Physician Rights to Privacy of Data Prevail in Two Major Court Tests, But New Questions Lie Ahead

It is becoming increasingly clear that the days of paper-based medical records are numbered. The writing is on the wall or, perhaps more accurately, on the silicon, as electronic medical records (EMRs) are fast becoming the method of choice for storing clinical data. The newly passed economic stimulus bill, which allocates $20 billion to encourage the use of EMRs, will greatly accelerate the trend.

Beyond EMRs, patient information is captured electronically through many different routes and for many different purposes. Patients compile their own medical dossiers on Web sites. Payers, both public and private, profile practitioners’ practice patterns based on re-imbursement claims. Third-party vendors facilitate electronic communication for electronic prescribing, claims submission, and other functions. The avenues for electronic sharing of clinical data have grown steadily over the past several years, and they promise to proliferate even more rapidly in the years ahead.

Medical information that is linked to identifiable patients is protected from unauthorized disclosure by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA). As a matter of ethics, patient privacy is widely considered to be sacrosanct. But what about the disclosure of information that identifies individual physicians?

ELECTRONIC RECORDS AND PHYSICIAN PRIVACY

The legal recognition of physician privacy, when electronic medical information is compiled and transmitted, is far from clear. Historically, publicly available data on physician behavior has been scarce, but the Internet has changed things dramatically. Various Web sites now list disciplinary actions and malpractice judgments, and some Web sites include patient comments. Zagat’s, the company that rates restaurants based on customer input, is reportedly planning to begin scoring physicians in a similar manner.¹ None of these data sources has yet faced a legal challenge, although there is concern among many physicians about Web-based patient critiques.

Two other uses of physician information are more controversial legally. One is the practice used by large commercial organizations, most notably IMS Health, Inc., and Verispan, LLC, now owned by Surveillance Data, Inc. (SDI). These companies compile data from pharmacies on individual physicians’ prescribing practices. The information is then sold to other businesses, including pharmaceutical companies, which use it to guide detailing. This business arrangement has been in effect for many years.

The other use of physician information is more recent. It takes the form of Medicare’s recently initiated pay-for-performance (P4P) program, in which physician reimbursement is tied to data that measure compliance with best practices. A consumer organization, Consumer’s Checkbook/Center for the Study of Services, has sought access to this compliance information through the federal Freedom of Information Act to use it as the basis for publishing consumer guides.

RECENT COURT DECISIONS FAVORING PHYSICIAN PRIVACY

In two recent separate cases, federal appeals courts reviewed these arrangements. In both instances, arguments favoring physician privacy prevailed. Physician organizations have generally been supportive of the results, although appeals are still possible in both cases. Whatever the ultimate outcomes, both decisions could have far-reaching implications for future use of electronic health data.

New Hampshire Protects Physician Prescribing Data

The first case was a challenge to a New Hampshire law that outlawed the dissemination of physician-identified pharmacy data for commercial purposes. The law’s stated purpose was to limit pharmaceutical marketing practices that could inflate health care costs by targeting physicians for promotional activity.² Dissemination for other uses, such as utilization review or health care research, was still permitted. IMS Health and Verispan claimed that the law violated their right to free speech, and they won in the lower court in 2007. In November 2008, in the case of IMS Health v. Ayotte,³ the U.S. Court of Appeals for the First Circuit reversed that decision, thereby permitting the law to take effect.

The appeals court reasoned that the compilation and dissemination of data represent forms of conduct rather than of speech. The data in question do not articulate ideas and do not seek to influence public debates. To the extent that the information represents speech, it is “commercial speech” and promotes a business interest. The Supreme Court has assigned a level of protection for this form of communication that is lower than that for speech promoting a political position. Commercial speech can be trumped more easily when a competing public policy interest—in this case, controlling health care costs—comes into play.

No Public Access to Medicare Pay-for-Performance Data

In January 2009, the U.S. Court of Appeals for the District of Columbia reversed a lower court ruling that had granted Consumer’s Checkbook access to Medicare P4P data.⁴ The court found the public interest in availability of the data to be nonexistent. As a result, the court reasoned that the release of these data would create an “unwarranted invasion of personal privacy” of physicians.

The government had argued that the information would have been misleading to patients if they had they tried to use it to judge the competence of individual physicians.⁵ At the same time, when combined with other publicly available data, the information could have been used to calculate a physician’s total annual Medicare payments, which should be treated as confidential. Consumer’s Checkbook had argued that greater transparency through data disclosure is in patients’ best interests and that consumers of a service should decide for themselves what information they wish to rely on and how they wish to use it.

REACTIONS TO THE DECISIONS

Because both cases are subject to appeal and might be brought before the Supreme Court, the ultimate outcomes are not yet known. If the New Hampshire statute survives, other states may follow along. Similar laws have been considered in 15 states.⁶ Vermont and Maine have already passed their own privacy laws for physician prescribing information, but implementation has been suspended pending the outcome of the New Hampshire litigation. However, these laws are less stringent because they grant physicians the option of permitting their prescribing data to be disseminated.

Prohibiting the commercial use of these data could dramatically alter pharmaceutical marketing. Drug companies rely on this type of information to target the activities of sales representatives and to judge their effectiveness. Without it, the entire paradigm under which pharmaceutical detailing operates might have to change.

Restricting public access to Medicare P4P data would have a more limited effect, as this information is narrow in scope. However, restrictions on the availability of government data involving physician performance hold implications for the broader movement to empower decision making in health care by consumers.

Physician groups have supported the outcomes of both court cases. The New Hampshire Medical Society filed an amicus brief in support of that state’s statute. The Society’s president, Charles Blitzer, MD, said that the law “has been a significant step forward in safeguarding physician independence.” (Personal communication, February 28, 2009.) The American College of Physicians, which represents internists, has asked the American Medical Association (AMA) to forbid all collection of physician prescribing information.⁷ The AMA actively intervened in the Medicare P4P lawsuit in support of denying data access.

Physicians will increasingly find themselves leaving what some observers have called “electronic tracks” while they perform their professional duties.

On the other side, the Pharmaceutical Research and Manufacturers of America (PhRMA) predicted that the New Hampshire decision would make it more difficult for doctors and patients to obtain current information about medications.⁶ IMS and Verispan issued a joint statement contending that physician prescribing information is vital to efforts to improve health care quality, efficiency, and safety.⁸ Consumer’s Checkbook said that denial of access to Medicare P4P data robs the public of a powerful tool with which to judge physician quality and the overall performance of the Medicare program.⁵

OUTLOOK FOR PHYSICIAN PRIVACY

Whatever the ultimate resolutions of these cases, the matter of physician privacy is likely to become more complex over the next few years. New forms of data and new kinds of analytical applications will continue to arise as clinical records complete their migration from paper to digital formats. Physicians will increasingly find themselves leaving what some observers have called “electronic tracks” while they perform their professional duties.⁹ In each instance, policy-makers will have to balance intrusions on privacy against a competing policy goal in one way or another.

The next round of debates in Congress, state legislatures, and the courts is likely to focus on the greater public good that could result from the release of physician-identified data in improving health care quality and controlling costs. The movement to facilitate greater decision making by consumers is also likely to push demands for more transparency of information. All sides should be prepared for data policy wars that may shape the brave new world of electronic medical information. The logistics of replacing paper records is only the start.