Indiana Law Review Confidentiality of prescription Drug Information IN THE Era of Computers and Managed Care* McDonald-Merrill-Ketcham Lecture Bernard Lo, M.D. Introduction In 1998, an incident occurred in which certain patients' prescription information was publicly disclosed in order to advertise a new drug. This incident exemplifies the importance ofconfidentiality in the era ofmanaged care and computers. In addition, the ethical concerns voiced about this incident also apply to pharmacy benefits management programs. Pharmacy benefits management companies "design, implement, and administer outpatient drug benefit programs for employers, managed care organizations, and other third party payers."' Pharmacy benefits management companies process claims for drug prescriptions, negotiate prices and rebates with drug manufacturers and institute programs to restrain the cost of prescription drug benefits.^ The use of personal health information in pharmacy benefits management is particularly important because of increased pressures to control rising drug costs. This Article argues that confidentiality concerns about pharmacy benefits management include whether the goal ofbenefitting patients will be achieved and whether the means used to achieve that goal are appropriate. Policies should be crafted that protect confidentiality while allowing for appropriate use of personal health information in pharmacy benefits management. Sound policies should require: clear evidence of benefit to patients, an oversight committee, patient An earlier and shorter version of this Article was published as Bernard Lo & Ann Alpers, Uses and Abuses ofPrescription Drug information in Pharmacy Benefits Management Programs, 283 JAMA 801-06 (2000). * The McDonald-Merrill-Ketcham Lecture and Award was initiated through a joint bequest to the Indiana University Schools of Medicine and Law—Indianapolis by Dorothy M. Ketcham. The award is designed to bridge the gap between law and medicine through honoring an individual, distinguished in both fields, who will share their expertise with students, faculty, and leaders of the medical and legal professions. This Article was the basis of Dr. Lo's presentation on Grand Rounds on October 13, 1999 at the Indiana University School of Medicine.* Program in Medical Ethics, the Center for AIDS Prevention Studies, and the Division of General Internal Medicine, University of California San Francisco. B.A., 1966, Harvard University; M.D., 1975, Stanford University. Supported in part by the Robert Wood Johnson Foundation Initiative on Strengthening the Patient-Provider Relationship in a Changing Health Care Environment and Center Grant MH42459 from the National Institute of Mental Health. Correspondence can be sent to author at: Room C 126, 521 Parnassus Avenue, San Francisco, CA 94 1 43-0903, or email bemie@medicine.ucsfedu. I am indebted to Ann Alpers and to the members ofthe Health Privacy Working Group for many illuminating discussions on this topic. Julie Cantor and Claude Platton provided their outstanding research assistance. 1. Helene L. Lipton et al., Pharmacy Benefit Management Companies: Dimensions of Performance, 20 ANN. REV. PUB. HEALTH 361, 361-62 (1999). 2. See K.A. Schulman et al.. The Effect ofPharmaceutical Benefits Managers: Is It Being Evaluated?, 124 ANNALS INTERNAL Med. 906-13 (1996). 938 INDIANA LAW REVIEW [Vol. 33:937 authorization, disclosure or prohibition of conflicts of interest, additional safeguards for sensitive medical conditions, strong confidentiality protections, and restrictions on advertising. A pharmacy program that made front-page news in 1998 dramatized how personal health information can be both used and abused in the era of managed care and computers. Two Washington, D.C. pharmacy chains, CVS and Giant Foods, sent patient prescription records to Elensys, a database marketing firm.^ Elensys used the records to mail patients prescription refill reminders as well as information regarding new drugs. One such mailing informed patients who had purchased products for the nicotine replacement drug, bupropion,"* that they might consider this new product more acceptable than other drugs that block the symptoms ofnicotine withdrawal.^ The pharmacy chains and Elensys were paid by drug manufacturers for these mailings. Prior to receiving these mailings, patients were unaware that their medical information was being used in this manner; although Elensys said that drug companies had no direct access to pharmacy records and that patients could opt out of the program by returning a form.^ Critics objected to the program arguing that it crossed the line between medicine and marketing. In response, the president of Elensys stated, "This is good medical and good entrepreneurial [practice], which is the nice thing about it."' Both CVS and Giant Pharmacy canceled the program after news stories elicited public outrage.* A Giant Pharmacy spokesperson said, "The customer response was extremely negative, and because of privacy concerns we decided to discontinue Our phones rang offthe hook.'" Ironically, the next year, the advertised product, bupropion, was shown to be more effective than other approaches to smoking cessation.'^ The Elensys incident illustrates the importance ofprotecting personal health information contained in computerized databases. These databases contain information regarding patients' diagnoses, prescriptions, and utilization ofhealth care services. The databases link information from many sources, such as test 3. See Robert O'Harrow, Jr., CVSAlso Cuts Ties to Marketing Service; Like Giant, Firm Cites Privacy on Prescriptions, WASH. PoST, Feb. 1 9, 1 998, at E 1 [hereinafter O'Harrow, CVSAlso Cuts Ties\\ Robert O'Harrow, Jr., Giant Food Stops Sharing Customer Data: Prescription-Marketing Plan Drew Complaints, WASH. POST, Feb. 18, 1998, at Al [hereinafter O'Harrow, Giant Food]; Robert O'Harrow, Jr., Prescription Sales, Privacy Fears: CVS. Giant Share Customer Records with Drug Marketing Firm, WASH. PoST, Feb. 15, 1998, at Al [hereinafter O'Harrow, Prescription Sales, Privacy Fears]. 4. See O'Harrow, Prescription Sales, Privacy Fears, supra note 3, at Al . 5. See id. 6. See id 7. Id 8. See O'Harrow, Giant Food, supra note 3, at Al . 9. Id 10. See Douglas E. Jocenby et al., A Controlled Trial ofSustained-Release Bupropion, a Nicotine Patch, or Bothfor Smoking Cessation, 340 NEW Eng. J. MED. 685, 690-91 . 2000] PRESCRIPTION DRUG CONFIDENTIALITY 939 results from clinical laboratories, radiology departments, and pathology departments; discharge diagnoses from hospitals; and prescriptions from pharmacies. The electronic linking of such data provides many benefits to patients and society as a whole, including quality improvement and outcomes research.'