "informational privacy."

Whalen v. Roe

The claim of information privacy first arose in a case concerning a medical record database, in Whalen v. Roe, 429 U.S. 589 (1977). In that case, Justice Stevens wrote: [T]he constitutional question presented is whether the State of New York may record, in a centralized computer file, the names and addresses of all persons, who have obtained, pursuant to a doctor’s prescription, certain drugs for which there is both a lawful and an unlawful market. Whalen, 429 U.S. at 591. The Court recognized the right to informational privacy as “the individual interest in avoiding disclosure of personal matters,” Id. at 599, but ultimately concluded that there were sufficient safeguards in place to safeguard the information and that therefore a right of informational privacy would not defeat the state collection requirement.

NCTA v. FCC

NCTA v. FCC, 555 F.3d 996, 1000 (D.C. Cir. 2009), concerned personal data collected by telecommunications corporations about a consumer's telephone calls. The data, called customary proprietary network information (CPNI), includes the time, date, duration and destination number of each call, the type of network a consumer subscribes to, and any other information that appears on the consumer's telephone bill. The Federal Communications Commission (FCC) decided to regulate access to CPNI at EPIC's urging. The FCC's final rule requires phone companies to obtain affirmative, opt-in consent from each individual whose CPNI they disclose. In August 2007, the National Cable and Telecommunications Association (NCTA) filed a complaint with a federal appeals court challenging the FCC's new rules, claiming a First Amendment right to disclose customer information. EPIC filed an amicus brief in the case on behalf of consumer and privacy organizations, as well as technical and legal experts arguing that: (1) individuals have a significant interest in controlling distribution of their personal information and in preventing others from profiting by its use; (2) the FCC's Order does not restrict NCTA's right to communicate with its customers; (3) the FCC order is like many state and federal laws that limit the disclosure of personal information by private entities without implicating the First Amendment; and (4) the FCC properly interpreted the intent of the Congress by choosing the most effective means for protecting the privacy interests of consumers. The Court upheld the regulations, rejecting industry challenges to the rule. The Court recognized that "the government has a substantial interest in protecting the privacy of customer information and that requiring customer approval advances that interest," and cited EPIC's petition as spurring the rulemaking process.

Reno v. Condon

In Reno v. Condon, 528 U.S. 141 (2000), EPIC's amicus brief argued that the 1994 Drivers Privacy Protection Act ("DPPA") was a constitutional exercise of Congressional authority and did not violate the Tenth Amendment. In that case, the Supreme Court considered whether the DPPA, which prohibits the disclosure of personally identifiable information and motor vehicle records by public agencies and private persons, was an unconstitutional breach of federalism principles. EPIC argued that individuals have a reasonable expectation of privacy in their DMV records and a constitutional interest in limiting the collection and use of personal information obtained by state agencies. The Court held that the Act appropriately restricts States from disclosing a driver’s personal information without the driver’s consent.

Useful Resources from EPIC's Advisory Board Members

Maine and New Hampshire Legislation and Litigation

On June 30, 2006, the New Hampshire legislature unanimously passed The Prescription Confidentiality Act. The law prohibits prescription information records which contain patient- or prescriber-identifiable data from being transferred, licensed, sold, or used for most commercial purposes. This includes marketing, advertising, and other forms of promotion. The Act specifically bars the use of prescriber-identifiable data for "physician detailing." This law was upheld by the First Circuit in IMS v. Ayotte. In the summer of 2007, Maine enacted similar legislation. Several data miners, including IMS Health and Verispan, filed lawsuits in federal court challenging the law. In IMS v. Rowe, the district court struck down the Maine law, citing First Amendment concerns and referencing the trial court's opinion in IMS v. Ayotte. However, the IMS v. Ayotte decision casts substantial doubt on this ruling since Maine resides in the First Circuit.

Additional State Legislation

Each of these states has a strong interest in the outcome of IMS v. Sorrell.

  • Arizona: SB 1518 was introduced on January 30, 2007. The bill has not yet moved from committee.
  • District of Columbia: The SafeRx Act of 2007 (pdf) was introduced on November 16, 2007, and is in the D.C. Council Committee on Health.
  • Illinois: HB 1459 was introduced on February 21, 2007. The bill was referred to the Rules Committee on March 23, 2007.
  • Kansas: SB 229 (pdf) was introduced in the Kansas legislature on January 30, 2007.
  • Maine: LD 4 was enacted, and has been the subject of litigation. NOTE: Maine has passed MRSA 1711-E, which prohibits the sale of prescription drug information that identifies, directly or indirectly, patients or health care providers.
  • Maryland: SB 266 was introduced on January 30, 2007. No action has been taken since a Finance Committee hearing on March 12, 2007.
  • Massachusetts: SB 1275 is pending.
  • New York: The State Assembly is currently considering S2056 and S6992. S2056 was introduced on January 30, 2007 and referred to the Higher Education Committee on January 9, 2008. S6992 was introduced on March 23, 2007 and has been referred to the Health Committee.
  • North Carolina: SB159 was introduced on February 13, 2007, and has been referred to the Committee on Commerce, Small Business, and Entrepreneurship.
  • Rhode Island: S. 0653 (pdf) was introduced into the General Assembly during the January session. The bill was referred to the Senate Health and Human Services Committee on February 15, 2007.
  • Vermont: HB 92 was introduced into the House on January 23, 2007. The bill has not yet received a second reading.
  • Washington: HB 1850 (pdf) was introduced on January 30, 2007. The bill was returned to the Rules Committee for a second reading on March 15, 2007, and was automatically reintroduced for the 2008 session.
  • West Virginia: SB 434 was introduced on February 1, 2007. The bill was referred to the Committee on Health and Human Resources, and carries over into the 2008 session.

News Reports

Related Resources

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security