Marketing madness The disingenuous use of free speech by big data and big pharma to the detriment of medical data privacy

Abstract

I.               Introduction

In Sorrell v. IMS Health, the Supreme Court struck down a Vermont regulation requiring pharmacies to obtain prescriber consent to release prescriber-identifying information[1] to data miners for marketing research purposes.[i] Since Sorrell, legislators in the US have shied away from traditional commercial regulations limiting corporate speech, many of which would support bioethical principles.[ii] The right to free speech has become more expansive covering pharmaceutical free speech in ways uncharacteristic of the long-accepted fundamental right.[iii] As a result, pharmaceutical companies increasingly influence patients and skew the judgment of doctors in prescribing decisions, now through the use of data without the authorization of the doctor or patient. The expansive view of commercial free speech has grown beyond the voicing of personal or political opinions, the suppression of which challenges liberal society. Patients’ autonomy should extend to control over personal data. An ethical system would protect private data, preserve doctor-patient confidentiality, and promote justice by leveling the playing field so that generic drugs and changes to lifestyle and diet are not drowned out by the already advantaged pharmaceutical industry’s aggressive marketing.

II.              Background

A Vermont statute imposed a consent requirement so that pharmacies selling prescriber-identifying information including the practitioner and the drug prescribed to data miners who then sell mined data to pharmaceutical companies would need explicit consent from the prescriber.[iv] The purpose of purchasing the data is detailing, a form of personalized sales and marketing directed at the practitioners most likely to prescribe certain drugs. The Sorrel decision is based on the notion of corporate free speech, a concept that encompasses two conditions: first, that corporations are speakers entitled to First Amendment protection; and, second, that advertising and marketing constitute “speech.” Corporations argue free speech should be broadly construed to include accessing data or information necessary to the action of later speech. The prescriber-identifying information in Sorrell creates a way to create an audience for the speech that the respondents argue is constitutionally protected overextending commonly recognized free speech.

The Supreme Court case was brought by manufacturers of brand name pharmaceuticals and data miners (respondents) who argued that free speech protects the ability to purchase, use, and resell the data, that the data collected served their commercial interest in targeting specific audiences for pharmaceuticals, and that requiring doctors’ consent violated the respondents’  right to free speech. The Court held that the Vermont statute was unconstitutional because it violated free speech rights by imposing both content-based and speaker-based obstacles on the respondents.[v]

Since the Sorrell case, legislators have been hesitant to regulate corporate speech while technological advancements in data have increased the use of personal data in marketing. As noted in the New York Times, among developed countries, the U.S. is noteworthy for its absence of a comprehensive consumer data protection body of law and enforcement agency.[vi] Corporations are coopting control over data absent government checks on their power. Technological advances in data mining and reidentification (the ability to rematch personal information with medical prescription data) serve to make deidentification less meaningful giving more reason to protect seemingly anonymous data.

III.            Analysis: the conflict between pharmaceutical marketing research and regulatory power protecting medical data

a.     The pharmaceutical corporations and data miners’ arguments

Pharmaceutical companies argue that they are helping doctors by presenting details of drugs to help doctors treat patients. There is no evidence that without personalized prescriber data, drug reps would no longer target likely prescribers. They did so before data mining and will do so as long as it is legal.[vii]However, legality does not imply ethical marketing practices. To argue detailing is a driving force in their effort to disseminate helpful information as if the financial benefits are merely ancillary to an altruistic act is insincere.[viii]

The pharmaceutical industry can express speech in a myriad of ways. Contrary to the Court’s interpretation, this is not a case of a state trying to keep people “in the dark” about the availability of prescription drugs.[ix] Regulations effecting corporate speech used to be encouraged for the public good. For example, laws regulating the advertising of cigarettes and alcohol were well accepted by the public. The erosion of both privacy and the individual voice’s power correspond with the uptick in recognizing previously undeclared corporate constitutional rights.[x] The pharmaceutical companies’ marketing efforts take place at the expense of data privacy and confidentiality within the doctor patient relationship. 