* For example, programs can v^am physicians of adverse drug interactions, remind patients to refill prescriptions for chronic conditions, and identify patients who could be switched to lower-cost, equivalent drugs. '^ However, computerized databases that contain personal health information also pose risks to patients. Because computer databases allow access to a large amount of information regarding individuals,'^ breaches of confidentiality may be more widespread with computers than with paper medical records. The Elensys case dramatizes how patients may be unaware of how their personal health information is being used. The use of information regarding drug prescriptions is a timely topic for several reasons. First, pharmacy costs are the fastest rising sector of health expenditures, and the employment of pharmacy benefits management is an increasingly common means of controlling these expenses.'* Second, as the Elensys incident illustrates, certain uses of personal information about pharmaceutical use may be considered ethically problematic. Finally, pharmacy benefits management sheds light on some important issues of federal policies regarding the confidentiality of electronic health information. The contours of federal policy debates are well known. The Health Insurance Portability and Accountability Act required either Congress to pass health privacy legislation by August 1999 or the Secretary ofHealth and Human Services to establish health privacy regulations by January 2000.'^ Because Congress failed to act, the Secretary recommended proposed regulations in October 1999.'^ The Secretary's proposed federal regulations allow health care plans, providers, and clearinghouses to use or disclose individually identifiable health information in electronic format for treatment, payment, and health care operations without individual patient authorization.'^ Although pharmacy benefits management is not specifically mentioned in the proposed regulations, 11. See COMM. ON MAINTAINING PRIVACYAND SEC. IN HEALTH CAREAPPLICATIONS OF THE Nat'l Info. Infrastructure, Nat'l Research Council, For the Record: Protecting Electronic Health Information 26 ( 1 997) [hereinafter For the Record] . 12. See Lipton et al., supra note 1, at 372-82. 1 3. See generally FOR THE RECORD, supra note 1 1 . 14. See Lipton et al., supra note 1, at 362; Arnold J. Rosoff, The Changing Force of Pharmacy Benefits Management: Information Technology Pursues a GrandMission^ 42 St. Louis U.L.J. 1,1(1998). 15. See health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, § 264 (c)(2), 110 Stat. 1936, 2033 (1996). 1 6. See Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. §§ 160-164(1999). 17. See id 940 INDIANA LAW REVIEW [Vol. 33 :937 patient authorization would probably not be required under these regulations because case management and disease management are generally considered treatment. Furthermore, the regulations provide that definitions oftreatment and payment are to be "construed broadly."^* Whether individual patient authorization should be required for pharmacy benefits management will be discussed later. This Article begins by discussing briefly why medical confidentiality is important and how prescription information can be used by health care organizations. Next, it analyzes key ethical issues regarding the use of prescription information. Finally, this Article recommends how policies can be crafted to both protect confidentiality and still allow personal health information to be used appropriately in pharmacy benefits management. I. CONFIDENTIALITY OF MEDICAL INFORMATION Professional medical ethics requires physicians to maintain confidentiality.^^ Indeed, state statutes may place role-specific obligations on health care providers to protect confidentiality.^° Confidentiality encourages people to seek medical care and to disclose information to physicians. Furthermore, it also prevents stigma and discrimination in health insurance or employment.^^ Although confidentiality is important, there are exceptions. Patients may authorize disclosure of information in some circumstances, such as to secure insurance coverage for services. Even without such patient permission, confidentiality may be overridden in a number of other circumstances. Health care providers may be required by law to report certain infectious diseases to public health officials, gunshot wounds to police, and serious threats ofviolence by psychiatric patients to intended victims.^^ These exceptions to confidentiality are ethically justified because they prevent physical harm to third parties or promote the public health. Other exceptions to confidentiality are ethically justified because patients benefit from the efficient flow of personal health information.^^ For example. 18. Id. 1 9. See generally ToM L. Beauchamp& James F. Childress, Principles of Biomedical Ethics 418-29 (4th ed. 1994); Bernard Lo, Resolving Ethical Dilemmas: A Guide for Clinicians 44-55 (1995). 20. See generally Lawrence O. Gostin, Health Information Privacy, 80 CORNELL L. REV. 451, 506-08 (1995); Health Privacy Working Group, Health Privacy Project of Georgetown University's Institute for Health Care Research and Policy, The State of Health Privacy: An Uneven Terrain (visited May 10, 2000) . 21. See Beauchamp& Childress, supra note 1 9, at 4 1 8-29; Lo, supra note 20, at 44-45. 22. See generally PAUL S. Appelbaum, ALMOST A REVOLUTION 7 1 - 1 03 ( 1 994); Lo, supra note 19, at 44-45; Health Privacy Working Group, supra note 20, at 39, 40; Ariella Hyman et al.. Laws Mandating Reporting ofDomestic Violence, 213 JAMA 1781 (1995). 23 . See CoMM. ON Reg'l HEALTH Data Networks, Inst, of Med., Health Data in the 2000] PRESCRIPTION DRUG CONFIDENTIALITY 94 1 State laws may permit disclosure of information without patient consent for the direct care ofthe patient; for authorization, billing, and payment for services; and for utilization review, quality control, and peer review.^'* Current discussions regarding federal health privacy policies have focused on autonomy as the guiding ethical principle: confidentiality should be respected because people want control over personal health information.^^ However, autonomy and control as the ethical basis of confidentiality may be problematic because the need to restrain health care costs severely limits the choices people have over how their personal health information is used. Insurers who wish to restrain health expenditures need to know whether a patient is enrolled in their program, whether their plan covers a specific service or intervention, whether appropriate authorization has been obtained, and whether the services were actually rendered. Realistically, patients who do not release their personal health information for these purposes will either need to pay more out of pocket for care, change providers or health plans, or make special arrangements with the health care organization.^^ Thus, economic forces may compel patients to agree to disclose information, with little control over the conditions of disclosure or subsequent uses of the information. Respect for persons may be a more appropriate philosophical basis for seeking authorization to disclose information than is respect for autonomy .