Amicus Curiae Brief — IMS Health Health, Inc. v. Ayotte (No. 08-1202)

Supreme Court. U.S.

f No. 08-1202 APR 27 2003:

: LERK

Gn The

Supreme Court of the Gnited States

-

IMS HEALTH, INC. AND VERISPAN LLC,

Petitioners,

VS.

KELLY M. AYOTTE, AS ATTORNEY GENERAL

OF THE STATE OF NEW HAMPSHIRE,

Respondent.

¢

On Petition For A Writ Of Certiorari

To The United States Court Of Appeals

For The First Circuit

+

BRIEF OF AMICI CURIAE THE CENTER FOR

DEMOCRACY AND TECHNOLOGY, THE GENETIC

ALLIANCE, THE PHARMACEUTICAL CARE

MANAGEMENT ASSOCIATION, MARK FRISSE,

AND SARA ROSENBAUM

IN SUPPORT OF PETITIONERS

¢

GREGORY A. CLARICK*

WILLIAM BERNSTEIN

ARUNABHA BHOUMIK

MANATT, PHELPS & PHILLIPS LLP

*Counsel of Record

7 Times Square

New York, NY 10036

(212) 790-4500

Attorneys for Amici Curiae

COCKLE LAW BRIEF PRINTING CO. (800) 225-6964

OR CALL COLLECT (402) 342-2831

1

TABLE OF CONTENTS

Page

INTERESTS OF AMICI CURIAE ..................000000 1

SUMMARY OF ARGUMENT ................ccceeceeeeseeees 5

i, RRA ere ap le ee 7

I. THIS COURT SHOULD GRANT THE

PETITION FOR A WRIT OF CERTI-

ORARI BECAUSE PATIENTS AND

HEALTH CARE PROVIDERS DO NOT

HAVE ANY PRIVACY INTERESTS IN

THE INFORMATION THAT THE PRE-

SCRIPTION INFORMATION LAW PRO-

PIE aedenevtacacniealonaan: kabcdehswsncsdapantWnncedtininen os

Il. THIS COURT SHOULD GRANT THE

PETITION FOR A WRIT OF CERTIORARI

BECAUSE THE NEW HAMPSHIRE STA-

TUTE WILL STIFLE EFFORTS TO EVA-

LUATE AND IMPROVE HEALTH CARE

QUALITY THROUGH HEALTH IN-

FORMATION TECHNOLOGY .................. 11

~]

CONCLUSION

li

TABLE OF AUTHORITIES

Page

CASES

Bibb v. Navajo Freight Lines, 359 U.S. 520, 79

S. Ct. 962, 3 L. Bd. 2d 1003 (1959)......................... 15

CTS Corp. v. Dynamics Corp. of America, 481

U.S. 69, 95 L. Ed. 2d 67, 107 S.Ct. 1637

By g be EE 15

IMS Health, Inc. v. Ayotte, 490 F. Supp. 2d 163

(Ee i nc vevsccreocecceecess 8

Marshall v. Barlow’s, Inc., 436 U.S. 307, 98

S. Ct. 1816, $6 &. Ed. 2a 306 (1078)......................... 8

New York v. Burger, 482 U.S. 691, 107 S. Ct.

ZESG, DE Fi Be varices occ evesesesccecescee 8

STATUTES

Health Insurance Portability and Account-

ability Act of 1996, 42 U.S.C. §1320d

CE BOG. vncaigeniecaned aaa tanh demeeesn ses 8,9, 10, 16

OTHER AUTHORITIES

An Act Requiring Certain Persons To Keep the

Contents of Prescriptions Confidential:

Hearing on H.B. 1346 Before the S. Comm.

on Exec. Departments & Administration,

159th Sess: Gen. Ct. 1 GN... 2006)........................... 7

E.A. Balas and S.A. Boren, Managing Clinical

Knowledge for Health Care Improvement, in

IMIA Yearbook cf Medical Informctics (2000) ....... 12

ill

TABLE OF AUTHORITIES — Continued

Page

eHealth Initiative, eHealth Initiative Issue

Brief: States Getting Connected: State Policy-

Makers Drive Improvements in Healthcare

Quality and Safety Through IT (2006)................... 13

Institute of Medicine, Crossing the Quality

Chasm: A New Health System for the 21st

i eer owciaances 12

Institute of Medicine, Yo Err Is Human:

