[Congressional Record Volume 144, Number 145 (Tuesday, October 13, 1998)]
[Extensions of Remarks]
[Pages E2149-E2151]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




         MANAGED CARE MANAGES NOT TO CARE ABOUT MEDICAL PRIVACY

                                 ______
                                 

                         HON. EDWARD J. MARKEY

                            of massachusetts

                    in the house of representatives

                       Tuesday, October 13, 1998

  Mr. MARKEY. Mr. Speaker, on September 27, The Washington Post 
chronicled a shocking violation of patient privacy and the aggressive 
tactics of Pharmacy Benefits Managers. This article shines a light on 
efforts by PBMs, often owned by drug manufacturers to accumulate 
extremely sensitive and private medical data on individuals which they 
claim is being used to manage their health plans more economically. The 
article describes the experience of a woman whose prescription 
purchases were tracked by a pharmacy benefits manager, which in turn, 
used the information to inform her doctor that she would be enrolled in 
a ``depression program'', to monitor her prescriptions for anti-
depression medication and to target her for ``educational'' material on 
depression. Even more alarming is that her employer had free access to 
all this sensitive information.
  As it turns out, this woman was not suffering from any depression-
related illness. Her doctor prescribed the medication to help her 
sleep. She had no idea that by signing up for her managed care plan, 
she was signing up for an invasion of her privacy. By using her 
prescription-drug-card, the privacy she had every right to expect 
between patient, doctor and pharmacist was breached and abused
  This story serves to underscore my concern that laws protecting the 
privacy of personal information are woefully inadequate. In this 
electronic age, we must strengthen our privacy rights in proportion to 
the supersonic speed at which privacy can now be stripped from 
unsuspecting patients. I urge my colleagues to reflect on this 
situation and to work to address it in the next Congress.

               [From the Washington Post, Sept. 27, 1998]

  Plans' Access To Pharmacy Data Raises Privacy Issue--Benefit Firms 
                       Delve Into Patient Records

                         By Robert O'Harrow Jr.

       Joan Kelly knew she would save money at her pharmacy when 
     she used her prescription-drug card to buy an antidepressant 
     her doctor prescribed to help her sleep. Instead of paying 
     $17 for a month's supply of trazodone, she paid just $8.
       But Kelly didn't know that when she filled her prescription 
     last fall at a drugstore in Austin, Tex., she would also be 
     swept up in a technology-driven revolution to control medical 
     costs, a new kind of managed care that trampled on her 
     notions of privacy.
       Sensitive information about her prescription was flashed to 
     PCS Health Systems, a company in Scottsdale, Ariz., that 
     administers her pharmacy benefit on behalf of her health 
     insurance plan. Computers instantly matched her information 
     with other data previously collected about medications she 
     had been taking, and the new data was stored for review by 
     PCS administrators.
       A few months later, PCS sent Kelly's doctor a letter. At 
     the request of Kelly's employer, it said, the company had 
     peered into one of its databases of more than 500 million 
     prescriptions, pinpointed her as someone who used 
     antidepressants and enrolled her in a ``depression program.'' 
     Kelly's prescriptions would not be monitored, it said, and 