^^ Even if realistic choices are limited, it shows respect to ask patients for authorization. Furthermore, respect for persons may require limits on how confidential information may be used. Setting limits can prevent harms or wrongs to patients, even if they have little realistic choice regarding the use of their personal health information. Reasonable limits might include restricting disclosure to the minimum needed to carry out the objective of a program and taking steps to minimize any harms that might arise from disclosure of information. II. USE OF Personal Information About Drug Prescriptions The term "pharmacy benefits management covers a wide range of activities,^* some ofwhich resemble the Elensys program in ethically significant Information Age: Use, Disclosure, and Privacy 5 (Molla S. Donaldson & Kathleen N. Lohr eds., 1994); Health Privacy Working Group, Health Privacy Project of Georgetown University's Institute for Health Care Research and Policy, Best Principlesfor Health Privacy (visited May 20, 2000) . 24. 5eeCAL. Civ. Code, §§ 56-56.37 (Deering 1997); Health Privacy Working Group, supra note 20, at 22. 25. See CoMM, ON Reg'l HEALTH Data Networks, supra note 23, at 5; William W. Lawrence, PrivacyandHealthResearch: AReportto the U.S. Secretary of Healthand Human Services 1-13 (1997). 26. See Health Privacy Working Group, supra note 23. 27. See Beauchamp & Childress, supra note 1 9, at 4 1 1 . 28. Lipton et al., supra note 1 . 942 INDIANA LAW REVIEW [Vol. 33:937 ways. Some pharmacy benefits management programs are quality improvement programs, warning physicians of adverse drug interactions or underuse of beneficial drugs. Others are disease management programs, reminding patients to refill prescriptions needed for the long-term treatment of chronic diseases. Still pharmacy benefits management programs are cost-containment initiatives, switching patients to lower-cost, equivalent drugs.^^ Patients may be contacted about drug switches by the prescribing physician, the dispensing pharmacist, or the pharmacy benefits management program. Patients may not realize that the pharmacy benefits management program commonly prompts physicians and pharmacists to consider drug switches. Some pharmacy benefits management projects resemble advertising because they promote products of a particular manufacturer that have no clinical advantages over alternative drugs. The primary goal ofadvertising is to increase the market share for the advertised product; benefit to consumers is a secondary end. Pharmacy benefits managers with ties to a drug manufacturer often promote drugs made by that manufacturer.^^ In one case, pharmacists were paid to switch patients from a diabetes drug that had generic competitors to another drug from the same manufacturer that had patent protection,^ ^ despite there being no evidence that the patented drug was more effective or safer. Such a switch does not benefit patients clinically; however, it increases the cost of care and may violate federal restraint of trade regulations.^^ III. Ethical Considerations in the Use of Personal Health Information for Pharmacy Benefits Management Critics of the Elensys project objected, arguing that the project's goal was self-interest rather than patient benefit, that patients did not authorize it, that third parties had access to information, and that safeguards for confidentiality were lacking. On closer examination, these criticisms may also apply to some pharmacy benefits management programs. A, Benefit to Patients The ethical guideline of beneficence may justify the use of personal health information in pharmacy benefits management. Beneficence requires physicians 29. See Robert O'Hanrow, Jr., Plans ' Access to Pharmacy Data Raises Privacy Issues: Benefit Firms Delve into Patient Records, WASH. POST, Sept. 27, 1 998, at Al; As Drug Costs Rise, Health Plans Shift the Burden, 10 CAPITATION MOMT. REP. 153, 154 (1997). 30. See generally Rosoff, supra note 1 4; David S. Hilzenrath, Drug Firms Said to Pressure Doctors; Report Cites Efforts to Switch Prescriptionsft-om Rival Products, Wash. POST, Aug. 14, 1997, at E3; Gina Kolata, Pharmacists Help Drug Promotions, N.Y. TIMES, Aug. 2, 1994, at Dl. 31. See Gina Kolata, Upjohn to Repay 8 States over Drug Plan, N.Y. Times, Aug. 2, 1 994, atDl. 32. See Rosoff, supra note 1 4, at 39-4 1 ; Hilzenrath, supra note 30, at E3 ; Kolata, supra note 31, atDl. 2000] PRESCRIPTION DRUG CONFIDENTIALITY 943 to help patients further their important and legitimate interests." Such interests would include avoiding adverse drug interactions, correcting underutilization of effective medications, increasing adherence to effective therapeutic or preventive regimens, and keeping the costs of care under control. However, despite its potential benefits, pharmacy benefits management may be regarded as ethically problematic. Concerns about drug switches and formulary restrictions have provided the impetus for state patient-protection legislation.^* Two questions need to be addressed when assessing the benefits of pharmacy benefits management to patients. 1. Is the Claim of a Patient Benefit Warranted?—The Elensys program claimed to benefit patients by encouraging smoking cessation. However, at the time the program was in place, there was no rigorous evidence that the recommended product was superior to alternatives, or even equivalent to them. Thus there was little warrant for asserting that it was in the patient's clinical best interests to be informed of the drug or that the benefits of informing patients outweighed the breach of confidentiality needed to determine which patients to notify. Overriding confidentiality cannot be justified by the mere hope or expectation that the new drug will be effective. Adequatejustification would be studies that have been peer reviewed and determined to meet accepted professional standards of rigor.^^ Moreover, the use of personal health information is not justified retroactively if the following year a randomized controlled trial showed that the recommended product was more effective than other approaches to smoking cessation.^^ The justification must be attained before the breach of confidentiality occurs. The determination that patients should be switched to another equivalent drug requires a detailed analysis ofthe published evidence regarding the drugs, as well as a consideration of the practical consequences of changing drugs. A common situation is changing a patient from one cholesterol-lowering drug to another of the same chemical class. Elevated levels of LDL-cholesterol are a common risk factor for heart attacks and stroke. Several drugs inhibit the enzyme 3-hydroxy-3-methdylglutaryl coenzyme A reductase, a key enzyme in 33 . See Beauchamp & CHILDRESS, supra note 1 9, at 295-325. 34. See Health Policy Tracking Service of National Conference of State Legislatures, Pharmaceuticals: Managed Care Drug Formularies (visited May 10, 2000) (on file with Indiana Law Review). 35. See Gordon H. Guyatt et al., User 's Guides to the Medical Literature: IL How to Use an Article About Therapy or Prevention: A. Are the Results Valid?, 270 JAMA 2598 (1993) [hereinafter Guyatt et al., User 's Guide IIA]; Gordon H. Guyatt et al., User 's Guides to the Medical Literature: IL How to Use anArticle About Therapy or Prevention: B. What Were the Results and Will They Help^Me in Caringfor My Patients? 271 JAMA 59 (1994) [hereinafter Guyatt et al., User 's Guide IIB]\ Gordon H. Guyatt et al., User 's Guides to the Medical Literature: XVL How to Use a Treatment Recommendations?, 281 JAMA 1836 (1999) [hereinafter Guyatt et al.. User 's Guide XVI\. 