Your health care data is for sale. Here’s how Big Pharma is using it.

Big Pharma buys consumer health care data and uses it to target doctors who don’t prescribe their drugs. Pharmaceutical companies have been doing this for decades, yet few people know it happens. Many doctors don’t fully understand how it’s done. 

Straight Arrow News investigated how both doctor and patient data are collected, sold and utilized through a little-known $9 billion industry.

How do insurance companies sell personal health care data?

The sale of consumer information between insurance companies and pharmaceutical giants may sound like a violation of health care privacy laws, but drug companies can legally use this data to target specific doctors as long as patient names are replaced with numbers. 

“They know your age, your sex, your medications, your hospitalizations, your illnesses, and the zip code where you live, but as long as your name isn’t attached to that information but you’re identified by a number, that’s considered anonymized patient level information,” Dr. Adriane Fugh-Berman told Straight Arrow News. “That is compliant with HIPAA laws.” 

Fugh-Berman has been researching the marketing and sales practices of Big Pharma for decades. She is a professor in the department of pharmacology and physiology at Georgetown University Medical Center. 

Pharmacies sell prescription data 

The prescription data sold by pharmacies de-identifies patient information and replaces doctors’ names with their license numbers. 

But here’s the key: The American Medical Association sells access to its physician master file, which contains the license information for nearly every doctor in America. This gives drug companies everything they need to connect doctors to their prescriptions. 

“They know exactly what they’re prescribing and they also know what they’re prescribing it for,” Fugh-Berman told SAN. 

Health care intelligence companies 

A $9 billion industry called health care commercial intelligence buys all this data from insurance companies and pharmacies and puts it together in an easy-to-use database. 

Drug companies subscribe to these databases and use the information to make inroads either in a new market or with a new drug. 

Definitive Healthcare, for example, sells itself as having all the answers to pharmaceutical companies’ most important questions including: Who are the physicians most likely to prescribe your drug? How large is the market for your medical device? Who are the key decision makers at your target account? 

Definitive has profiles on more than 2.6 million physicians, nurses and other health care professionals, as well as billions of insurance claims on hundreds of millions of patients. The company updates its database daily. 

The physician profiles include clinical activity level, prescription activity level and their propensity to prescribe brand-name over generic drugs. So when a drug rep walks into a doctor’s office, they have the doctor’s profile in hand and a custom sales pitch based on patient data. 

“I started practicing 30 years ago and even back then the pharmaceutical companies could buy vendor data,” Rep. Ami Bera, D-Calif., told SAN. “They knew what your prescribing practices were, and they would use that to target specific medication, specific physicians based on prescribing patterns.”

Bera has a unique perspective as a medical doctor and member of Congress. 

“It could be used for good if you’re not using the medications correctly, or it seems like you’re an outlier in those medications,” Bera said. “I’m going to guess most of the time it’s used to market those medications and try to get you to switch from one, let’s say anti-hypertensive, to a different one.”

How many doctors meet with drug reps? 

According to a 2022 report from the cloud software company Veeva, 60% of health care providers meet with drug reps. 

Dr. John Dombrowski, an anesthesiologist based in Washington, D.C., counts himself among that crowd. 

Knowing drug reps have insight to exactly what he prescribes “makes me a little uncomfortable,” he told SAN. “It seems like big brother. I did not consent to that.”

It’s like “being vacuumed up,” he said. “It’s very sad that the American Medical Association is then making profit off my data that I didn’t consent to, that they can then sell to Big Pharma.”

Still, he said he meets with representatives from drug companies to learn about their products. 

“Obviously, I know from a drug representative, they’re here to push a product. I know what they’re selling, and you should always be aware of that,” Dombrowski said. “But just because there’s a new product out there doesn’t mean it’s good or bad; it means I should take a look at it to see maybe there’s something I’m missing. And that’s appropriate.” 