     the doctor would be notified of any lapses. Kelly also would 
     be sent educational material on depression.
       The aim of the company, the letter noted, was to ``optimize 
     pharmaceutical care.''
       When Kelly's doctor told her about the letter, Kelly began 
     to fret about being watched. She wondered if her bosses at 
     Motorola Inc., which runs its own health insurance plan, 
     would mistakenly think she was mentally ill.
       ``I feel it's an invasion of privacy,'' said Kelly, 50, who 
     has worked at Motorola for 20 years as an engineering 
     assistant. ``I feel that if I go looking for a job or a 
     promotion, they'll say, `She's on antidepressants.' ''
       A Motorola spokesman said the company chooses not to 
     receive information about specific employee prescriptions, 
     but there are no laws preventing it from doing so. Indeed, 
     there are few federal rules governing the use of personal 
     information by companies such as PCS.
       They are called pharmacy benefit managers. Not long ago, 
     such companies primarily determined if individuals' 
     prescriptions were covered by a health plan. Today, they are 
     technology-savvy giants that stand at the heart of a dramatic 
     change in how medicine is being practiced under managed care.
       Using powerful computers, these firms have muscled their 
     way into what was once a close and closed relationship 
     between patients and their doctors and pharmacists. They have 
     established electronic links to just about every pharmacy in 
     the United States. And they now gather detailed prescription 
     information on the 150 million Americans who use prescription 
     cards. PCS, which administers the benefit of 56 million 
     people, adds about 35 prescriptions a second to a storehouse 
     of 1.5 billion records.
       PCS and other benefit managers said prescription cards 
     should be considered an unprecedented opportunity to improve 
     medical care and save health plans money.
       Working on behalf of health plans, the benefit managers 
     said, they use the data to pinpoint dangerous overlaps in 
     medications that shouldn't be taken together, or to suggest 
     generic drugs that might be just as effective at a fraction 
     of the cost. They also reach out directly to patients and 
     advise them on when and how to take their medication, a 
     practice they say saves money by improving individuals' 
     health. Industry officials estimate that their companies have 
     saved health plans billions of dollars in recent years.
       ``They're the patient's caretaker,'' said Delbert Konnor, 
     president of the Pharmaceutical Care Management Association, 
     an industry group that represents some of the nation's 
     largest benefit managers. ``They're monitoring the physician. 
     They're monitoring the patient. They're also monitoring the 
     costs.
       ``The whole health care industry is in a state of strategic 
     flux,'' Konnor added. ``It's the information that really is 
     the valuable portion of what's going on.''
       But a growing number of patients, doctors and pharmacists 
     complain that they never gave explicit approval for personal 
     information to be collected and analyzed. Some doctors 
     contend that the benefit managers have overstepped their 
     roles as administrators, and they worry that new programs 
     touted as improving care mask efforts to market drugs.
       Critics say the top three benefit managers sometimes 
     highlight medications made by their parent companies--drug 
     manufacturers