36. See Jocenby et al., supra note 10. 944 INDIANA LAW REVIEW [Vol. 33 :937 cholesterol metabolism. These drugs are effective in lowering cholesterol levels and are well tolerated by patients. A number of pharmaceutical companies manufacture brand-name drugs in this class. There is strong evidence that drugs of this type are equivalent in their ability to lower serum cholesterol levels and also to reduce the risk of heart attacks, other adverse cardiac events, and overall mortality.^^ However, even though the drugs in this class are generally considered equivalent from the perspective ofa population ofpatients, switching a patient from one drug to another may entail adverse consequences for an individual patient. A patient who is doing well on one drug may suffer side effects when changed to another drugs. Furthermore, the equivalent doses of drugs cannot be determined in advance because ofvariation in effectiveness from patient to patient. Thus a patient who is switched to a different drug may need to have additional blood samples drawn to measure cholesterol levels and have additional office visits to adjust the dosage ofnew drug. Finally, some scientists argue that even if the drugs are equivalent in their ability to lower cholesterol, they may differ in other clinical effects, such as their effect on preventing clots in blood vessels.^^ Patients may benefit from reduced costs of health care as well as from improved clinical outcomes resulting from products promoted by pharmacy benefits management programs. However, it may be difficult to determine the magnitude of savings that pharmacy benefits management programs yield to patients.^^ Drug discounts negotiated by pharmacy benefits management programs from pharmaceutical companies are business secrets. In addition, the savings from negotiated discounts may be directed to enhancing the profitability of health care organizations rather than keeping premiums and copayments affordable.'" 2. Do Financial Conflicts ofInterest Undermine Benefit to Patients?—Some critics objected to the profit motive of Elensys and the drug company,"*' which they contrasted with the patient-oriented beneficence of medical practice. However, the distinction between self-interest and beneficence can be blurred in a market-driven health care system. Both not-for-profit organizations and for- profit organizations need to pursue their financial self-interest and generate a favorable balance sheet. The ethical concern with pursuing self-interest while delivering health care is that some financial incentives that encourage providers to provide more efficient care also may cause them to withhold beneficial care."*^ 37. See Finlay A. McAlister et al., User 's Guides to the Medical Literature: XIX. Applying Clinical Trial Results: B. Guidelinesfor Determining Whether a Drug Is Exerting (More Than) a Class Effect, 282 JAMA 1371(1 999). 38. See Curt D. Furber et al.. Are Drugs Within a Class Interchangeable?, 354 LANCET 1202, 1203 (1999). 39. See Lipton et al., supra note 1, at 386-88; RosofF, supra note 14, at 10-24. 40. See generally R. McCarthy, PBMs in aJaundicedEye, 1 1 DRUGBenefitTrends 20-27 (1999). 41 . See O'Harrow, Prescription Sales, Privacy Fears, supra note 3, at Al . 42. See generally MARC A. RODWIN, MEDICINE, MONEY, AND MORALS: PHYSICIANS' 2000] PRESCRIPTION DRUG CONFIDENTIALITY 945 Financial arrangements in some pharmacy benefits management plans are as ethically problematic as the direct payments for information in the Elensys program. Some pharmacy benefits managers pay pharmacists to switch a patient to a preferred drug/^ These payments are allegedly for record review, patient education, and discussion with the prescribing physician. However, the pharmacist receives such payment only if a switch is made and presumably education and discussion can occur even ifthere is no change in drugs. Offering health care workers a bonus for specific clinical decisions affecting an individual patient is a grave conflict of interest. For physicians, such a direct incentive is considered an unethical and illegal kickback.'*^ In contrast, financial incentives averaged over a large group of patients are regarded as acceptable because their psychological impact on the health care worker is weaker. Because incentives are pooled over a group ofpatients, the physician or pharmacist need not believe that their personal income is jeopardized by a decision for any particular patient. Thus they are considered more likely to override their self-interest if it is in the patient's best interest to receive the more expensive intervention. Even when the goals ofa project are laudable, its means may be problematic. Ethical concerns about the means used in pharmacy benefits management projects include authorization, access, and safeguards. B. Patients Authorization ofPersonal Health Information Many patients in the Elensys program felt wronged because they had not authorized the sale oftheir personal health information.'*^ Even ifthey suffer no tangible physical or psychosocial harms, patients may feel wronged if confidential medical information is inappropriately disclosed. The patient may believe that the physician or health care organization has broken an implicit promise to keep personal health information confidential. Moreover, patients may feel wronged because they could not withdraw from the program before their information was accessed. Patients learned of the Elensys program only when they received a letter informing them about a new drug or the need to refill a prescription, at which point their personal health information had already been used. If patients authorized the use of their personal health information for pharmacy benefits management, there would be few ethical concerns that they had been wronged. However, patient authorization is not generally obtained for pharmacy benefits management programs, regardless ofwhether the program is Conflict of Interest (1993). 43. See Lipton et al., supra note 1, at 377-78; Donald P. Baker, Virginia Bill Would Bar Cash Incentive^for Persuasive Druggists, WASH. POST, Jan. 30, 1997, at CI; Kolata, supra note 31,atAl. 44. See generally Stephen R. Lathom, Regulation ofManaged Care Incentive Payments to Physicians, 11 AM. J.L. & MED. 399 (1996); Steven D. Pearson et al.. Ethical Guidelines for Physician Compensation Based on Capitation, 339 New Eng. J. Med. 689 ( 1 998). 45. See O'Harrow, Giant Food, supra note 3, at Al . 946 INDIANA LAW REVIEW [Vol. 33:937 carried out within a health care organization or contracted out to external organizations. Individual patient authorization is believed to be an administrative burden, reduces the cost-effectiveness of these programs, and deters the use of such programs."*^ C Who Has Access to the Information? It is hard to imagine that patients would object if their personal physician examined their medical records to determine ifthey need drug refills or help with smoking cessation. When seeking care, patients choose to share information with doctors and trust them to maintain confidentiality. On the other hand, patients may not realize that physicians play a secondary role in pharmacy benefits management. Frequently drug changes underpharmacy benefits management are implemented through a letter from the physician to the patient.