You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

IMS Health v. Ayotte

Concerning the Use of Prescriber-Identifiable Data for Targeted Marketing

Latest News

  • Supreme Court to Hear Arguments in Medical Record Data-mining Case: Oral argument for IMS Health, Inc. v. Sorrell will take place in the Supreme Court on Tuesday, April 26, 2011. The case concerns a state privacy law that seeks to regulate data-mining of prescription records for commercial purposes. EPIC filed an amicus brief on behalf of 27 technical experts and legal scholars, as well as nine consumer and privacy groups, arguing that the privacy interest in safeguarding medical records is substantial and that the "de-identification" techniques adopted by data-mining firms do not protect patient privacy. For more information, see EPIC: IMS Health v. Sorrell. (Apr. 25, 2011)
  • Supreme Court to Hear Medical Privacy Case: The Supreme Court granted review of Sorrell v. IMS Health Inc., after the Second Circuit Court of Appeal's decision to strike down Vermont's prescription confidentiality law. The law regulates data mining companies that sell or use doctors' prescribing records containing personal information on patients. The Court of Appeals' decision, which relied on the First Amendment, diverged significantly from other decisions upholding similar laws. EPIC filed a "friend of the court" brief in support of the Vermont law, arguing that the state has a substantial interest in protecting the privacy of medial records and that the data miners' de-identification practices do not, in fact, protect patient privacy. For more, see EPIC: IMS Health v. Sorrell, EPIC: IMS Health v. Ayotte, and EPIC: Medical Privacy. (Jan. 7, 2011)
  • Vermont Urges Supreme Court to Overturn Second Circuit's Medical Privacy Decision: The State of Vermont has petitioned the Supreme Court to review a Court of Appeals decision striking down the state's prescription confidentiality law. The law regulates data mining companies that sell or use doctors' prescribing records containing personal information on patients. EPIC had filed a "friend of the court" brief in support of the law. The decision, issued by the Second Circuit, diverged significantly with two previous decisions upholding similar laws in the First Circuit. Vermont's brief emphasized the importance of consistency across state boundaries, listing twenty six other states considering proposed prescription confidentiality laws. The Vermont Attorney General wrote, "As the ability to amass volumes of information about prospective customers - including health care providers - grows, States and other regulators need guidance as to the scope of their ability to allow individual Americans to control access to and use of their information." For more information, see EPIC: IMS Health v. Sorrell and EPIC: IMS Health v. Ayotte. (Dec. 14, 2010)
  • Federal Appeals Court Overturns Vermont Medical Privacy Law: The Second Circuit Court of appeals has ruled that a Vermont privacy law violates the First Amendment. The law regulated data mining companies that sell or use doctors' prescribing records containing personal information on patients. EPIC, and several privacy technology experts, had filed a "friend of the court" brief in support of the law. Writing in dissent and siding with EPIC, Judge Debra Ann Livingston said that the majority reached the "wrong result," creating "precedent likely to have pernicious broader effects" on medical privacy case law. A similar medical privacy law was upheld by the First Circuit Court of Appeals. For more information, see EPIC: IMS Health v. Sorrell and EPIC: IMS Health v. Ayotte (Nov. 29, 2010)
  • Federal Appeals Court Upholds Maine Prescription Privacy Law: The First Circuit Court of Appeals has upheld a Maine law that bans the sale of prescriber-identifiable prescription drug data for marketing purposes. Data mining companies had challenged the law, claiming that the privacy measure violated their free speech rights, an argument that the court rejected because "the statute regulates conduct, not speech, and even if it regulates commercial speech, that regulation satisfies constitutional standards." The decision in IMS Health v. Mills followed a decision by a panel of the same court in IMS Health v. Ayotte, upholding a similar law in New Hampshire. In that case, as well as in a similar case regarding a Vermont law, EPIC and several privacy and technology experts filed "friend of the court" briefs arguing that there is a substantial state interest in privacy protection and that the data miners' de-identification practices do not, in fact, protect patient privacy. A decision in the Vermont case is expected soon. For more information, see IMS Health v. Ayotte, IMS Health v. Sorrell. (Aug. 9, 2010)
  • Supreme Court Lets Stand New Hampshire Prescription Privacy Law : The Supreme Court refused to hear a challange to the Prescription Confidentiality Act, which prohibits the sale of prescription information. The First Circuit had upheld the ban on the sale of such information. EPIC and 16 experts in privacy and technology filed a "friend of the court" brief, in support of the law, detailing the substantial privacy interests in de-identified patient data. The petitioners claimed that the law infringed on their free speech rights. See EPIC IMS Health v. Ayotte. (Jun. 29, 2009)
  • Court Upholds New Hampshire Prescription Privacy Law. Today, the First Circuit Court of Appeals upheld a New Hampshire law that bans the sale of prescriber-identifiable prescription drug data for marketing purposes. In August, EPIC and 16 experts in privacy and technology filed a "friend of the court" brief urging the federal appellate court to reverse a lower court ruling that delayed enforcement of the New Hampshire Prescription Confidentiality Act. The experts said the lower court should be reversed because there is a substantial privacy interest in patient data that the lower court failed to consider. The New Hampshire Attorney General also defended the law, calling pharmaceutical representatives "invisible intruder[s] in the physician's examination room." Data mining companies challenged the law, claiming that the privacy measure violated their free speech rights. (Nov. 18)