[[Page E2150]]

     Eli Lilly and Co., which owns PCS; SmithKline Beecham, which 
     owns Diversified Pharmaceutical Services; and Merck & Co., 
     which owns Merck-Medco Managed Care. At the same time, drug 
     companies often pay for benefit managers to send in-house 
     specialists to visit doctors in attempts to modify patient 
     care--sometimes without asking patients' permission.
       ``Right now people live with this myth that the doctor-
     patient confidentiality is sacrosanct. We know that's not 
     true,'' said Janlori Goldman, director of the Health Privacy 
     Project at Georgetown University.
       ``Once they file a claim, once they fill a prescription, 
     the personal, sensitive information they shared with their 
     doctor is fair game,'' she said. ``The information about them 
     essentially becomes a commodity.''
       Some specialists fear that patients anxious about giving up 
     their privacy may ultimately lose trust in the medical 
     profession.
       ``There's a fundamental realignment of the players here,'' 
     said Daniel Wikler, a professor of medical ethics at the 
     University of Wisconsin. ``The question is: Who is the 
     patient supposed to look to?''
       Regulators in Nevada, Ohio and elsewhere have begun 
     examining possible violations of state confidentiality laws 
     or regulations protecting medical records. Legislators in 
     Virginia, New York and elsewhere also have begun considering 
     laws that would give their states more control over pharmacy 
     benefit managers.
       ``By what authority do these companies believe they have a 
     right to collect this information?'' asked Charles Young, 
     executive director of the Massachusetts Board of Registration 
     in Pharmacy. ``And once they get it, how are they using it? 
     Is it in the best interest of the patients? Or is it in the 
     best interest of the company?''
       Pharmacy benefit managers have been in business for more 
     than two decades. They began playing a more central and 
     controversial role in health care just a few years ago.
       That's when drug manufacturers and pharmacy chains--
     including CVS, Rite Aid and others--began spending billions 
     of dollars to acquire such companies as part of the race to 
     capture a larger share of the fast-growing market for 
     prescription drugs.
       Improvements in computer technology also made it vastly 
     easier to gather, store and track information about patients. 
     This technology has become widespread in recent years, in 
     part because of the plummeting cost of data storage and 
     steady increases in computer processing speeds.
       New benefit management companies popped up everywhere. Now 
     more than 150 pharmacy benefit managers manage 1.8 billion 
     prescriptions every year, and the number of people who use 
     prescription cards has more than doubled since 1990 to more 
     than 150 million, according to the industry association. At 
     the same time, the proportion of prescriptions covered at 
     least in part by managed care has soared from about one in 
     four to almost two of every three, according to IMS Health 
     Inc., a health care information company.
       The market for prescription drugs is worth more than $81 
     billion annually, more than twice the amount at the beginning 
     of the decade. Officials at the benefit management companies 
     say that figure would be significantly higher without them. 
     Studies by the General Accounting Office, the Congressional 
     Budget Office and other researchers tend to support that 
     contention.
       A GAO report said that three plans in the Federal Employees 
     Health Benefits Program estimated benefit managers saved up 
     to $600 million in overall spending in 1995 ``by obtaining 
     manufacturer and pharmacy discounts and managing drug 
     utilization.'' The report also found a ``high degree of 
     satisfaction'' among Federal employees with pharmacy benefit 
     management services.
       A more recent analysis by the Congressional Budget Office 
     concluded that pharmacy benefit managers have helped to slow 
     the rising cost of prescription drugs. The authors suggested 
     in July that the benefit managers accomplished this by 
     directing doctors and pharmacists to use certain lower-cost 
     drugs.
       ``We're achieving the dual objective of ensuring 
     appropriate care for patients, while at the same time 
     reducing pharmaceutical costs for health plans,'' said Blair 
     Jackson, spokesman for PCS Health Systems.
       To assess the impact of the benefit management revolution 
     on personal privacy, it is necessary to understand how the 
     system works. But that's not easy. Even many regulators and 
     doctors have only recently begun to sort out how these 
     companies gather, use and resell patient information.
       To many consumers, the process is almost invisible, even 
     though in most cases they have given their consent by signing 
     up for a health plan, industry officials say.
       It starts when someone uses a prescription card to get 
     medication. Their information is electronically messaged to 
     their health plan's benefit manager, a transaction that in 
     most instances takes seconds. A computer checks to see if the 
     medication is covered and whether the drug is safe for a 
     particular patient, in many cases as the patient waits for 
     the prescription to be filled.
       The computers also match the prescription against a 
     formulary, a list of medications the benefit managers have 
     arranged for health plans to buy at a lower cost or that have 
     been determined to be more effective. Health plans often get 
     the discounts by pledging to use certain drugs exclusively. 