^^ The patient may incorrectly infer that the physician has personally reviewed the medical records and that no one else has done so. However, it is the pharmacy benefits management program that identifies eligible patients and prepares letters for physicians to sign if they agree with the drug change. The patient's health information has already been analyzed by the program before the physician receives the letter. Thus the physician cannot ensure that confidentiality has been maintained in this process of identifying patients to be contacted. The Eiensys episode illustrates how the issue ofwho has access to personal health information is intertwined with why they have access. Pharmacy chains and pharmacy benefit managers need to access personal health information when dispensing medications, in order to determine whether the patient is allergic to a prescribed drug, has a medical contraindication to the drug, or is taking another drug that interacts with it in an adverse manner. It also is appropriate for pharmacy benefits management programs and pharmacies to have access to personal health information for billing and payment, quality improvement, disease management, and cost containment. In contrast, there is little warrant for these organizations to access identifiable clinical information to advertise products that are not known to be better than alternatives, unless the patient has already given permission to access records for this purpose. In a similar manner, employers mayjustifiably have access to personal health information for some purposes but not others. Self-insured employers need to have prescription information in order to pay for prescription drug benefits and to ensure that billed services have actually been delivered. However, employers should not have access to personal health information when making personnel decisions.'** Employees may be concerned that firewalls are inadequate to prevent the benefits division of the company from passing personal health information to the personnel department. Concerns about confidentiality are 46. See Health Insurance Portability and Accountability Act of 1 996, Pub. L. No. 1 04- 1 9 1 , § 264(c)(2), 110 Stat. 1936, 2033 (1996). 47. See Lipton et al,, supra note 1, at 377. 48. See Rosoff, supra note 14, at 29-32. 2000] PRESCRIPTION DRUG CONFIDENTIALITY 947 particularly troubling with regard to prescription information because employers who provide health benefits often hire pharmacy benefits management firms to manage drug benefits.'*^ Patients in the Elensys program objected that third parties whom they did not know had access to their personal health information. However, the involvement ofthird parties may be needed for a pharmacy benefits management program to work effectively. Some pharmacy benefits organizations lack the expertise to identify individual patients for direct mailings. Such programs may contract with an external service organization which has expertise in analyzing computerized databases.^^ However, patients may fear that these service organizations fedl to safeguard confidentiality, as we next discuss. D. Safeguardsfor Maintaining Confidentiality? Safeguards reduce the risks of projects that use personal health information. Recent reviews discuss in detail how confidentiality may not be adequately protected.^* Several problems have been identified. First, state confidentiality statutes and case law may apply specifically to health care providers,^^ but not to data management finns who do not clearly fall within the definitions of "health care providers. ""^^ After the Elensys incident, uncertainty over the applicability of state laws prompted state legislators in Maryland and Virginia to introduce bills to strengthen confidentiality ofpharmacy records.^'' Second, statutes usually concern disclosure of personal health information by health care providers to third parties and not the use of information within a health care organization.^^ However, breaches of confidentiality within an organization may cause harm or wrong to patients, as well as disclosures to third parties. Third, technical measures and legal protections to safeguard computerized health information may be inadequate. "^^ In theory, electronic personal health information can be more tightly protected than paper records through the use of such measures as password protection, audit trails that keep a record of all persons who have accessed a patient's record, and automatic logoff from the database if a remote terminal has not been used for a set period of time." However, health care 49. See Lipton et al., supra note 1 , at 368. 50. 5eezV/. at363. 5 1 . See Janlori Goldman, Protecting Privacy to Improve Health Care^ HEALTH AFFAIRS, Nov./Dec, 1998, at 47; Gostin, supra note 20, at 451-528; Health Privacy Working Group, supra note 20. 52. See Cal. Civ. CODE §§ 56-56.37 (Deering 1997). See generally Gostin, supra note 20; Health Privacy Working Group, supra note 2 1 . 53. See Baker, supra note 43, at CI ; Ralph Jimenez, Bill Would Ban Raids on Rx Records ^ Boston Glob^E, June 14, 1998, (New Hampshire Weekly), at 1 . 54 . See O ' Harrow, Prescription Sales, Privacy Fears, supra note 3 , at A 1 55. See Health Privacy Working Group, supra note 20, at 1 7. 56. See id. ; FOR THE RECORD, supra note 1 1 , at 1 22-26. 57. See FOR THE RECORD, supra note 1 1 , at 82-1 1 1 . 948 INDIANA LAW REVIEW [Vol. 33:937 organizations often do not use these measures to safeguard confidentiality, even though they are technically feasible to implement.^* The debates over federal health privacy legislation or regulation offer an opportunity to craft policies that can both protect confidentiality and allow the use ofpersonal health information in appropriate pharmacy benefits management programs. IV. Recommendations for Using Personal Health Information in Pharmacy Benefits Management There are strong policy reasons to identify adverse drug reactions, prescribing errors, and underuse of beneficial drugs, to enhance patient adherence and to restrain increases in prescription costs.^^ Thus, quality improvement, disease management, and cost containment are praiseworthy goals for pharmacy benefits management. However, the means used to achieve these goals must also be appropriate. In this section, this Article recommends guidelines for allowing personal health information to be used for such purposes. These recommendations go beyond the proposed regulations ofthe Department of Health and Human Services in requiring clear evidence ofbenefit to patients, an oversight committee, patient authorization, disclosure or prohibition of conflicts of interest, and additional safeguards for sensitive medical conditions. A. Strong Evidence ofBenefit to Patients Benefit to patients is a necessary condition for using personal health information in pharmacy benefits management. Ethically, the guidelines of beneficence and nonmaleficence can provide a strong warrant for using personal health information. However, there are practical difficulties in determining the degree of benefit to patients. To reduce controversies over whether a particular program benefits patients, two operational questions need to be asked about benefit: First, what standards should be used to determine benefit? Second, who decides whether a project is beneficial? The standard for benefit should be evidence-based medicine and clinical epidemiology.