Doctors’ offices are awash in drug reps while televisions and social media are erupting with pharmaceutical direct-to-consumer ads. Pharmaceutical manufacturers are already allowed to infiltrate offices, hospitals, continuing medical education conferences, and sometimes medical schools. They are permitted to advertise directly to consumers, planting brand names and rosy pictures of health in the minds of all desperately seeking cures. The respondents did not show anything more than potential financial harm. Without the data, they could continue their other extremely lucrative sales and marketing techniques.  The data grab undermines beneficence. Patients are neither compensated directly for their own data nor are they afforded access to an array of pharmaceuticals at reasonable prices. With the patient’s voice absent from the Court’s opinion, patients and practitioners lose autonomy and control over personal and confidential data.

b.     The state’s regulatory goals protect traditional bioethics principles

Vermont’s regulatory interest behind the law included both data privacy and healthcare cost containment. The privacy argument was dismissed prematurely and should be presented differently.[xi] The respondents point out that the government requires that the data be collected by the pharmacies. It is also available for other uses including communication with insurers, and state and academic research. Respondents claim these uses render the data public. The opinion is flawed in that researchers and others privy to the data in noncommercial spheres have their own professional and legal standards and nondisclosure requirements. The Sorrell Court seemed to see the patient and physicians’ right to privacy as inadvertently waived. 

Vermont argued that the statute would be better for the public by decreasing healthcare costs and increasing health.[xii] In healthcare, these policy goals would be welcome by almost every politician or candidate for President in either political party. Containing healthcare costs and improving health are so large a government priority that federal laws themselves confirm a legitimate government purpose.[xiii] Affordable healthcare is a well-established justice-based healthcare issue. For the Court to find that this state law’s purpose is not substantial enough holds implications for broad healthcare policy and demonstrates favoritism to the pharmaceutical industry at the expense of the people. The government’s goal of affordable healthcare will often conflict with pharmaceutical lobbying and marketing practices. 

The Court held that Vermont favored a specific viewpoint by placing a hurdle in the promotion of the brand name pharmaceuticals. Brand name drugs are marketed using detailing based on prescriber-identifying data. It is possible that pharmaceutical companies’ lack of access to the data for detailing could make more room for generic drug sales. The lack of access to the data also might reel in overprescribing in general by limiting access of drug reps to specifically vulnerable patients and to doctors who may prescribe drugs for profit rather than medical necessity. The Vermont law leveled a playing field rather than actively promoting generics or limiting the overuse of prescription drugs. State governments wanting to expand healthcare for more people have an immediate need to reduce costs. The Court indicated that academic institutions would have the same ability to approach doctors’ offices and decrease brand name drug sales.[xiv] Academic medical centers do not engage in expensive counter-detailing. Instead, they work with manufacturers of brand name drugs for research and development and they already have a built-in bias favoring brand names. The Court’s majority opinion leaned toward accusing Vermont of a conspiracy to promote an anti-pharmaceutical viewpoint, a point that is not convincing without explicit evidence.[xv] While it should be legal to promote the ethical view that access to generics or other medical solutions is a proper use of the data, no evidence was presented that any program resembling the marketing prowess of big pharma was impending. The marketing of generics arguably has a beneficial public purpose compared to the marketing of expensive brand name drugs. The law’s educational use provision included ways to increase awareness of brand-name drugs about to expire and alternative generics, but not to the exclusion of brand-name drugs, just in the context of less costly alternatives.[xvi] The ethical principle of healthcare justice requires disseminating all relevant information about the availability of affordable care.

Unlike the laws traditionally subject to free speech scrutiny, the Vermont statute did not suppress religious, hate, or political speech, yet the Court held it quieted an unwelcome viewpoint, the essence of important free speech cases.[xvii] The use of pharmaceutical marketing data does not rise to the heightened analysis ascribed by the Court.[xviii] As the dissenting opinion notes, the ethical concerns underlying free speech do not apply to freedom in this highly regulated industry’s marketing tools. The dissenting justices also noted that all regulations reflect some point of view and that the Court is undermining democratically elected regulators by imposing on their legislative responsibilities. 