  • Vermont Postpones Effective Date of Prescription Privacy Law. The Vermont Legislature postponed the effective date of the state's recently-enacted prescription privacy law until July 1, 2009. The Vermont law is the subject of litigation, and is similar to the New Hampshire Prescription Confidentiality Act. (March 5, 2008)
  • Federal Appellate Court Hears Case on Prescription Data and Privacy. Today, the First Circuit Court of Appeals heard oral arguments in a case concerning a New Hampshire state law banning the sale of prescriber-identifiable prescription drug data for marketing purposes. In August, EPIC and 16 experts in privacy and technology filed a "friend of the court" brief (pdf) urging the First Circuit Court of Appeals to reverse the ruling (pdf) of the lower court, which held that the NH Prescription Confidentiality Act violated the free speech rights of data mining companies. The experts said the lower court should be reversed because there is a substantial privacy interest in de-identified patient data that the lower court failed to consider. This privacy interest, in part flows from the reality that data may not be, in fact, truly de-identified, and also because de-identified data does impact actual individuals. (January 9, 2008)
  • Maine Prescription Privacy Law Struck Down. In IMS v. Rowe (pdf), the Maine federal district court held that the state prescription privacy law violated the First Amendment. The court held that the Act improperly restricted the commercial speech rights of data brokers and pharmaceutical companies. (January 2, 2008)
  • Vermont Attorney General Postpones Enforcement of Prescription Privacy Law. The Vermont Office of the Attorney General announced today that it will delay enforcement of the state's recently-enacted prescription privacy law until September 1, 2008. The delay is intended to provide time for state agencies to develop rules and procedures for implementation. The Vermont law is the subject of litigation, and is similar to the New Hampshire Prescription Confidentiality Act. (September 27, 2007)
  • Data Miners Challenge Prescription Privacy Laws in Maine and Vermont. Today, several data miners, including IMS Health and Verispan, filed suits in Vermont (IMS v. Sorrell) and Maine (IMS v. Rowe) challenging recently-passed patient privacy laws. The Maine and Vermont laws are similar to the New Hampshire Prescription Confidentiality Act. (August 29, 2007)
  • EPIC Urges Court to Consider Privacy Interest in De-Identified Patient Data. EPIC and 16 experts in privacy and technology today filed a "friend of the court" brief (pdf) in a case concerning a New Hampshire state law banning the sale of prescriber-identifiable prescription drug data for marketing purposes. The experts urged the First Circuit Court of Appeals to reverse the ruling (pdf) of the lower court, which held that the NH Prescription Confidentiality Act violated the free speech rights of data mining companies. The experts said the lower court should be reversed because there is a substantial privacy interest in de-identified patient data that the lower court failed to consider. This privacy interest, in part flows from the reality that data may not be, in fact, truly de-identified, and also because de-identified data does impact actual individuals. (August 20, 2007)
  • New Hampshire Files Brief in First Circuit Appeal of Ayotte. New Hampshire has filed its brief (pdf) in the First Circuit Court of Appeals seeking reversal of the federal district court's decision (pdf) striking down the state Prescription Confidentiality Act. New Hampshire said that the district court erred in finding that the Act violated the First Amendment. "The Act's restriction on the use of prescriber-identifiable prescription data for commercial purposes is a regulation of non-expressive conduct, which does not abridge freedom of speech under the First Amendment," New Hampshire said. (August 14, 2007)
  • Maine Passes New Prescription Privacy Legislation. The Maine legislature has amended their Prescription Privacy Law with MRSA 1711. The bill prohibits the sale of prescription drug information that identifies, directly or indirectly, patients or health care providers. The amendment includes language substantially similar to the New Hampshire Prescription Confidentiality Act. (June 19, 2007)
  • First Circuit to Hear Ayotte Appeal. The First Circuit Court of Appeals will be hearing the state of New Hampshire's appeal in IMS Health v. Ayotte (pdf). Appellate briefs will be due in August. (June 10, 2007)
  • New Hampshire Prescription Privacy Law Struck Down. In IMS v. Ayotte (pdf), the New Hampshire federal district court held that the state Prescription Confidentiality Act violated the First Amendment. The court held that the Act improperly restricted the commercial speech rights of data brokers and pharmaceutical companies. (April 30, 2007)
  • New Hampshire Passes New Prescription Privacy Legislation. The New Hampshire state legislature unanimously passed the Prescription Confidentiality Act. The law is the first in the country to ban the sale of prescriber-identifiable prescription drug data for marketing purposes. The Act will prevent data brokers from collecting information on which individual physicians were prescribing which drugs and selling that information to pharmaceutical companies so that those companies can influence the physicians' prescribing habits. (June 30, 2006)