     Sometimes the pharmaceutical companies give rebates as their 
     drugs are dispensed, industry officials said.
       These formularies are the cornerstone of efforts to control 
     drug costs. They also are a contentious issue. Critics, 
     including some federal and state regulators, contend that 
     benefit managers appear to have shown a bias toward the 
     products of their parent companies.
       A study two years ago by the office of the public advocate 
     for the city of New York, for example, found that benefit 
     managers steered doctors and patients toward their parent 
     companies' drugs, an allegation that the benefit managers 
     deny. Public Advocate Mark Green said the companies should 
     not have such sweeping access to patient records.
       They ``are using medical histories of millions of 
     unsuspecting patients. This is as little known as it is 
     wrong,'' Green said. ``It would be hopelessly naive to trust 
     the voluntary virtue of these PBMs.''
       If the benefit manager's computer approves a transaction, 
     an affirmative message is sent back to the pharmacist. But if 
     it determines that a less expensive drug can be safely 
     switched, that suggestion is sometimes flashed back. PCS 
     offers pharmacists up to $12 to secure approval from a 
     patient and the patient's doctor for a ``therapeutic 
     interchange'' of certain drugs. A change can't be made 
     without such approval, PCS officials said.
       Meanwhile, a patient's information is stored in various 
     computers, including data warehouses operated by the benefit 
     managers. The technology allows the benefit managers to keep 
     close track of individuals. In some cases, they remind 
     patients to refill prescriptions and take their medicine at 
     appropriate intervals, Medical officials say that up to half 
     of all patients with some conditions--such as hypertension or 
     high cholesterol--fail to take their medicine as 
     prescribed.
       The benefit managers also can track people with chronic 
     illnesses and offer suggestions about their care. These 
     increasingly common efforts are known as ``disease 
     management'' programs. One of the problems with these 
     programs is the risk of misidentifying a person's ailment. 
     Medical specialists say that's because certain drugs can be 
     used to treat different problems.
       Kelly, the Texas woman, said she was mistakenly enrolled in 
     a program called ``Journeys: Paths Through Depression.'' She 
     took antidepressant medicine because she was having trouble 
     sleeping because of menopause, she said, not because she was 
     mentally ill. Karen Hill, the physician who was treating 
     Kelly at the time, confirmed Kelly's account.
       In the letter, the company acknowledged the possibility of 
     making an incorrect assumption about a patient's ailment and 
     said those who have questions should consult their doctor.
       Kelly said she had no idea when she enrolled in her health 
     plan that it would open the way to close scrutiny of her 
     prescriptions.
       ``Mainly, what you're looking at is what you get and what 
     you pay. I wasn't even thinking about personal information 
     going out,'' Kelly said. ``With managed care, I know it's 
     getting more convoluted. But this never occurred to me.''
       Motorola officials said there was no reason for such 
     anxiety. They described the PCS effort as a ``stigma-free 
     mental health'' program that provides employees with help and 
     educational material about depression. So far, 167 of the 
     5,721 employees enrolled in the program have opted out.Connie 
     Giere, a benefit official at Motorola, said information about 
     patients is protected. ``Obviously, we own that data,'' she 
     said. ``But we have chosen not to receive that data because 
     it's counter to our philosophy of confidentiality.'' Motorola 
     officials said the company chooses only to receive general 
     reports about trends, not the names of employees or other 
     personal information.
       Pharmacy benefit managers also routinely urge doctors to 
     change a patient's medicine to a brand or generic drug that 
     the companies believe is less expensive or more effective. 
     The benefit managers contact patients and doctors through 
     letters, telephone calls and faxes. Some benefit managers 
     also send messages to pharmacists as patients wait for their 
     prescription.
       Bernard Steverding of Fairfax County received a letter 
     several months ago that said the prescription he was taking 
     to lower his cholesterol had been changed by a pharmacy 
     benefit manager to another drug. The letter he received was 
     typical, but it made him furious.
       The letter, from a company now called Express Scripts/
     ValueRx, said: ``When we find a medicine that we believe to 
     be better for a particular patient, we review the patient's 
     medication profile and then confirm with the prescribing 
     physician that a change of medication is appropriate. We know 
     that the only way to help control prescription drug costs is 
     in partnership with you and your doctor.''
       Steverding and his wife said the letter arrived after the 
     new prescription was filled and the change was made without 
     his consent. Souzana Steverding said her husband wasn't sure 
     if he should take the new drug concurrently with the 
     remaining pills he had under the old prescription. ``We got 
     this new prescription and didn't even know what it was for,'' 
     she said. ``Nobody told us you can't take these two 
     together.''
       Dan Cordes, a vice president at Express Scripts/ValueRx, 
     said Steverding had given