IV.            Counterarguments discounting data privacy

The most common counterargument specific to pharmaceutical research is that deidentified material found in metadata is not special to the patient. However, this argument ignores modern data storage, access, research techniques, and bioethics principles. Reidentification is simpler than is commonly understood.[xix]While medical researchers are unlikely to reidentify, pharmaceutical companies arguably would benefit from some reidentification especially because they market to consumers directly. Linking data points through voting registration or hospital stays can lead to other personal information.[xx] Even liens, court dates, and social media accounts all become fair game for marketers in the medical data reidentification process. There is a snowball effect because data miners benefit from selling data to multiple industries and the government. Data mining does not reflect the true cost of the data. Pharmacies, data miners, and ultimately pharmaceutical companies are subsidized by decisions like Sorrell that fail to require patient and prescriber consent. While each person’s data is arguably worth pennies in the system, the total is worth a great deal.[xxi] Autonomy can include the power to sell one’s medical data.

V.             Controlled use of medical data

Many people prefer directing how their data is used. When a school or hospital system asks permission to use photographs or data, parents can certainly sign “yes” for one use and “no” for another, e.g., “yes” on print but “no” on website. Similarly, hospitals ask for signatures before releasing medical data for certain purposes, including research. There is an understanding and usually a legal obligation to ensure the data would not be otherwise used. The dissenting opinion aptly points out that “a car dealership that obtains credit scores for customers who want car loans can be prohibited from using credit data to search for new customers.”[xxii] The Court impinged on individuals’ privacy rights by expanding free speech so much that any limits on how data can be used will be evaluated as discriminatory by use. In JOLT Digest, Katie Booth fears that commercial privacy laws and do-not-track legislation will fail the Sorrell standard which treats use as binary: either the data is available for every use or private and unavailable regardless of use. However, she suggests market forces might lead to corporate responsibility despite a lack of regulations.[xxiii] She recognizes that consumers do want to share data “categorically” and an inability of legislatures to provide ways to do that may force complete dependence on “private market data privacy policies.” Booth is right that, for now, urging corporate ethics reform might be a workable option in certain cases.

Bonnie Kaplan of Yale School of Medicine also readily speaks against the Sorrell decision citing its ethical and legal ramifications. Kaplan’s moderate position understands the logistical need for access to data by insurers, a point the Vermont statute acknowledges. Kaplan does not believe deidentification is foolproof and expects that patients would opt out of sharing data for marketing. To her, transparency about the data’s uses would help patients discern when to allow data sharing for research that might benefit their own healthcare quality. Kaplan would prefer “flexibility in thinking” and a system more ethical than that propelled by Sorrell. Kaplan’s ethical criteria and analysis present the reader with ideas about the complexity but they do not adhere to binding Supreme Court precedent under Sorrell. Her ethical analysis calls for limiting or overruling Sorrell, an unlikely scenario for now.

There is a distinct partisan divide in amicus briefs filed in Sorrell.[xxiv] Pharmaceutical trade groups and companies favored the respondents’ point of view while a preponderance of academic literature and thirty-five other states supported Vermont’s position.[xxv] Similar to the backdrop of Citizens United when the Supreme Court altered important traditional checks on corporate power, partisanship is glaring in the Sorrell decision.[xxvi] Working toward a middle ground means a willingness to reasonably limit pharmaceutical corporate free speech for the sake of patient privacy. 

VI.            Reconciling Sorrell, privacy, and bioethics

Beverly Cohen  argues that, despite Sorrell,  HIPAA[xxvii] currently precludes the sale of the data to the data mining companies.[xxviii], [xxix] In a nod to HIPAA, the Sorrell Court noted that a broader law limiting even more speech would have better demonstrated Vermont’s desire to protect privacy.[xxx] But a broader law arguably would offend free speech more. The Court limited Cohen’s expansive view of HIPAA through Sorrell. HIPAA has a narrower exception for routine use of data to ease healthcare delivery and payment. Yet HIPAA and data mining coexist now reflecting a failure to apply HIPAA Cohen’s way. Cohen’s ethical defense of privacy is significantly more in keeping with bioethics principles than the Court’s view of privacy.