Introduction

On June 30, 2006, the New Hampshire legislature unanimously passed The Prescription Confidentiality Act. The law prohibits prescription information records which contain patient- or prescriber-identifiable data from being transferred, licensed, sold, or used for most commercial purposes. This includes marketing, advertising, and other forms of promotion. The Act specifically bars the use of prescriber-identifiable data for "physician detailing." IMS Health Inc. defined (pdf) "physician detailing" as a practice commonly employed by pharmaceutical sales representatives to tailor their sales pitches to individual physicians based on their past prescription writing habits. The Act explicitly permits the use of this data for such non-commercial purposes as research and education. In passing the law, the New Hampshire legislature partially attributed (pdf) high prescription drug costs to both the large financial resources pharmaceutical companies devote to detailing, and the fact that "detailed" physicians tend to write prescriptions for pricier drugs. The legislature also cited (pdf) the privacy interests of patients and physicians in preventing third parties from receiving in-depth information on every prescription they write.

The plaintiffs, IMS Health Incorporated and Verispan, LLC, are both data mining companies which purchase and compile prescription information in order to sell the data to research and academic institutions, as well as law enforcement agencies, and private organizations. Their biggest clients by far are pharmaceutical companies, which use the data extensively for detailing, they said (pdf). The plaintiffs filed suit against the State, alleging that the new Act violated their First Amendment right to free speech. Specifically, they argued (pdf) that: 1) the law was subject to strict scrutiny because it provided a content-based restriction on non-commercial free speech; 2) the law violated the First Amendment because it was not narrowly tailored to serve compelling state interests; and 3) if the judge determined that the law was subject to intermediate scrutiny because it only restricted commercial speech, it still did not advance a substantial government interest in a narrowly tailored way.

In the State's defense, the Attorney General argued (pdf): 1) that the law did not implicate the First Amendment because it did not regulate speech; and even if the Act did implicate speech, 2) the law should survive intermediate scrutiny because it advanced the State's substantial interests in promoting public health, controlling health care costs and protecting the privacy of patients and doctors, while still allowing the data to be used for non-commercial purposes.

District Court Judge Paul Barbadoro held (pdf) that the Act restricted commercial speech and was subject to intermediate scrutiny. Accordingly, the Court utilized the three-part Central Hudson Gas & Electric Corp. v. Public Service Comm. of New York intermediate scrutiny test to evaluate the law. Under Hudson, commercial speech can only be limited if it: 1) "is in support of a substantial government interest; 2) directly advances the government interest asserted; and 3) is not more extensive than necessary to serve that interest."

The District Court rejected all of the Attorney General's arguments, finding that the government did not have an interest in "preventing the dissemination of truthful commercial information" and that the law was more expansive than necessary to promote the State's interests. The Court held that the Act did not advance a substantial interest in protecting the privacy of patients and health care providers because the law targets only professional (not personal) information, there is no reasonable expectation of privacy in this information, and the Act itself does not attempt to keep the information entirely private.

New Hampshire appealed to the First Circuit Court of Appeals. The First Circuit heard oral arguments in the case on January 9, 2008. On November 18, 2008, the First Circuit Court of Appeals upheld the constitutionality of The Prescription Confidentiality Act.

The Supreme Court later heard a separate, but related case in IMS Health v. Sorrell, where the Court struck down Vermont's prescription privacy law. For more information see EPIC: IMS Health v. Sorrell.

