Author Received $21,000 from Bill Benefactors

SACRAMENTO, CA — A consumer advocate will speak out against proposed legislation that would create a loophole in existing law which bars the sharing of private medical information without a patient’s consent. The bill, SB 1096 (Calderon), does so by deeming what amounts to marketing material to be necessary to provide health care services. Transfers of private medical information — including a patient’s illnesses and prescribed medications — to private companies hired by drug manufacturers to increase prescription drug sales would occur without the patient’s knowledge or consent. Such databases of medical records are attractive targets to hackers and identity thieves.

In the last 2 years, the bill author, Senator Ronald Calderon, has received at least $21,690 from drug companies and others that will benefit from the legislation.

FTCR’s letter to the Senate Health Committee opposing the bill is below.

The Honorable Sheila Kuehl
Chair, Senate Health Committee
State Capitol, Room 5108
Sacramento, CA 95814
RE: SB 1096 – OPPOSE

Dear Senator Kuehl,

We are writing you and members of the Senate Health Committee to urge your opposition to SB 1096. This bill would create a loophole in existing law that bars the sharing of private medical information without a patient’s consent. The
bill does so by deeming what amounts to marketing material to be necessary to provide health care services. In addition to the broad privacy concerns outlined below, SB 1096 could open the floodgates of inappropriate sharing of medical
information. Even more certain is that a "service" funded by pharmaceutical corporations must serve its employer, emphasizing the virtues of a particular medication.

The bill would allow companies like Adheris, the bill sponsor, to access patients’ prescription drug purchases, putatively only for the purpose of communicating with patients to increase "adherence" to the scheduled regimen. But it is clearly, for the drug companies that pay Adheris, a direct marketing tool. Adheris is likely to directly or indirectly encourage a patient to stay on a branded medication, even if a cheaper generic is available.

The advice provided directly to individual patients by Adheris, by mail or e-mail or phone, may also be in conflict with doctors’ advice and decisions.

From the Adheris web site:

– How the medication should be taken.

– How long they should remain on therapy.

– What to expect (i.e., side effects, onset of action, etc.) while they are on therapy."

1. There is no way in many instances for Adheris to know exactly why a medication has been prescribed or how a doctor expects it to be taken.

2. Adheris’ advice about how long a medication should be taken may conflict with that of the physician who actually knows the patient, and who may wish to stop the medication or switch to a different medication. If such conflicts occur for even a short time, they may reduce patients’ confidence in their doctor.

3. The patient’s doctor may want him or her to report all significant side effects (particularly among the elderly, weak or immune-compromised), not just those that Adheris may describe as serious or life-threatening.

This seemingly benign "service" is also a violation of a patient’s right to control his or her personal medical information. The bill would allow a pharmacy to share information about a patient’s medical conditions and prescription drug regimen to a third party proprietary business hired by drug companies to increase drug sales. Such transfers would occur without the patient’s knowledge or consent.

The bill is premised on the idea that mailed reminders will help ensure that patients take their medications. The bill sponsor provides no evidence to support the claim. Further, if in fact a reminder to take medication was the goal of the bill, the pharmacy itself could send the reminder without necessitating the transfer of private medical data to a third-party business. If pharmaceutical companies were only interested in adherence, they could fund payments to pharmacists to directly provide the service. Even if the pharmacy used a third-party mail house to send the notice, the information could be encrypted so that it would not be identifiable to a particular patient.

However, a simple reminder is not the purpose of these mailings. Among other things, Adheris’ marketing materials promise drug companies that they will build brand loyalty and prescription renewals. From the company’s website:

"Adheris provides literature so that patients are more informed about their condition and the medication used to treat it, promoting proactive behavior in self-education and self-management of the disease."

A marketing company employed by drug manufacturers to increase the sales of prescription drugs have no place in "informing" patients about their illness. Provisions in the bill that require copies of marketing materials to be submitted to the Food and Drug Administration Division of Drug Marketing, Advertising and Communications provides little protection given the lax standards employed by the FDA.

Further, a pharmacist is required by law to counsel a patient about the use of medication prescribed by a physician. That pharmacist should also be required to ask the patient if he or she wants private medical information shared with a
for-profit company employed by drug companies. Barring positive informed consent from the patient, the private medical information should not be traded, sold or shared.

Another issue is the threat of misuse of the data by allowing a third party to have access to it. Minimally, the bill would usher in a new era of electronic databases containing private, personally identifiable medical information. Such databases have already proven attractive targets to hackers and identity thieves. The problem is compounded when confidential medical information is sent electronically. According to Adheris:

"These programs can be implemented in various forms, including letters, e-mail messages, newsletters, brochures, and phone calls."

According to the bill, "[a]ccess to the information shall be limited to authorized persons." Does mean that Adheris can "authorize" another company, possibly a health insurance company investigating a claim or an employer checking up on a prospective employee, to use the information?

Further, medical records are often coded with a patient’s Social Security number. Information aggregators that get access to medical records could use the Social Security number to combine medical information with a wide range of information already available, including credit information and lists of credit card purchases and bank account balances. The resulting data file would be immensely valuable to companies looking to market products or, in the case of insurers or even mortgage lenders, deny a policy or loan based on combined health and financial data. The digital dossier, maintained without direct government oversight, would also be an attractive target for hackers and identity thieves.

As personal information — medical, financial and domestic — becomes an increasingly available and valuable commodity for the corporations that buy and sell it, consumers are more vulnerable to unscrupulous marketers, identity thieves and corrupt corporations. On-line information aggregators enhance these threats by compiling data dossiers that accumulate, manipulate and distribute data that most Americans consider private and protected.

Sincerely,

Jerry Flanagan
(310) 392-0522 ext. 319

cc: Senator Aanestad
Senator Alquist
Senator Cedillo
Senator Cox
Senator Maldonado
Senator McLeod
Senator Ridley-Thomas
Senator Steinberg
Senator Wyland
Senator Yee