^ Criteria have been published in peer-reviewed journals for evaluating the strength of evidence in clinical trials. Studies should be given more weight if they have been designed to minimize bias and to enhance the generalizability offindings. Criteria have been established for specific issues in research design, such as selection of subjects, attention to potential confounding factors, specificity of the intervention, blinding, comparability of groups at 58. See id at 122. 59. See As Drug Costs Rise, Health Plans Shift the Burden, supra note 29, at 153; ExplodingPharmacy Costs, 3 OnMANAGEDCARE 2 ( 1 998). See generally Mark R. Chassin et a!., The Urgent Need to Improve Health Care Quality, 280 JAMA 1000 (1998). 60. See generally Evidence-Based Medicine Working Group, Evidence-Based Medicine: A New Approach to Teaching the Practice ofMedicine, 268 JAMA 2420 (1992). 2000] PRESCRIPTION DRUG CONFIDENTIALITY 949 baseline, selection of outcome measures, and adequacy of follow-up.^' Furthermore, standards have been set for how to combine findings from disparate studies in a rigorous way." These standards have been subjected to peer review and have been widely accepted. When deciding whether to recommend that patients be changed from one drug to another, a pharmacy benefits management program should use these standards for evaluating clinical evidence when reviewing the pertinent published literature. The conclusions ofa study should be given more weight if it has been conducted in accordance with these rigorous standards. Conversely, the conclusions should be given less weight ifthe study fails to meet these standards. Similarly, pharmacy benefits management programs that inform patients ofnew drugs are justified only if a critical review ofthe published evidence establishes that the drugs are superior to the alternatives or at least clinically equivalent. Again, standards have been established for specifying how to determine whether two drugs are clinically equivalent. B. The Role ofan Oversight Committee The second question in evaluating benefit to patients is who decides whether a project is beneficial. The decision-maker should be impartial and balanced. An interdisciplinary oversight committee is preferable to an individual decision- maker because different members can point out overlooked issues, unexamined assumptions, and hidden value judgments. In a committee, a range of perspectives can be articulated and considered. The committee should determine: whether the benefits ofthe program are sufficiently well established tojustify the risk ofbreaches ofconfidentiality; whether adequate safeguards for confidentiality are in place; whether other ethical concerns about the program have been addressed; and whether a project should be characterized as advertising and therefore subject to heightened scrutiny. To carry out these tasks the oversight committee should include patient advocates and experts in the confidentiality of computerized databases as well as clinical pharmacists, physicians, and experts in evidence-based medicine, who can help assess the strength of published evidence regarding a drug. This is a different membership from a pharmacy and therapeutics committee that determines what drugs a hospital will include in its formulary. Because of concerns about conflicts ofinterests, the majority ofcommittee members should have no financial stake in the decisions, the organization holding the data, or a contracting organization and should not be employees of the organization or a 61 . See generally Guyatt et al., User 's Guide IIA, supra note 35; Guyatt et ai., User 's Guide IIB, supra not^ 35. 62. See generally Antonia L. Dans et al.. User 's Guide to the Medical Literature: XIV. How to Decide on the Applicability ofClinical Trial Results to Your Patients, 279 JAMA 545 (1998); Guyatt et al., User's Guide XVI, supra note 35; Robert S. Hayward et al.. User's Guide to the Medical Literature: VIII. How to Use the Clinical Practice Guidelines: A. Are the Recommendations Valid?, 274 JAMA 570 (1995). 950 INDIANA LAW REVIEW [Vol. 33:937 contracting organization. Independent review as a means to protect patients has a precedent in institutional review boards ("IRBs") for research on human subjects. IRBs are charged with protecting research subjects and assuring that the balance of benefits to risks in a research project is acceptable. Under federal regulations, IRBs are required to have members who are not associated with the institution, who are nonscientists, and who are primarily concerned with the welfare of subjects.^^ Furthermore, IRBs usually develop rules for recusing members who have ties to the investigator whose project is being reviewed in order to prevent conflicts of interest or the appearance of such conflicts. The inclusion of community members and persons with a range of disciplines is intended to enhance the committee's ability to carry out its functions. Recently IRBs have been criticized for lacking expertise in ethical issues, paying too much attention to consent forms rather than study design, delaying important research because of bureaucratic requirements, and missing serious ethical lapses.^ Many believe that IRBs are overworked and lack the resources to carry out their job adequately. These criticisms of IRBs can be useful in designing oversight committees for using patient databases for pharmacy benefits management. First, these oversight committees need to consider both the benefit of the pharmacy benefits management and the risk of violating confidentiality. IRBs have been criticized for examining only the risks to subjects, not the benefits of the research. Critics assert that the balance of benefits to risks that is crucial. In a similar way, database oversight committees need to consider the clinical benefits of using personal health information in pharmacy benefits management, the risks ofbreaching confidentiality, and adequacy ofsteps taken to minimize breaches ofconfidentiality. Second, database oversight committees must have sufficient resources to carry out their task. Third, these committees need to operate in a timely manner. Procedures need to be devised to assure prompt but thorough review of proposed pharmacy benefits management programs. C. Patient Authorization The Department ofHealth and Human Services proposed regulations allow electronic personal health information to be used without patient authorization for treatment, payment, and core business operations.^^ The Department argues that signing an authorization form does little to promote confidentiality.^^ 63. See Protection of Human Subjects, 45 C.F.R. § 46. 1 07 (1 998). 64. See OFFICE OF EXTRAMURAL RESEARCH, NAT'L INT. OF HEALTH, EVALUATION OF NIH Implementation of Section 491 of the Public Heath Service Act, Mandating a Program OF Protection for Research Subjects (1998); GAO, Continued Vigilance Critical to Protecting Human Subjects 17-23 (1998). 