EPIC's Interest

According to evidence introduced at trial (pdf) there are approximately 1.4 million health care providers in the United States. These providers write billions of prescriptions each year for more than 8,000 different pharmaceutical products. These prescriptions are filled at 54,000 retail pharmacies throughout the country. The retail pharmacies acquire records for every prescription they fill. These records include: patient name; prescriber identification; drug name; dosage requirement; quantity; and date filled. In order to comply with federal and state privacy laws, patient identifying information is encrypted and de-identified, often with software installed by the data mining companies themselves. The rest of the prescription record remains intact. Thus, a patient's entire drug history is correlated, and each provider can be identified along with their prescribing habits. This practice raises privacy concerns for both patients and health care providers.

Although patient information is encrypted and de-identified, encryption is not a foolproof method to protect privacy. Security breaches are common, and with relatively little information, it is possible to re-identify patients. See Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923, 929 (7th Cir. 2004). This represents an alarming loss of privacy which could have greater implications for patients. For example, patients may be less likely to fill prescriptions for certain conditions, or they may be less likely to seek initial health care.

Physicians also have an interest in keeping their prescription writing habits confidential. According to evidence introduced at trial (pdf), disclosure of such information is used to target physicians and may influence the medicines prescribed to their patients. According to a 2002 Kaiser Family Foundation study, 74 percent of doctors disapprove of drug companies accessing prescription information. Additionally, doctors also have a professional responsibility to ensure the privacy of their patient population.

EPIC recommends that prescription information instead be identifiable by zip code or medical specialty and used only for non-commercial purposes. This would provide useful information to researchers, pharmaceutical companies, and other entities while still affording additional privacy protections to both providers and patients.

Legal Documents

First Circuit Court of Appeals (all PDFs)

District Court (all PDFs)

Amici in District Court (all PDFs):

Maine and Vermont Legislation and Litigation

In the summer of 2007, Maine and Vermont enacted laws similar to the New Hampshire Prescription Confidentiality Act. On August 29, 2007, several data miners, including IMS Health and Verispan, filed lawsuits in federal court, challenging the laws. In IMS v. Rowe, the court struck down the Maine law, citing First Amendment concerns and referencing the trial court's opinion in IMS v. Ayotte. Maine resides in the First Circuit, and will be directly effected by the Appellate Court's resolution of IMS v. Ayotte. IMS v. Sorrell, which involves dateminers' challenges to Vermont's prescription privacy law, is pending. On March 5, 2008, Vermont postponed the effective date of its prescription privacy law until July 1, 2009.

Additional State Legislation

Legislation similar to New Hampshire's Prescription Confidentiality Law is currently pending in numerous states. Each of these states has a strong interest in the outcome of IMS v. Ayotte.

  • Arizona: SB 1518 was introduced on January 30, 2007. The bill has not yet moved from committee.
  • District of Columbia: The SafeRx Act of 2007 (pdf) was introduced on November 16, 2007, and is in the D.C. Council Committee on Health.
  • Illinois: HB 1459 was introduced on February 21, 2007. The bill was referred to the Rules Committee on March 23, 2007.
  • Kansas: SB 229 (pdf) was introduced in the Kansas legislature on January 30, 2007.
  • Maine: LD 4 was enacted, and has been the subject of litigation. NOTE: Maine has passed MRSA 1711, which prohibits the sale of prescription drug information that identifies, directly or indirectly, patients or health care providers.
  • Maryland: SB 266 was introduced on January 30, 2007. No action has been taken since a Finance Committee hearing on March 12, 2007.
  • Massachusetts: SB 1275 is pending.
  • New York: The State Assembly is currently considering S2056 and S6992. S2056 was introduced on January 30, 2007 and referred to the Higher Education Committee on January 9, 2008. S6992 was introduced on March 23, 2007 and has been referred to the Health Committee.
  • North Carolina: SB159 was introduced on February 13, 2007, and has been referred to the Committee on Commerce, Small Business, and Entrepreneurship.
  • Rhode Island: S. 0653 (pdf) was introduced into the General Assembly during the January session. The bill was referred to the Senate Health and Human Services Committee on February 15, 2007.
  • Vermont: HB 92 was introduced into the House on January 23, 2007. The bill has not yet received a second reading.
  • Washington: HB 1850 (pdf) was introduced on January 30, 2007. The bill was returned to the Rules Committee for a second reading on March 15, 2007, and was automatically reintroduced for the 2008 session.
  • West Virginia: SB 434 was introduced on February 1, 2007. The bill was referred to the Committee on Health and Human Resources, and carries over into the 2008 session.

News Stories

Related Resources

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security