Pharmaceutical companies spend billions of dollars a year on “prescriber detailing,” or face-to-face sales meetings. Often, that happens over a meal: A representative takes a doctor out to dinner or delivers lunch to their office. In exchange, the doctor listens to a sales pitch while they eat. 

Some doctors have become so frustrated with drug reps that they either refuse to meet with them or impose time limits. Some hospital systems have totally banned them. 

“I never felt pressure,” Bera said. “But again, I think they’re doing their job, which is selling their medication. I think we have to do our job, and I think we could do a better job educating medical students in residency to understand what the real world is going to be like. So our job is to push back, ask questions, gather information, but then make the most cost-effective decision.”

What exactly does HIPAA protect?

This is all allowed under the Health Insurance Portability and Accountability Act of 1996, or HIPAA, which was written to protect private health information. 

“HIPAA works by saying to the doctors and the hospitals and the health insurers, here’s a bunch of rules that you have to follow about this data,” attorney Kirk Nahra told SAN. “No matter what the patient says, the patient gets these rights just by existing. They don’t have to agree to anything.”

Nahra is a partner at WilmerHale and one of the nation’s leading privacy and cybersecurity experts. 

HIPAA only applies to personally identifiable information, so health insurance companies can legally de-identify data and sell it.

There are two ways to de-identify data: the expert method and the safe harbor method. 

The expert method is straightforward. An expert must review the data to ensure there is a very low risk that a company could identify whose it is. The safe harbor method requires the removal of 18 identifiers, including name, ZIP code, telephone numbers, email addresses and Social Security number. 

“De-identified health information created following these methods is no longer protected” by HIPAA, according to the Department of Health and Human Services, 

“They wrote it and said, ‘If you go through this de-identification process, essentially, as long as it’s still de-identified, you can do whatever you want with the data,’” Nahra said. “Nobody in that chain knows that you were one of the 400 patients that the doctor prescribed for any drug, so the patient data isn’t a part of this.”

Insurance companies disclose their practices 

Insurance companies spell out what they do with Protected Health Information, or PHI, in their disclosures, but not all consumers read the fine print.

Other big companies in the space, like United and CVS Pharmacy, have similar clauses.

Those disclosures are “almost exactly word for word” in line with what the rules dictate, said Nahra. 

SAN reached out to the major insurance companies, health care commercial intelligence providers and the nation’s largest pharmacy chains. Despite multiple inquiries, these household names — including United, Cigna, and CVS — never responded. 

Nahra told SAN he doesn’t believe that selling data is inherently bad. 

“This idea that your privacy is being violated because your data in an anonymous, de-identified format is being used for other purposes, there’s a disconnect there,” Nahra said. “It’s a little hard to frame what your privacy interest is in having data that none of the recipients know is about you.” 

When used correctly, sharing data can help health professionals track what works and what doesn’t, leading to better care for patients, he said. 

“You want to be able to follow a patient across a journey. I don’t care that it’s you. I just need to know that it’s the same patient who had this diagnosis on this day, this test, this procedure… and had that result,” Nahra said. “I need to know that it’s the same person in order to evaluate whether it’s working and whether you’re doing that across the health care system.”

Bera practiced in a medical specialty group, which tracked its own physicians’ prescriptions. 

“We would want to have the information to get a sense of how are doctors prescribing. What are they prescribing? How are they using their medications? So that we could actually take that feedback and give it back to our doctors, compare them to a panel of their peers and see where they’re at,” Bera said.  “That, I think, is all valuable information. But that’s not the pharmaceutical company, that’s the medical group, that’s the hospital system.” 

Interactions between drug reps and medical professionals have changed since the turn of the century. In 2002 the Pharmaceutical Research and Manufacturers of America created a code to police interactions between reps and health care professionals. The self-imposed rules were updated in 2009, further restricting gifts and meals. 

The post Your health care data is for sale. Here’s how Big Pharma is using it. appeared first on Straight Arrow News.

Ella Rae Greene, Editor In Chief