Building a Safe Health System (1999)...............02.. 12

Letter dated February 13, 2009 from Con-

gressional Budget Office to Speaker of the

House of Representatives Nancy Pelosi ................+- 13

NCQA, The State of Health Care Quality 2007

DO i ctteiccnsiestrtn iicioo ee eis, oo, 10, 12

Standards for Privacy of Individually Identifi-

able Health Information, 64 Fed. Reg. 59918

ge SE, Nae ane an Ue Oe ee 9

CONSTITUTION

Commerce Clause, U.S. Const. art. I, § 7 ...........0...... 15

1

BRIEF OF THE CENTER FOR DEMOCRACY

AND TECHNOLOGY, THE GENETIC

ALLIANCE, THE PHARMACEUTICAL

CARE MANAGEMENT ASSOCIATION,

MARK FRISS: , AND SARA ROSENBAUM

AS 4MICI CURIAE IN

SUPPORT OF PETITIONERS

With the joint written consent of the parties, the

Center for Democracy and Technology, The Genetic

Alliance, The Pharmaceutical Care Management

Association, Mark Frisse, and Sara Rosenbaum re-

spectfully submit this brief as amici curiae.’

¢

INTERESTS OF AMICI CURIAE

The Center for Democracy and Technology

(“CDT”) is a non-profit Internet and technology

advocacy organization which promotes public policies

that preserve privacy and enhance civil liberties in

the digital age. As information technology is

increasingly used to support the exchange of medical

records and other health information, CDT, through

its Health Privacy Project, champions comprehensive

' Amici curiae and their counsel authored this brief in

whole and no person or entity other than amici or its counsel

has made a monetary contribution to the preparation or

submission of this brief.

The parties were notified ten days prior to the due date of

this brief of the intention to file. The parties have consented to

the filing of this brief.

2

privacy and security policies to protect health data.

CDT promotes its positions through public policy

advocacy, public education, and litigation, as well as

through the development of industry best practices

and technology standards. CDT plays an instru-

mental role in safeguarding consumer privacy on the

Internet. Recognizing that a networked health care

system can lead to improved health care quality,

reduced costs, and empowered consumers, CDT is

using its experience to shape workable privacy

solutions for a health care system characterized by

electronic health information exchange.

Genetic Alliance transforms health through

genetics, promoting an environment of openness

centered on the health of individuals, families, and

communities. Genetic Alliance brings together diverse

stakeholders that create novel partnerships in

advocacy; integrates individual, family, and com-

munity perspectives to improve health systems; and

revolutionizes access to information to enable

translation of research into services and _ indi-

vidualized decision making.

The Pharmaceutical Care Management Asso-

ciation” (“PCMA”) is the national association

* PCMA’s members include the following: Aetna Inc.;

Caremark Inc., a wholly-owned subsidiary of CVS/Caremark

Corporation; CIGNA Health Corporation; Prime Therapeutics

LLC; Express Scripts, Inc.; MC-21 Corporation; Medco Health

Solutions, Inc.; RxSolutions, Inc. d/b/a Prescription Solutions, a

wholly-owned subsidiary of PacifiCare Health Systems, LLC,

(Continued on following page)

3

representing pharmacy benefit managers (PBMs),

which administer prescription drug benefits for more

than 210 million Americans with health care

coverage. PBMs work to drive down the cost of

prescription drugs through proven cost-containment

tools, including negotiating with drug manufacturers

to obtain rebates on plan members’ drug purchases;

establishing networks of both retail and mail-order

pharmacies to allow consumers access to discount

drugs; and administering “drug utilization review”

programs designed to monitor and deter purchases of

dangerous drug combinations and questionable doses.

PBMs also have been at the forefront in advancing

eutting-edge technologies such as electronic pre-

scribing, which provides physicians with clinical and

cost information on prescription options that allows

tuem to better counsel consumers regarding which

medications are the safest and most affordable

choices.