In a landmark Supreme Court case delineating a right to privacy, Griswold v. Connecticut,[xxxi] the Court was careful not to trample on regulatory power unless it interfered with a fundamental right. The regulation in Griswold, a case about the doctor patient relationship and the right to contraception, not only overstepped a private relationship but also interfered with deeply personal beliefs about becoming pregnant. Griswold established that rights not explicitly enumerated are worthy of protection and that privacy is of “comparable magnitude to the fundamental rights that are constitutionally protected.”[xxxii]  The Sorrell Court was unwilling to focus on any belief deeper than a financial belief in the ability to market a product using the data in question. Griswold should apply to the data because, like in the Griswold case, the data is a consequence of a confidential relationship. The Court created uncertainty of whether medical data remains personal pursuant to the Griswold chain of cases, undermining autonomy in private decisions.

Reconciling Griswold and Sorrell is difficult. While Sorrell undermines regulatory authority aiding patient data privacy, there is room for solutions to use the law to promote the ethical considerations. First, statutes like Vermont’s can be drafted according to the suggestion made in dicta in Sorrell allowing only minor exceptions: insurance and billing purposes. All other uses should require consent by the patient. 

Second, a class action brought directly by patients recognizing traditional privacy rights  outside the HIPAA regulatory framework must be brought to challenge or limit Sorrell. Not only do patients not know their prescription data is being used this way, doctors tend to be unaware of the intricacies of data mining as well.[xxxiii] Laws protecting patients rather than prescribers would have more strength in court because the direct privacy interest in protecting one’s own data certainly trumps the prescribers’ privacy interest which, to the Court, stems from not wanting to be bothered by marketers and drug reps. The data means more to the patient than to the doctor; in a breach, the patient would bear the burden of the stigma of a condition made public. The nature of the data itself is private and personal. In rural areas, even without any type of reidentification, the patient’s identity can easily be ascertained. Pharmacies distribute personal prescriptions to treat stigmatized conditions including HIV, schizophrenia, depression, and to terminate pregnancy. Some of the data could be subject to subpoena. Data in the hands of more organizations is more vulnerable to leaks or unforeseen uses. The doctor patient relationship hinges on patients’ open discussion with doctors. If data can be sold, mined, and even reidentified, patients might avoid use of certain prescriptions to their medical detriment.

If a legal approach cannot overcome Sorrell, then Booth might be correct that corporate policy will eventually succumb to societal pressures and step in to protect the doctor patient relationship. Privacy should  protect confidentiality between doctor and patient and self-direction in personal matters. A high level of scrutiny must be applied to data mining that challenges privacy. When constitutionally protected privacy meets the boundary of the now constitutionally elevated commercial right to free speech, the analysis concerns two competing constitutional rights: privacy and free speech. 

The California Consumer Data Privacy Act (CCPA) which went into effect January 1, 2020 will test the waters of data privacy. So far, Hannah Anderson and Salesforce are being sued for privacy breaches. If those corporations challenge the law’s provisions, Booth’s assertion that corporations want to treat data ethically could be proven wrong. However, if the CCPA leads to significant litigation by people who suffer from data breaches, corporations will likely find it less costly to comply regardless of their will. Practicality and efficiency may prevail regardless of whether the corporation would prefer to protect privacy. Corporate ethics could become irrelevant under the weight of a strict law. The right to privacy and right to commercial free speech are not objects with equal force. When corporations argue the CCPA violates commercial free speech, courts will be forced to define the point at which the right to privacy and the right to commercial free speech meet on a continuum, reconciling the two fundamental constitutional rights and defining modern privacy law.

VII.          Conclusion

There is a fundamental ethical challenge left by Sorrell. Pharmaceutical companies are using the data for profit-making. That is marketing: it is not the government’s duty or place to ensure unfettered access to private data. The failure of government protection allows data miners to expand to new uses of data with little oversight. The patient’s explicit consent to the use of data for marketing purposes should be required out of respect for personal autonomy and privacy concerns. Privacy is the backbone of successful doctor patient relationships. Citizens United and Sorrell opened a floodgate for corporations to declare free speech rights that undermine advertising and marketing regulations. Broad implications from Sorrell are seeping into everything from alcohol, tobacco, and vaping products and possibly headed toward the marketing and advertising of guns. On this trajectory, factory discharge of carbon and toxins into the air could be labeled “speech,” a viewpoint on climate change in a politically charged atmosphere. Autonomy, justice, and beneficence are served by data protection. Free speech in the realm of political, religious, and societal opinions cannot be impeded without the strictest scrutiny. Marketing drugs can. 

