Privacy as the Price of Drug Access

In response to the recent increase in FDA-approved specialty drugs and escalating specialty drug prices, drug companies now offer patient support programs (“PSPs”) for eligible patients prescribed a particular pharmaceutical drug. Such programs encompass both financial assistance for the purchase of a specialty drug and behavioral services, including nursing support and injection training, intended to improve drug adherence. Although ostensibly gratuitous, these programs have a steep and underappreciated cost: disclosure of protected health information. In effect, patient support programs compel patients to trade protected health information for drug access. This Article provides the first in- depth examination of the legal and ethical concerns associated with patient support programs. Enrollment in a drug company’s patient support program furnishes the company with linked patient- and prescriber- identifying information for each enrollee, data which may enable drug companies to target marketing to patients and healthcare providers with an otherwise unattainable degree of precision. Moreover, once a drug company acquires an enrollee’s protected health information pursuant to a valid Health Insurance Portability and Accountability Act (HIPAA) authorization, a drug company faces few limits on downstream uses of those data. This Article illuminates a possible role for patient support program-mediated data collection in two unlawful drug company practices: (1) kickback schemes in coordination with foundations that cover pharmaceutical drug copays, and (2) “product hopping” to a new brand-name drug formulation after patent expiration of an older formulation. The current regime for health data privacy in the United States lacks adequate safeguards to prevent drug companies from exploiting patient support program-derived data to the detriment of patients. The Article ends by proposing practical modifications to the HIPAA Privacy Rule to modernize HIPAA’s protections vis-à-vis health data transferred from covered entities to noncovered entities such as drug companies.