65. See Health Insurance Portability and Accountability Act of 1 996, Pub. L. No. 1 04- 1 9 1 , § 264(c)(2), 1 10 Stat. 1936, 2033 (1996). 66. See id 2000] PRESCRIPTION DRUG CONFIDENTIALITY 95 1 However, notification and authorization show respect for patients as persons, even iftheir practical choices are constrained. For those patients who are deeply concerned about breaches ofconfidentiality, a requirement ofauthorization gives them greater control over their personal health information. Even iffew patients can afford to limit access to their personal health information, it is important to make it simple for them to do so. Authorization is particularly important for pharmacy benefits management because of concerns about the degree of patient benefit and about conflicts of interests. Because of such issues, some patients may not want their personal health information to be used by certain pharmacy benefits management programs. Requiring affirmative authorization gives patients more control over the use of personal health information than placing the burden on patients to object. The legal formality of signing a document calls attention to the possibility ofchoice and objection.^^ An authorization requirement increases the likelihood that patients will act on serious concerns.^* As in research studies, participation rates are likely to be lower if affirmative consent is required than if patients are entered into the program unless they object.^^ 1. Authorization as a Condition ofCare.—Patient choice is constrained by the economic reality that drug costs and overall health costs need to be restrained. Health care organizations and plans should be allowed to make the use of personal health information for pharmacy benefits management a condition ofcare. The burdens ofkeeping records of individual authorization or allowing individuals to opt-out of certain uses of their personal health information will reduce the cost-effectiveness ofpharmacy benefits management. Administrative burdens will be particularly heavy ifpatients want their personal health information to be used for certain pharmacy benefits management programs but not others. Furthermore, there are important considerations of justice at stake. A patient who does not participate in pharmacy benefits management is a "free rider," obtaining the benefits ofcost-effective care without sharing the risks to confidentiality. When physicians make a drug switch, they tend to make the switch for other patients as well.^° Thus, other patients benefit if a pharmacy benefits management program points out that an effective drug is underutilized or suggests that the patient be switched to an equivalent but more cost-effective drug. 2. Authorization NeedNot Be Burdensome,—On annual enrollment or first clinical contact health care providers now commonly obtain authorization to release information to third party payers. Even where such release is authorized by statute, health care providers commonly ask patients to sign an authorization. At those times, patients could also be asked to authorize the use of their health information for pharmacy benefits management. Thus, requiring authorization 67. See Lon L. Fuller, Consideration and Form, 4 1 COLUM. L. REV. 799, 800 ( 1 94 1 ). 68. See Health Privacy Working Group, supra note 23. 69. See National Biothics AdvisoryComm'n, ResearchonHuman StoredBiologic Materials 69-70 ( 1 999). 70. See Rosoff, supra note 14, at 12. 952 INDIANA LAW REVIEW [Vol. 33:937 would not necessarily entail additional costs to health care organizations because many are already obtaining such authorization. Note that authorization may need to be obtained at the point of service because patients may seek care without previous contact with the provider. Separate authorization for each use of information, as advocated by some health privacy advocates, would be prohibitively burdensome. A policy of one-time authorization that allows authorization to be a condition of care is a feasible middle ground between statutory authorization and authorization for each specific use.^^ 3. Disclosure or Prohibition ofFinancial Conflicts ofInterest.—Disclosure of financial arrangements is a widely accepted response to conflicts of interests and may be useful in several ways.^^ Public scrutiny may deter projects that are ethically problematic, as ultimately occurred in the Elensys case.^^ Disclosure of financial arrangements in pharmacy benefits management also may help patients make several important decisions, including whether to choose a particular benefits plan, whether to appeal a formulary restriction, or whether to pay more out of pocket for a drug not on the plan's list of preferred drugs. Some conflicts of interests are so severe that they should be prohibited, rather than merely disclosed.^"* The likelihood and magnitude ofbiased decisions is too great, or the perception that decisions will be unfair is unacceptable. Pharmacy benefits management programs should not pay pharmacists for switching patients to specific drugs. ^^ If reimbursement to pharmacists in drug swdtching programs truly is for record review, patient education, and discussion with the physician, the pharmacist should be paid for these activities even if no subsequent switch is made. D. Sensitive Medical Conditions Some conditions, such as HIV infection, mental illness, and substance abuse, carry greater risks of discrimination and stigma. Many states have enacted stricter confidentiality protections for such conditions. For example, specific written consent may be required to disclose HTV test results or mental health records. ^^ However, effective therapies are underused in these conditions, and primary care physicians underdiagnose and undertreat major depression.^^ 7 1 . See Health Privacy Working Group, supra note 23 . 72. See Lo, supra note 19, at 267-72; Dennis F. Thompson, Understanding Financial Conflicts ofInterest, 329 NEW Eng. J. Med. 573, 575 (1993). 73 . See O'Hairow, Giant Food, supra note 3, at Al . 74. See Lo, supra note 1 9, at 267-72. 75 . See Baker, supra note 43 , at C 1 . 76. See CaL. Civ. Code §§ 56-56.37 (Deering 1997); Ronald Byer, Public Health Policy and the AIDS Epidemic: An End to HIVExceptionalism?, 324 NEW ENG. J. MED. 1 500, 1 50 1 -02 (1991); Gostin, supra note 20, at 508. 77. See generally Robert M.A. Hirschfeld et al.. The National Depressive and Manic- Depressive Association Consensus Statement on the Undertreatment of Depression, 277 JAMA 333,333-40(1997). 