[1] Prescriber-identifying information links prescribers (e.g., doctors, nurse practitioners, physician’s assistants) to prescriptions which can be used with metadata, deidentified patient data, and public records to build a detailed analysis used for sales and marketing.

[i] Sorrell v. IMS Health Inc., 564 U.S. 552 (2011) IMS et al. are referred to as “respondents” while the State of Vermont is the “petitioner.”

[ii] Within a year of Sorrell, federal courts began to strike down ordinary advertising regulations, some designed to protect children’s health. In Massachusetts, a court struck down an ordinance limiting tobacco advertising near schools, and the Sixth Circuit Court of Appeals struck down part of a law governing colorful cigarette packaging. “One year later: the consequences of Sorrell v. IMS, Inc.” Alliance for Justice, Justice Watch blog. July 2, 2012. https://www.afj.org/blog/one-year-later-the-consequences-of-sorrell-v-ims-health-inc

[iii] Citizens United v. Federal Election Commission, 558 U.S. 310 (2010) opened the floodgate to Sorrell, giving unprecedented corporate power and severely limiting the scope of regulation of corporations.

[iv] Vt. Stat. Ann., Tit. 18, §4631.

[v] Sorrell. The Court examined the free speech right compared to the regulatory priorities of the state of Vermont. Deciding to apply heightened rather than intermediate scrutiny, the Court broke from precedent on commercial free speech and held the statute unconstitutional. The departure from the norm is part of a pattern increasingly elevating the right to commercial free speech after Citizens United. The dissent, in keeping with past cases regarding commercial free speech, applied the Central Hudson three-pronged test and found the regulation acceptable. Central Hudson looks to whether the regulation is based on a substantial government interest, that it truly advances the interest, and that it does so in as narrow a way as possible. Central Hudson Gas and Elec. Corp. v. Public Service Commission of N.Y., 447 U.S. 557 (1980).

[vi] Singer, Natasha, “The government protects our food and our cars. Why not our data?” New York Times, Nov. 2, 2019. Beckerman, Michael, “Americans will pay a price for state privacy laws,” New York Times, Oct. 14, 2019.

[vii] Whitney, Jake, “Big (Brother) Pharma,” New Republic, August 29, 2006. https://newrepublic.com/article/84056/health-care-eli-lilly-pfizer-ama

[viii] Financial benefits are the result of the aggressive marketing practices.

[ix] By omission, the Court implies without marketing based on the prescriber-identifying information, a viewpoint would be suppressed. 

[x] For an example of corporate free speech, Citizens United v. FEC, 558 U.S. 310 (2010) allowed corporations to support political candidates.

[xi] In “Selling Health Data: De-identification, Privacy, and Speech,” Bonnie Kaplan notes the Court’s failure to evaluate the Sorrell case as a constitutional privacy case.  She concedes that “the State deciding which speech is permitted and which data users are favored over others is detrimental to both personal freedom and the marketplace of ideas.” Kaplan, Bonnie, “Selling Health Data: De-identification, Privacy, and Speech,” ISPS Bioethics Working Paper, Yale Interdisciplinary Center for Bioethics, Oct. 7, 2014. I assert that, in Sorrell, the state deciding is detrimental to neither: personal freedom is irrelevant except for the personal freedom to protect one’s own data; the marketplace of ideas is not furthered by using data to promote detailing, a one-sided marketing tool promoting brand names. 

[xii] Sorrell, 17.

[xiii]Patient Protection and Affordable Care Act, 42 U.S.C. § 18001 et seq. (2010)

[xiv] “For example, it appears that Vermont could supply academic organizations with prescriber-identifying information to use in countering the messages of brand-name pharmaceutical manufacturers and in promoting the prescription of generic drugs…” “the law on its face burdens disfavored speech by disfavored speakers.” Sorrell, p. 8. In “Two More from the Supreme Court”, the Drug and Device Law Blog mischaracterizes the Court’s statement saying “…the statute provided for state-financed ‘counter-detailing’-pushing cheaper, often generic, competing drugs.” Bexis, “Two More from the Supreme Court,” the Drug and Device Law Blog (June 23, 2011). https://www.druganddevicelawblog.com/2011/06/two-more-from-supreme-cour.html

The Court acknowledged Vermont has no state-run counter-detailing effort but does collect the data. Sorrell, p. 4. The statute’s “evidence based prescription drug education program” should not be mischaracterized as counter-detailing despite its inclusion of cost-effective options.