Mark Frisse is a physician and Accenture

Professor of Biomedical Informatics at Vanderbilt

University. Working on a five-year project funded by

AHRQ and the State of Tennessee, Dr. Frisse was a

which in turn is a wholly-owned subsidiary of UnitedHealth

Group Incorporated; Wellpoint Pharmacy Management (a d/b/a

for Professional Claims Services, Inc.) and Anthem Prescription

Management, LLC, both of which are wholly-owned subsidiaries

of Wellpoint, Inc.; US Scripts, Inc.; and Scriptrax, part of Novant

Health — a not-for-profit health care system.

4

leader in efforts to create a regional health infor-

mation exchange involving all major providers in the

Memphis area. The exchange has comprehensive data

sharing agreements and supports care for over

750,000 people; it has been in operation for over two

years. In addition, Dr. Frisse was involved in a large-

scale data integration project in the mid-1990s that

provided drug interaction alerts to pharmacists at the

BJC Health System in St. Louis. He has also led

workshops and authored comprehensive reports on

privacy, confidentiality, and health information

exchange.

Sara Rosenbaum is the Harold and Jane Hirsh

Professor of Health Law and Policy and chair of the

Department of Health Policy at the George

Washington University School of Public Health

Services. A leader in health policy, with a particular

focus on health care access for medically underserved

populations, Professor Rosenbaum is known nation-

~ ally for her work on health insurance, national health

reform, and health care access. For five years

Professor Rosenbaum kas led a series of studies for

the United States Department of Health and Human

Services that examine health information technology

adoption among physicians and hospitals. She has

written extensively on numerous aspects of health

law, including health information law, and is a co-

author of Law and the American Health Care System

(Foundation Press).

The New Hampshire law at issue in this case is

directly at odds with the policy objectives of amici. In

rs)

the service of privacy interests that do not exist, the

law will impede efforts to reform our health care

system and improve the quality and efficiency of

health care provided to patients and populations.

Therefore, amici write to assist the Court in

analyzing the legal and public policy issues that

warrant this Court’s review of the decision of the

Circuit Court of Appeals for the First Circuit.

¢

SUMMARY OF ARGUMENT

1. The Court should grant the petition because

the Prescription Information Law does not implicate

any legitimate privacy interest. The New Hampshire

Legislature and New Hampshire Attorney General

have sought to justify the Prescription Information

Law on the grounds that New Hampshire has an

interest in protecting the privacy of both patients and

prescribers, and that this interest requires limiting

the exchange of prescription information. The

Prescription Information Law, however, does not

protect any legitimate privacy interest. Physicians

have no privacy interest in their prescribing

practices. Such practices are consistently revealed to,

and reviewed by, numerous third-parties. Nor is

patient privacy at issue here. The Prescription

Information Law regulates “de-identified” patient

information that does not implicate patient privacy.

Further, tremendous public health benefits are

associated with the transfer and use of de-identified

health care information. Review by this Court is

6

therefore critical to facilitate the national interest in

the use of health care information where, as here, it

does not implicate any legitimate privacy interest.

2. The Court should grant the petition because

the Prescription Information Law and _ copycat

legislation in other states threaten to strangle efforts

to use health care information technology to improve

patient care and public health. Information

technology has made it easier than ever to collect,

exchange, aggregate, analyze, and communicate

health information electronically. This has enormous

potential benefits, including improved health

outcomes, better quality of care, and lower costs.

Indeed, President Obama recognized this potential

when his administration authorized $36 billion in

federal stimulus funds to encourage adoption of

health IT tools. But the New Hampshire Prescription

Information Law — with its broad undefined prohi-

bitions, and amorphous exceptions — threatens to

undermine this important national trend.

¢

7

ARGUMENT

I.

THIS COURT SHOULD GRANT THE

PETITION FOR A WRIT OF CERTIORARI

BECAUSE PATIENTS AND HEALTH CARE

PROVIDERS DO NOT HAVE ANY PRIVACY

INTERESTS IN THE INFORMATION

THAT THE PRESCRIPTION

INFORMATION LAW PROTECTS

The legislative record is replete with references

to the supposed “privacy” interests that the

Prescription Information Law would protect. Repre-

sentative Cindy Rosenwald, one of the statute’s co-

sponsors, noted that the statute “will protect privacy

... by prohibiting the sale or use of individual patient

or prescriber identity.” Further, in defending the

statute below, the New Hampshire Attorney General

justified the law on the grounds that it protects both

patient and prescriber policy.

