Supreme Court Strikes Down Vermont Prescription Data Mining Law

In a clear and resounding victory for data mining companies, the U.S. Supreme Court June 23 struck down a Vermont law prohibiting pharmaceutical companies from buying or using prescription data for marketing purposes. The decision, Sorrell v. IMS Health Inc.,¹564 U.S. ___ (2011), slip opinion available at http://www.supremecourt.gov/opinions/10pdf/10-779.pdf. holds that the state law prohibiting the sale for marketing purposes of prescription data that identifies prescribers (but not patients) is an unconstitutional infringement on the free speech rights of pharmaceutical and data mining companies. The case was decided on First Amendment grounds, with the court roundly rejecting Vermont’s arguments that the state law was needed to protect privacy.

In order to fully understand the court’s opinion, some background on the kind of data that Vermont was regulating is needed. When a patient goes to a pharmacy to have a prescription filled, the pharmacy is required by law to collect certain information about the transaction, including the name and dosing details of the prescribed drug and the physician’s name. After the prescription is filled, many pharmacies sell the prescriber-identifiable data to data aggregation companies like IMS Health. It is illegal under the Health Insurance Portability and Accountability Act for pharmacies to sell patient-identifiable data and therefore patient identifying information is removed from the data sets. Research and publishing companies aggregate and analyze billions of prescription drug records derived from pharmacy records across the country. Aggregated data sets are then made available on the commercial market for a number of purposes, including research and marketing. Armed with data about particular prescribers and their prescribing habits, a pharmaceutical sales representative can more effectively target physician marketing and education efforts through the process known as “detailing.” This is the practice specifically that Vermont was seeking to limit.

In 2007, Vermont enacted a law restricting the use of pharmacy prescription claims data by pharmaceutical companies for marketing purposes.²Vt. Stat. Ann. Tit. 18, § 4631 (Supp. 2010). Information about Vermont physicians could be used only to the extent an individual doctor agreed to the data use by checking a box on their annual license forms. Vermont argued that the law was constitutional for two reasons. First, the state asserted that the law was vital to the achievement of state health policy objectives: changing the way that pharmaceutical companies could “detail” would lower health care costs and improve health care outcomes by encouraging doctors to prescribe generic drugs and focusing pharmaceutical marketing efforts more on objective medical issues rather than on targeting specific doctors. Second, the state argued that the law was necessary to protect medical privacy in general and physician confidentiality in particular.

The court struck down the Vermont statute as an unjustifiable content- and speaker-based restriction on the free speech of pharmaceutical and data mining companies. The rapidly growing stores of electronic health records and medical claims transactions have enabled health researchers, public health officials, pharmaceutical manufacturers, and others to perform increasingly sophisticated data analyses for a multitude of purposes. Vermont did not restrict access to pharmacy prescription data across the board nor did it directly regulate conversations between drug companies and doctors. Rather, the state restricted access by drug companies to prescription data for the purpose of determining how best to target their marketing and education efforts. The majority seemed to view the statute as an attempt to get doctors to prescribe generic drugs over their brand-name competitors by restricting speech and denying doctors access to full information about the name-brand drugs.

In a 6-3 decision written by Justice Anthony Kennedy, the court concluded that the Vermont law placed content- and speaker-based restrictions on the disclosure and use of prescriber-identifiable data. The court found that the law prohibited speech based on the content of the speech (marketing) and the speaker (pharmaceutical companies) and as such heightened scrutiny should be applied. That meant that the law needed to “show at least that the statute directly advances a substantial governmental interest and that the measure is drawn to achieve that interest.”³See Bd. of Trs. of State Univ. of N.Y. v. Fox, 492 U.S. 469, 480-81 (1989); Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm’n of N.Y., 447 U.S. 557, 566 (1980). The court found that Vermont’s justifications for its law did not withstand the heightened scrutiny applied to content-based burdens on protected speech. As noted above, Vermont put forth two primary justifications for the law. First, the state argued that restricting the ability of drug companies to “detail” prescribers would enable physicians to make better prescribing decisions, which would reduce costs and improve the quality of health care. Although the court concedes that Vermont’s health care policy goals may be proper, the majority concluded that Vermont imposed a policy that singled out pharmaceutical companies and allowed any speech related to the use of prescriber-identifiable data except for one—the use of prescriber data for marketing purposes. The court hammers the point that just because certain speech is effective or persuasive and that speech runs counter to a governmental interest does not give the government a license to burden this speech.