2000] PRESCRIPTION DRUG CONFIDENTIALITY 953 Physicians commonly use suboptimal doses of antidepressants, stop the drug too soon, or fail to consider other therapeutic approaches if an antidepressant is ineffective. Therefore, patients with sensitive conditions could benefit from pharmacy benefits management that monitors underutilization ofbeneficial drugs and failure to obtain refills. Pharmacy benefits management should be permitted for these sensitive conditions that are accorded greater protection by state law, but it should be subject to several additional safeguards. First, exclusive authorization to access personal health information regarding sensitive conditions for this purpose should be separate from authorization to access other personal health information. Second, there should be earlier and more significant physician involvement in pharmacy benefits management for these sensitive conditions. Physicians should be involved both in planning projects and notifying patients when changes in therapy are recommended. Such physician involvement helps ensure that programs are based on sound clinical judgment and truly benefit the patient. And lastly, organizations carrying out such programs should consult with advocacy groups for persons with the condition. Such consultation will help health care organizations to address patient concerns about confidentiality and may suggest changes that would increase acceptance of the program. For example, a pharmacy benefits management program on mental illness is likely to be more widely accepted by patients if it cannot access detailed psychotherapy notes that contain the patient's innermost feelings, fantasies, and fears. A 1995 incident in which psychotherapy notes were readily accessible on the computer network of a health maintenance organization illustrated that patients regard inappropriate access to psychotherapy notes as a serious breach of confidentiality.^^ Such access to intimate information is not needed to achieve the goals ofpharmacy benefits management. Finally, comprehensive safeguards are particularly important for sensitive conditions, as we next discuss. With such safeguards in place and with assurance that therapy notes will not be disclosed, patients are more likely to be willing to disclose such information as their diagnosis, medications, scores on fimctional status scales, and number and duration of office visits. This information, frequently withheld, is precisely what pharmacy benefits management programs need in order to determine whether the patient is receiving appropriate drugs, dosage, and duration of treatment. E. Safeguardsfor Confidentiality Policies regarding pharmacy benefits management make sense only within the context of comprehensive protections for personal health information. Organizational, technical, and physical safeguards for confidentiality have been extensively discussed.^^ The Department of Health and Human Services has 78. See Alison Bass, HMO Puts ConfidentialRecords On-Line: Critics Say Computer File- Keeping Breaches Privacy ofMental Health Patients, BOSTON GLOBE, March 7, 1 995, at Al . 79. See generally FOR THE RECORD, stipra note 11; NATIONAL COMM. FOR QUALITY 954 INDIANA LAW REVIEW [Vol. 33:937 issued proposed regulations for the security of individual health information by health care providers, plans, and clearinghouses.**^ These proposed regulations include: 1. Limitations on access. Ethically, use of patient-identifiable information should be restricted to what is needed for a specific project. The proposed regulations require that employees of health care organizations should have access only to information they need to perform their roles. For example, unlike nurses and physicians, billing clerks do not need access to detailed clinical information such as test results. Access may be restricted according to the person's role in the organization or place of work.** 2. Organizational policies and procedures regarding confidentiality, implemented through employee training and disciplinary actions for violations.*^ 3 . Technical security to control and monitor access to information and to prevent unauthorized access. The identity of the person seeking access should be verified through unique user identification and verification through a token, personal identification number, password, or a biometric identification system. There should be audits of access to the system, in order to identify problems. In particular, an audit trail ofall persons who have accessed a person's records allows unauthorized access to be detected.*^ In addition to these safeguards, the Elensys incident illustrates the need for restrictions on service organizations that contract with health care providers to analyze electronic personal health information. Personal health information should have the same protection, whether it is used internally within a health care organization that collected the information or by an external service organization. In other words, patients should have the same protections for identifiable health information, no matter who is using the data. The information should always be protected, no matter where the information is within the health care delivery system. Furthermore, service organizations should not use personal health information for purposes other than the original disclosure, and they should not disclose the data to third parties, without additional authorization from the patient. Information about safeguards should be made available to patients. Patients who are informed about the measures taken to maintain confidentiality may conclude that their concerns have been adequately addressed. In turn, such Assurance, Accredatation 2000, Draft Standards forManagedCare Orgs. &Managed Behavioral Health Care Orgs. (1999). 80. See Standards for Privacy ofIndividually Identifiable Health Information, 45 C.F.R.§§ 160-164(1999). 81. Id § 164.506(a). 82. Id § 164.518. 83. Id § 164.518(c). 2000] PRESCRIPTION DRUG CONFIDENTIALITY 955 patients may then be willing to have their personal health information used in pharmacy benefits management programs. F. Additional Restrictionsfor Advertising Some programs calling themselves "pharmacy benefits management" are more accurately characterized as advertisements. The organization's oversight committee should have the authority to decide whether this is the case.^ In light of the concerns about advertising discussed earlier in the paper, additional protections are needed when personal health information is used for this purpose. Patient authorization to use personal health information for advertising should be separate from authorization for pharmacy benefits management.*^ A separate authorization highlights differences between advertising and other uses of personal health information. Furthermore, authorization for advertising should never be used as a condition ofcare. Patients should be told that they may refuse authorization for advertising without compromising the care that they receive from the provider or health care plan. Patients also should be able to withdraw authorization for advertising at a later time. CONCLUSION Federal debates on health privacy offer the opportunity to develop coherent confidentiality policies. Comprehensive policies can both relieve patient concerns about confidentiality and also allow appropriate use ofpersonal health information in pharmacy benefits management. Sound policies for using personal health information in pharmacy benefits management should require clear evidence of benefit to patients, an oversight committee, patient authorization, disclosure or prohibition of conflicts of interest, additional safeguards for sensitive medical conditions, adequate confidentiality safeguards, and additional restrictions on advertising. 84. See discussion supra Part IV.B. 85. See Health Privacy Working Group, supra note 23, at 5.