[[Page E2151]]

     his consent to the program by signing up with his health 
     insurance plan, which authorized the collection of his 
     prescription information. Cordes said Steverding's doctor 
     approved the switch. ``It's a totally voluntary program,'' 
     Cordes said.
       Officials at benefit managers say they take great care with 
     the information they collect and understand its sensitivity. 
     At PCS, for example, employees must sign a pledge that they 
     will respect the confidentiality of personal records. Patient 
     information also is encrypted or depersonalized whenever PCS 
     transmits it.
       ``We clearly recognize that by being a part of the health 
     care system we have to abide by this type of ethics,'' said 
     Nick Schulze-Solce, a vice president for health management 
     services at PCS.
       But given the limited oversight by state and federal 
     authorities, there's no way to guarantee information will be 
     used appropriately. In Las Vegas last year, patients who 
     shopped at three independent drug stores later received $5 
     coupons and promotional fliers in the mail from a pharmacy 
     chain, American Drug Stores. Among them was Mary Grear, a 
     pharmacist and owner of the independent stores.
       Grear wondered why she and so many of her customers 
     received the same flier. By looking in her own computers, she 
     discovered they all had the same pharmacy benefit manager, a 
     company owned by American Drug Stores. She complained to 
     state authorities, who confirmed this spring that a pharmacy 
     benefit manager owned by American Drug Stores had passed 
     along the names and other information from confidential 
     prescription records.
       Grear said she was outraged, both as a patient and a 
     pharmacist.
       ``I mean, it's medical information. That's how it should be 
     used. It isn't for marketing,'' Grear said. ``I believe it's 
     between me and my health professional.''
       State authorities also were unsettled.
       ``Something like this has never happened before,'' said 
     Larry L. Pinson, president of the Nevada State Board of 
     Pharmacy, who described the prescription records involved as 
     ``very, very private medical histories.''
       In response, regulatory officials in Nevada recently sent 
     out a stern letter to 275 pharmacy benefit managers and other 
     administrators, warning that many of the companies' 
     activities may be illegal. ``You are now on notice,'' the 
     letter said, ``and the board hopes that these illegal 
     practices will now stop.''
       Dan Zvonek, a spokesman for American Drug Stores, said the 
     sharing of patient records by the companies was a mistake 
     that would not happen again.
       He acknowledged that pharmacy benefit companies are 
     struggling with privacy issues, trying to determine what's 
     appropriate as financial matters take an ever larger role in 
     decision making.
       ``You run this risk of stepping over those boundaries of 
     confidentiality. But no one knows where those boundaries 
     are,'' Zvonek said. ``You running a risk of ignoring the 
     health care aspect and focusing on profit.''
       One source of profit for the benefit managers is the resale 
     of aggregations of patient data. Although benefit managers 
     remove patient names and other personally identifying 
     information from the records, such data has become 
     increasingly valuable for drug companies and health 
     researchers.
       During companies mine the data, for example, to track how 
     much a health plan spends on each specific drug and to try to 
     document whether treatment resulted in the desired outcome. 
     They also use the information to measure the success of 
     direct marketing campaigns and to focus sales forces on 
     doctors who prescribe certain medicines.
       Raymond Gilmartin, chief executive of Merck & Co., the 
     giant pharmaceutical company that owns Merck-Medco, said that 
     by monitoring how diabetics take their medication, the firm 
     can save health plans $260 a year per diabetic by keeping 
     them well--and out of the hospital.
       ``This is exiting stuff,'' Gilmartin said. ``This is the 
     information everyone is looking for and that everyone 
     wants.''
       Among the many unresolved questions posed by benefit 
     mangers is who has the final say on how personal date is used 
     and maintained. In most cases, according to Schulze-Solce, 
     the health plan that has contracted with a benefit manager to 
     gather the information owns the information.
       In many cases that owner is an employer that provides it 
     own health insurance.
       ``That of course is something that needs to be 
     recognized,'' said Schulze-Solce. ``For society, it is 
     important to get their arms around that because that is a 
     potential source of leak. . . .  In theory, [privacy] is 
     depending on the self-discipline of those companies.''
       In any case, officials at pharmacy benefit managers said 
     patients, doctors and the rest of the medical community might 
     as well get used to them. Not only are they increasingly 
     important to the health care system, but they're not going 
     away anytime soon.
       As medical professionals come to rely on a person's genetic 
     history to recommend treatments, even more detailed data will 
     be needed to provide proper care. Schulze-Solce said pharmacy 
     benefit managers will be expected to help fill that need.
       He likened the development of pharmacy benefit managers to 
     the evolution of nuclear bombs: ``In the case of nuclear 
     weapons, you try to contain the risk,'' he said. ``Trying to 
     go back is moot.''

     

                          ____________________