These “privacy” considerations are phantoms.

The Prescription Information Law does not protect

any legitimate privacy interest.

First, there is no physician privacy to protect

because physicians have no expectation of privacy in

* See An Act Requiring Certain Persons To Keep the

Contents of Prescriptions Confidential: Hearing on H.B. 1346

Before the S. Comm. on Exec. Departments & Administration,

159th Sess. Gen. Ct. 1 (N.H. 2006) (statement of Rep. Cindy

Rosenwald, Member, House of Representatives).

8

their prescribing practices. As the District Court

noted below, the provisions challenged here relate to

the professional practice of prescribers, not personal

information. IMS Health, Inc. v. Ayotte, 490 F. Supp. 2d

163, 179 n.13 (D.N.H. 2007). Thus, health care

providers, who work in a “closely regulated” industry,

cannot claim any expectation of privacy over their

professional practices because “prescriber-identifiable

data is routinely disclosed to patients, pharmacies,

insurance companies, medical review committees,

and government agencies.” Jd. (citing New York v.

Burger, 482 U.S. 691, 702, 107 S.Ct. 2636, 96

L. Ed. 2d 601 (1987)); see also Marshall v. Barlow’s,

Inc., 436 U.S. 307, 313, 98 S. Ct. 1816, 56 L. Ed. 2d

305 (1978) (“Certain industries have such a history of

government oversight that no reasonable expectation

of privacy could exist ...”.) (internal citation omitted).

Second, the Prescription Information Law does

not implicate patient privacy. While it purports to

protect privacy interests, the statute regulates

patient de-identified information. At the federal] level,

the Health Insurance Portability and Accountability

Act of 1996, 42 U.S.C. §1320d et seq. (“HIPAA”),

provides rigorous standards for de-identifying

information, which involve either certification by a

statistician that the information has been de-identified

or the removal of specific identifiers including name,

social security number, medica] record number, and

address.

HIPAA also sets national standards for the use

and disclosure of Americans’ identifiable health

9

information. Specifically, the HIPAA Privacy Rule

regulates the use and disclosure of Protected Health

Information (“PHI”), i.e., information concerning

health status, provision of health care, or payment for

health care that identifies an individual. HIPAA

recognizes the need to place clear, enforceable

parameters around the use of such _ identifiable

information. In contrast, HIPAA expressly does not

restrict the use or disclosure of de-identified health

information, which is sufficiently stripped of patient

identifiers that its use and disclosure raises no

privacy risk to patients.

In making this distinction, HIPAA highlights the

substantial public health benefits of permitting broad

access to de-identified data. As the Department of

Health and Human Services noted in its commentary

supporting HIPAA:

Large data sets of de-identified information

can be used for innumerable purposes that

are vital to improving the efficiency and

effectiveness of health care delivery, such as

epidemiological studies, comparisons of cost,

quality or specific outcomes across providers

or payers, studies of incidence or prevalence

of disease across populations, areas or time,

and studies of access to care or differing use

patterns across populations, areas or time.

Standards for Privacy of Individually Identifiable

Health Information, 64 Fed. Reg. 59918, 59946

(proposed Nov. 3, 1999).

10

These benefits are not just theoretical. Researchers

and government officials have, on numerous occasions,

used de-identified health information to benefit the

public health. The National Committee for Quality

Assurance (“NCQA”), for example, uses de-identified

health care information to monitor variations in

quality of care. In one remarkable example, the use of

de-identified health information led to more than 97%

of patients who suffered heart attacks being

prescribed beta-blockers to help prevent a second

attack, up from only 62% in 1996. This improvement

alone saved between 4,400 and 5,600 lives over the

past six years. NCQA, The State of Heuith Care

Quality 2007 10, 26 (2007).

Further, the risk to patient privacy as a result of

transferring de-identified data under HIPAA

generally arises from efforts to re-identify patients

using the data. In this regard, while HIPAA privacy

protections could be strengthened, this would be

achieved by strengthening prohibitions against re-

identification of de-identified data. But the Prescn-

ption Information Law does no such thing. Rather,

the statute throws the baby out with the bathwater —

prohibiting the transfer of de-identified information

for commercial purposes — a limitation that has

nothing to do with preventing re-identification of

patient information.

