The bad news (and good news) about your medical privacy

By Associate Professor Aaron Caplan

On June 23, 2011, the U.S. Supreme Court issued its 6-3 decision in Sorrell v. IMS Health, Inc. I previously wrote about the case here. In the new decision, the Court invalidated a Vermont law that prohibited the sale and use for marketing purposes of pharmacy records that reveal doctors' drug prescribing practices without the doctors' permission. The Court viewed Vermont's law as a ham-handed attack on a particular type of commercial speech, so its ordinarily laudable free speech impulses kicked in. However, it failed to recognize the legitimacy of protecting informational privacy as a governmental goal, and indeed doubted that the law would even advance doctors' privacy. This surely comes as a surprise to doctors, who now find that data brokers have a constitutional right, at least in some settings, to buy and sell their information for commercial gain without their knowledge or consent.

The Court's decision contains mostly bad news for those who value individual control over the commodification of personal information. However, it leaves open the possibility that the real flaw in Vermont's law was not that it attempted to protect too much privacy, but that it protected too little.

THE BAD NEWS.

1. The Court revealed little understanding of why violations of informational privacy are troublesome. Evidence at trial showed that many doctors felt violated when they learned that pharmacies were selling information about the doctors' prescriptions to drug manufacturers behind their backs, alarmed that the manufacturers were secretly using the information to manipulate them during visits by pharmaceutical representatives, and outraged that the records could be used as a back-door method of determining their confidential and privileged advice to their patients. The biggest harm to privacy was not, as the Court seemed to think, that a pushy sales representative might come to a doctor's office. The harm was that doctors reasonably felt that their lives and livelihoods were under surveillance for the benefit of others. Overall, the Court showed little enthusiasm for informational privacy as a desirable component of a good society, and no recognition at all that it is a value of constitutional stature.

2. The Court seems to view informational privacy as an all-or-nothing proposition. If information leaks to anyone outside of a legally privileged relationship (such as the doctor/patient privilege), then all privacy is lost. Hence, once the information goes to a pharmacist, then it may be shared with even more people without causing any further privacy injury. As a matter of social reality, privacy is not identical to secrecy or confidentiality. Privacy is affected differently depending on who gains information about someone else and for what purpose. Patients may reveal personal information to doctors or pharmacists or insurance companies or medical researchers - some of whom are strangers to the patients - but that does not mean that they feel the same about revealing that same information to all possible strangers, including those who can use the information to earn greater profits, some of which might come at the patient's expense. Whether a disclosure of information is an invasion of privacy cannot be determined solely by looking at the information itself; one must also consider who gets the information and what they do with it. Vermont's law acknowledged this reality by placing limits on the sale of medical information for marketing purposes - which is the greater privacy intrusion - while still allowing it for other uses that harm privacy less. The Court decried this as "content based" and "speaker based" discrimination against those who would use the information for marketing purposes, without recognizing that the degree of privacy invasion differs depending on who obtains the information and for what purpose.

3. The Court was oblivious to the government's own role in facilitating the circulation of this private information. Pharmacists have information about what drugs doctors recommend to patients only as a result of the government's drug-control regulations; it is not as if pharmacists have this information as a consequence of natural law. One of Vermont's major arguments was that when the government forces someone to disclose personal information to a third party, it may also take reasonable steps to ensure that the third party uses the information for its intended purposes and does not disseminate it further. The majority scarcely even acknowledged that the argument was made, but its reasoning seems to reject it. The Court seems to treat all non-governmental possessors of information identically, even if those parties would not have certain information but for government intervention that transferred the information to them by force of law and for limited purposes.

THE GOOD NEWS.

Although it improperly belittled the privacy interests involved in the case, the majority acknowledged (somewhat grudgingly) that in some settings informational privacy may be protected by law. It objected to Vermont's law because it believed the law's real goal was to hobble speech by drug companies, and not to protect privacy. As the majority understood the statute, pharmacists could sell or give away doctors' medical information for a wide variety of reasons, and restricted its dissemination only for one particular use (marketing) by one disfavored class of users (pharmaceutical companies). "If Vermont's statute provided that prescriber-identifying information could not be sold or disclosed except in narrow circumstances," the majority wrote, "then the State might have a stronger position." Time will tell if the Court is serious about this proviso. If future lawmakers craft their privacy protections more broadly, the Court may be persuaded - as it was not in this case - that a privacy law is indeed a privacy law.