[Med-privacy] CA bill

[peter marshall]

California Bill Would Let Pharmacies Sell Medical Records

The San Francisco Chronicle has a story about SB1096, which would allow=20=

pharmacies to sell customers=92 prescription data for marketing =
purposes.=20
Currently, the California Confidentiality of Medical Information Act=20
prohibits such sales. The California Medical Association opposes the=20
bill, saying this would affect doctor-patient relationships. The bill=20
was previously defeated in the Senate, but is up for another vote today=20=

after it was amended to say, =93that the patient shall receive an=20
opportunity to opt out of the written communication.=94

Opt-out clauses are not protective enough. Would the opt-out clause be=20=

posted in a prominent area? Would the language be clear? Would the=20
patients understand what they were opting out of? The pharmacies would=20=

have financial incentives to have as few customers opt-out as possible.=20=

It is irresponsible for the pharmacies to place the burden on customers=20=

to keep their private medical data from becoming public.

Last year, I was co-counsel on an amicus curiae brief (pdf) in IMS=20
Health v. Ayotte, a case about a New Hampshire state law that banned=20
the sale of prescriber-identifiable prescription drug data for=20
marketing purposes. The marketing companies in the New Hampshire case=20
weren=92t asking for data that would outright link individuals to their=20=

prescriptions, yet we detailed the problems that could come from=20
=93de-identified data.=94 We argued:

     Although de-identification measures are increasingly innovative and=20=

computationally complex, patient data is still vulnerable to attacks=20
because sophisticated re-identification programs are also being=20
developed. Individuals can be re-identified using information such as=20
zip code, date of birth, and gender and then comparing that data to=20
publicly available information. Such information is easily accessible=20
via birth and death records, incarceration reports, voter registration=20=

files, and driver=92s licensing information.

Passage of the California bill would cause a much worse scenario. The=20
Chronicle notes, =93People receiving medication for a litany of=20
illnesses, including cancer, diabetes, asthma, osteoporosis,=20
depression, hypertension and heart disease, could receive the=20
[marketing] letters=94 once their private medical data is sold by the=20
pharmacies. The intensely personal data would be viewable by the=20
company employees who sent out the mailings, the Post Office employees=20=

who sorted and delivered the marketing documents, anyone who saw the=20
materials on an individual=92s kitchen table. Those who want to learn=20
more about protecting your medical data should visit Patient Privacy=20
Rights.

[Privacy Lives]=