The court also rejected the state’s second justification for the statute: that the law was necessary to “protect medical privacy, including physician confidentiality, avoidance of harassment, and the integrity of the doctor-patient relationship,” noting that the statute allows for the sharing of prescriber-identifiable data for any reason except marketing. The court also dismissed Vermont’s privacy arguments related to protecting physicians from “harassing sales behaviors,” pointing out that doctors are free not to allow pharmaceutical sales representatives into their offices and that a law is not necessary to protect physicians from pharmaceutical companies when doctors can simply provide their office staff with “No Detailing” instructions.

Justice Stephen Breyer, in a dissent joined by Justices Ruth Bader Ginsburg and Elena Kagan, argued that the Vermont law is “inextricably linked to a lawful governmental effort to regulate a commercial enterprise,” that the standard the court typically applies to statutes that regulate commercial speech should be applied, and under that standard the Vermont law should be upheld.

The decision resolves the question of whether the Maine and New Hampshire laws that regulate the use of prescriber-identifiable data can stand.⁴See Me. Rev. Stat. Tit. 22, § 1711-E; N.H. Rev. Stat. Ann. § 318:47-f. These laws had been challenged and upheld by the U.S. Court of Appeals for the First Circuit as constitutional state regulations of conduct rather than speech.⁵See IMS Health Inc. v. Mills, 616 F.3d 7 (1st Cir. 2010), IMS Health Inc. v. Ayotte, 550 F.3d 42 (1st Cir. 2008). Neither can stand in the wake of Sorrell. In the Maine litigation, a certiorari petition currently is pending at the Supreme Court and likely will be remanded for further consideration. [The Supreme Court June 28 vacated the IMS Health Inc. v. Ayotte judgment and remanded the case to the First Circuit]. In light of Sorrell, litigants can be expected to re-open the New Hampshire decision upholding that state’s prescriber data law.

As the rate at which health-related data can be obtained, aggregated, mined, and published explodes exponentially, legislators and policymakers will need to find ways to protect legitimate and important privacy interests without unconstitutionally restricting speech. Sorrell was being closely followed by a great number of states. More than 35 states joined in an amicus brief in support of the Vermont law, supporting the view that the restrictions would promote the states’ interest in cost savings associated with curbing the controversial practice of “detailing” and thereby encourage physicians to prescribe generic and therapeutically equivalent drugs.⁶Brief for the states of Illinois, Alabama, Arizona, Arkansas, California, Colorado, Delaware, Georgia, Hawaii, Idaho, Indiana, Iowa, Kentucky, Louisiana, Maine, Maryland, Minnesota, Mississippi, Montana, Nevada, New Hampshire, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Washington, and West Virginia and the District of Columbia as Amici Curiae in Support of Petitioners, Sorrell v. IMS Health Inc., 564 U.S. ___ (2011) (No. 10-779). Many of these states have bills similar to the Vermont law pending in their legislatures. Although the Supreme Court did not shut the door completely on laws regulating access to prescriber-identifiable data, the appetite among legislators to enact these types of restrictions likely will be significantly diminished. To the extent efforts continue, the bills are likely to be more focused on privacy concerns.

Despite its assumption in Sorrell that physicians have an interest in keeping their prescribing habits confidential, the court refused to view the Vermont law as being appropriately drawn to serve this interest—stating that the statute serves to keep prescriber information private only from one category of entities: pharmaceutical companies. While the court rejects Vermont’s privacy argument, the court did suggest that physician privacy could be protected with a law that permits the sale or disclosure of information in “a few narrow and well-justified circumstances,” citing HIPAA and its implementing regulations as an example of a law that is appropriately drawn to protect privacy interests. The court went on to point out that although privacy measures need not necessarily avoid content-based rules, state privacy protections cannot be conditioned on an individual’s acceptance of a state’s legislatively created priorities (in this case the disfavor of pharmaceutical detailing). In its conclusion, the court summarized its view on the importance of privacy and how it should be factored into government regulation:

The capacity of technology to find and publish personal information, including records required by the government, presents serious and unresolved issues with respect to personal privacy and the dignity it seeks to secure. In considering how to protect those interests, however, the State cannot engage in content-based discrimination to advance its own side of a debate… . Privacy is a concept too integral to the person and a right too essential to freedom to allow its manipulation to support just those ideas the government prefers.⁷Sorrell 564 U.S. at ___ (slip op., at 24-25).

Although Sorrell was decided as a free speech case, the court acknowledged privacy as a legitimate state interest for regulating speech in the right way and under appropriate circumstances. Unlike patient-identifiable data, however, which receives significant protection under both federal and state law, the extent to which physicians have a privacy interest in data related to professional services they provide is far less clear. The decision dramatically limits the ability of states to restrict the use of prescriber data for marketing, although parts of the decision and in particular some of the dicta on privacy and data use may serve as a springboard for future efforts.