Review of the Prescription Information Law is

therefore critical to facilitate the national interest in

enhancing the flow and use of health care information

11

where, as here, it does not implicate any legitimate

privacy interest.

il.

THIS COURT SHOULD GRANT THE PETITION

FOR A WRIT OF CERTIORARI BECAUSE THE

NEW HAMPSHIRE STATUTE WILL STIFLE

EFFORTS TO EVALUATE AND IMPROVE

HEALTH CARE QUALITY THROUGH

HEALTH INFORMATION TECHNOLOGY

The use of health information technology, or

health IT, is one of the most important developments

in modern health care. Health IT encompasses the

trend in the health care sector to collect, exchange,

aggregate, analyze, and communicate health

information electronically. Health IT offers providers

quick and reliable access to needed patient infor-

mation, and thus improves care. Thus health IT is not

an end unto itself, but rather is a means of improving

the quality of health care.

With the advent of health information

technologies like electronic health records that facil-

itate information sharing among providers at the

point of care, we are at the tipping point when it

comes to our ability to evaluate and improve provider

performance, and therefore care of patients. To make

health care delivery better, safer, more efficient, and

less prone to medical errors, we need to know more —

not less — about what physicians and other health

care providers do. Much of what we need to know to

12

accomplish these aims can be served by using de-

identified data, which can be collected, analyzed,

exchanged, and communicated electronically to those

who would rely on it to improve care, thanks to

advances in health information technology.

The potential for health IT to improve patient

care and health care quality is particularly com-

pelling. Remarkably, more Americans die each year

from preventable medical errors than from AIDS or

breast cancer. Institute of Medicine, Yo Err Is

Human: Building a Safe Health System (1999).

Indeed, the NCQA reports between 35,000 and 75,000

avoidable deaths, and between $2.7 billion and $3.7

billion in avoidable hospital costs in the year 2006

due to unexplained variations in quality of care.

NCQA, The State of Health Care Quality 2007 12

(2007). Further, while substantial investments have

been made in clinical research and development over

the last 30 years, resulting in an enormous increase

in medical knowledge, a 15 to 20 year lag exists

before physicians incorporate this knowledge into

their care. E.A. Balas and S.A. Boren, Managing

Clinical Knowledge for Health Care Improvement, in

IMIA Yearbook of Medical Informatics 65-70 (2000).

Health IT can reduce this lag. As the Institute of

Medicine stated, “[t]o deliver care in the 21st century,

the [health care] system must have a health

information and communications technology infra-

structure that is accessible to all patients and providers.”

Institute of Medicine, Crossing the Quality Chasm: A

New Health System for the 21st Century (2001).

13

In recognition of both the importance of health IT

to delivering quality health care and its potential

economic benefits, President Obama recently in-

cluded in the federal stimulus package approximately

$36 billion to network the health care industry so

that it can deliver high-quality efficient patient care.‘

But the President is only the most recent leader to

recognize the enormous potential of health IT to bring

transparency to the health care system and improve

patient care. Indeed, a 2006 report noted that

President Bush, both parties’ congressional leaders,

and nearly 40 states’ governors and state legislatures

had begun to pursue major health IT initiatives, to

achieve greater value for health care spending. See

eHealth Initiative, eHealth Initiative Issue Brief: States

Getting Connected: State Policy-Makers Drive Improve-

ments in Healthcare Quality and Safety Through IT

(2006). These leaders want to use health IT to save

lives, and they want patients to make health care

decisions armed with information about the cost and

quality of the services they are buying.

But the New Hampshire law — and others like it

— threatens to undermine the access to information

that will drive these reforms. While the First Circuit

construed the Prescription Information Law to

prohibit only the transfer of vrescription information

* See Letter dated February 13, 2009 from Congressional

Budget Office to Speaker of the House of Representatives Nancy

Pelosi at Table 2, available at nttp://www.cbo.gov/doc.cfm?index=

9989 (last viewed April 23, 2009).

