Microsoft word - marketing0708_final.doc

The Marketing of Your Personal Health Information:
The HIPAA Loophole
What is the Marketing “Loophole”?
The HIPAA Privacy Rule prohibits the use of an individual’s personal information for
marketing purposes without the patient’s prior written authorization. Under the Rule, health
care entities covered by HIPAA – e.g., providers, plans and pharmacies – do not need to
get prior authorization to use the personal information of their patients, enrollees or
customers to send them certain health-related communications that are related to their
treatment, their benefit plan, or alternative therapies or settings of care. These covered
entities are not permitted to directly sell individuals’ health information to others, such as
pharmaceutical companies and vendors of medical devices and supplies, for marketing
purposes.
Unfortunately, due to a “loophole” in the Privacy Rule, marketing communications fromentities not covered by HIPAA are being sent to patients without their authorization–because these outside companies are paying some covered entities to send marketingmaterials on their behalf. As a result, personal information that individuals give to theirproviders, plans and pharmacies for treatment purposes – or information that is generatedas part of the treatment relationship – is being used without patient knowledge or consentto market products or services to them. These marketing activities often take place withoutany real evaluation of whether the product is appropriate for the individual.
Patients trust that when they seek treatment or fill a prescription, the information theyprovide and any information generated during that encounter will not be used for anotherpurpose without their prior consent.
But this trust is betrayed routinely because of the “loophole” that allows HIPAA covered entities to use individual patient information to marketto them the products and services of outside companies.
Why is it Important to Close the Marketing Loophole?
According to a 2006 Markle Foundation survey,1 77% of the American public was very
concerned about their information being used for marketing purposes, even though they
were overwhelmingly in favor of online records. Clearly, the benefits of transitioning to an
electronic healthcare environment will remain out of reach if entities that have access to
personal health information are allowed to continue using it freely, without the individual’s
authorization, for marketing purposes.
Cases brought at the state level demonstrate that when they are aware of it, consumers willnot tolerate this practice. For example:  On July 9, 2002, the Florida attorney general issued investigative subpoenas to Eli Lilly & Co., Walgreen Co. and a number of health care providers to determine whether state laws wereviolated when Prozac tablets were mailed unsolicited to Florida residents. Individuals receivedan envelope from Walgreens with a letter encouraging them to switch to Prozac Weekly alongwith a free one-month trial of the drug. The Attorney General’s office was concerned not onlywith the unsolicited delivery of a prescription drug but also with the possibility that privacy rights 1 “Survey Finds Americans Want Electronic Personal Health Information to improve Own Health Care,” Lake ResearchPartners, American Viewpoint, and the Markle Foundation, November 2006,http://www.markle.org/downloadable_assets/research_doc_120706.pdf .
were violated by the misuse of medical information to target likely candidates for a particulardrug. A woman who received the unsolicited Prozac also filed an invasion of privacy lawsuitagainst Eli Lilly, Walgreens, and her doctor for sending her a drug that she did not request.2  Another Florida investigation found Eckerd’s was engaged in direct marketing of prescription drugs to customers who had signed receipts for prescriptions which, unknown to the customers,also contained an authorization for marketing. In a settlement with the attorney general, Eckerdagreed to change its policies to better protect patient privacy, including restriction of directmarketing of prescription drugs to customers who have given knowing written consent to usetheir medical information for such purposes. The company also agreed to fund a $1 millionethics chair at the Florida A & M School of Pharmacy.3  In California, a non-profit consumer organization brought action as a private attorney general against Albertsons, Inc., a chain drug store. Albertsons was accused of promoting their accessto confidential medical information to pharmaceutical companies anxious to increase the namerecognition and sale of their drugs.
Albertsons proceeded to enter into commercial arrangements with them to use consumers’ medical information for direct marketing campaigns,which were fully financed by the pharmaceutical companies.
disclosure to consumers or their physicians, and without seeking consent from consumers forthe use of their personal medical information in direct marketing campaigns. It is estimated thatAlbertson’s has made several million dollars per year from this practice.4 It is important to note that these suits were brought on the state level, because actionswere in violation of state privacy laws. All three of the above scenarios are perfectly legalunder the current federal privacy “protection” offered by HIPAA. Unfortunately, Florida andCalifornia are rare exceptions; most states have not passed laws prohibiting use ofpersonal health information for marketing, and therefore most American citizens have noprotection against this practice.
Entities that Profit from this Loophole are Fighting Efforts to Close It
Bills pending in both chambers would close this loophole by prohibiting the use of apatient’s personal information without consent for marketing purposes, particularly whenthat marketing communication is paid for by an outside person or entity. The bills wouldstill permit covered entities like providers, plans and pharmacies to use their own resourcesto send certain health-related communications to patients.
Some entities that will be affected by these provisions are anxious about the possibility thatthis secret revenue stream will be cut off. They continue to fight provisions that will endtheir ability to be paid to use the personal health information of millions of Americans formarketing purposes, without their knowledge or permission, under the guise of “patienteducation.” How Can You Help?
Advocate language in pending legislation that ensures consumers’ right to authorize or
deny the use of their personal health information for marketing purposes.
For more information on the Consumer Partnership for eHealth go to 2 “Fla. AG Issues Subpoenas Over Prozac,” Associated Press, July 10, 2002; B. Japsen, “Florida Prozac Case RaisesIssues of Privacy, Health,” Chicago Tribune, July 11, 2002.
3 M. Albright, “More Eckerd Questions,” St. Petersburg Times, March 5, 2002, p. 1E; J. Dorschner, “Eckerd EndowsFAMU Ethics Chair,” The Miami Herald, July 11, 2002.
4 See http://www.privacyrights.org/ar/PharmComplaint.htm.

Source: http://go.nationalpartnership.org/site/DocServer/HC_HIT_Marketing_0708.pdf?docID=3943