[xv] Sorrell, p. 4 and 8.

[xvi] Sorrell, p. 4.

[xvii] Sorrell, p. 8.

[xviii] Sorrell, dissent, p. 3-4, arguing the Central Hudson test would be sufficient for the commercial free speech claim at hand and that the majority’s elevated scrutiny of the speech was not appropriate.

[xix]Rothstein, Mark A. “Is deidentification sufficient to protect health privacy in research?.” American Journal of Bioethics, Vol. 10,9 (2010): 3-11. doi:10.1080/15265161.2010.494215 

[xx] US Department of Health and Human Services. https://aspe.hhs.gov/report/minimizing-disclosure-risk-hhs-open-data-initiatives/re-identification-individuals-data-released-public

[xxi] Ornstein, Charles, “Big data + big pharma = big money,” ProPublica, Jan. 10, 2014. Tanner, Adam, “This little known firm is getting rich off your medical data,” Fortune, Feb. 9, 2016. Both articles cite IMS revenues of which approximately 2 billion come from selling the data gotten from pharmacies. IMS develops patient dossiers (over 500 million of them now) without transparency as to its methods. IMS purchases data from pharmacies, electronic medical records companies, and insurers among others.

[xxii] Sorrell, dissent, p. 7, citing Trans Union LLC  v. FTC, 536 U.S. 915 (2002).

[xxiii] Booth, Katie, “The all-or-nothing approach to data privacy: Sorrell v. IMS Health, Citizens United, and the future of online data privacy legislation,” JOLT Digest Harvard Law School, Aug. 7 2011.

[xxiv]For a list of all 27 amicus briefs filed see https://www.scotusblog.com/case-files/cases/sorrell-v-ims-health-inc/ For example, in support of the Vermont law, the AARP, New England Journal of Medicine, the Electronic Privacy Information Center, the Vermont Medical Society, Berkeley Media Studies, Public Health Law and Policy filed amicus curiae briefs. In support of IMS, the Cato Institute, the Biotechnology Council, the Association of National Advertisers, and McGraw Hill and Hearst (both rely on similar data for marketing) filed amicus curiae briefs.

[xxv] One outlier in the think tank reports on Sorrell, see the libertarian Goldwater Institute’s “Restoring fee speech in medicine,” June 6, 2017 https://goldwaterinstitute.org/article/restoring-free-speech-in-medicine/

[xxvi] Sorrell, p. 9 finding intent “to impose a content-based burden” and discussion on p. 10-11 where the majority opinion refers to the message the speech conveys with an underlying theme that the type of corporate speech is worthy of heightened scrutiny. The justices post Citizens United are significantly more open to arguments that frame commercial speech in the language of personal speech.

[xxvii] The Health Insurance Portability and Accountability Act of 1996. Pub. L. 104-191. Stat. 1936. Web. 11 Aug. 2014.

[xxviii] Cohen, Beverly, “Regulating data mining post Sorrell: Using HIPAA to restrict marketing uses of patients’ private information,” Wake Forest Law Review, 2013. http://wakeforestlawreview.com/2013/04/regulating-data-mining-post-sorrell-using-hipaa-to-restrict-marketing-uses-of-patients-private-medical-information/

[xxix] Cohen, on how evaluating the statute in Sorrell under HIPAA would create a different result.

[xxx] Sorrell, p. 17. “And the measure permits insurers, researchers, journalists, and the State itself, and others to use the information.”

[xxxi]Griswold v. Connecticut, 381 U.S. 479 (1965). (Marital privacy).

[xxxii]Hartman, Gary, Landmark Supreme Court Cases, Facts on File (2004) p. 293, referring to Griswold.

[xxxiii] Kaplan, p. 16.