14

used for the purposes of detailing, the language of the

statute is considerably broader. Rather than directly

regulating the conduct of detailers in connection with

pharmaceutical company marketing efforts, the law

criminalizes the transfer of “prescription information

containing ... prescriber-identifiable data ... for any

commercial purpose.” The term “commercial purpose”

is defined as “any activity that could be used to

influence or even to evaluate the prescribing behavior

of physicians.”

Moreover, while the statute contains several

exceptions, none are clearly defined. Thus, with

limited, undefined, and amorphous exceptions, the

law prohibits pharmacies, benefits managers, insur-

ance companies, and the like from selling “for any

commercial purpose” information about prescriptions

written by New Hampshire prescribers.

Health IT is the key to facilitating the flow of

information to both patients and physicians that will

enable improvements in health care. But an over-

broad statute, with poorly defined exceptions will

have a chilling effect on the development of health IT.

This effect is overwhelming when one considers that

a number of other states are considering similarly

broadly worded statutes, with poorly defined pro-

scriptions, and indeterminate exceptions. Moreover,

while the First Circuit read the Prescription Infor-

mation Law to proscribe only the transfer of

prescriber information for the purposes of detailing,

there is no guarantee that other courts — including

New Hampshire courts applying the law — will read

15

the statute the same way. Nor will other courts

reviewing other states’ statutes be held to the First

Circuit’s interpretation of the New Hampshire

enactment.

The development of a national “health infor-

mation superhighway” that is facilitated through

health IT — an enterprise that is inherently inter-

connected and national in scope — will be choked if, in

order to do business, companies have to wade through

a morass of state statutes with unclear prohibitions

and exceptions. Indeed, this Court’s jurisprudence

under the Commerce Clause already has recognized

that where an industry is not “admitting of diversity

of treatment, according to the special requirements of

local conditions” a State requirement that is “out of

line with the requirements of almost all the other

States” may place an undue burden on interstate

commerce. See Bibb v. Navajo Freight Lines, 359 U.S.

520, 529-30, 79 S. Ct. 962, 3 L. Ed. 2d 1003 (1959); see

also CTS Corp. v. Dynamics Corp. of America, 481

U.S. 69, 88, 95 L. Ed. 2d 67, 107 S. Ct. 1637 (1987)

(“This Court’s recent Commerce Clause cases also

have invalidated statutes that may adversely affect

interstate commerce by subjecting activities to incon-

sistent regulations.”).

Review of this case is vital. The development of

health IT will improve access to health care infor-

mation for patients, providers and researchers. It

will save lives. The New Hampshire Prescription

Information Law — and others like it — threaten to

stifle the development of this technology by requiring

16

patients and industry to navigate a patchwork of

state regulatory regimes with vague _ statutes

regarding access to de-identified health data, and at

least in the case of New Hampshire, risk criminal

penalty should they run afoul of one of these regimes.

¢

CONCLUSION

Review by this Court is imperative. The New

Hampshire Prescription Information Law may have

been the brainchild of good intentions. Still, it will

impair the development of health IT and the essential

use of de-identified health information to improve

access to information, save lives, and reduce risks

endemic to the health care system.

By justifying the statute on “privacy” grounds,

the State has incorrectly presumed that prescribers

have a privacy interest in their medical practices. But

prescribers, who work in a highly-regulated industry,

have no expectation of privacy in their medical

practice, and federal jaw already provides rigorous

standards for de-identifying patient health care

information to protect patient privacy interests.

While States may provide privacy protection for

patient health information that is greater than the

federal floor HIPAA sets, the New Hampshire statute

— which regulates de-identified information — simply

doesn’t do so. Instead, it subjects the collection of

critical health data using health IT to a thicket of

vague, perhaps inconsistent local regulations. Thus,

17

the New Hampshire Prescription Information Law —

and others like it — will impair the development of the

technology, leading to less access to information, and

enormous public health consequences.

Respectfully submitted,

GREGORY A. CLARICK*

WILLIAM BERNSTEIN

ARUNABHA BHOUMIK

MANATT, PHELPS & PHILLIPS LLP

*Counsel of Record

7 Times Square

New York, NY 10036

(212) 790-4500

Attorneys for Amici Curiae

The Center for Democracy

and Technology,

The Genetic Alliance,

The Pharmaceutical Care

Management Association,

Mark Frisse, and

Sara Rosenbaum