Uses and Abuses of Prescription Drug Information in Pharmacy Benefits Management Programs

A pharmacy program that made headlines in 1998 dramatizes how personal health information can be both used and abused in the era of managed care and computers. Two Washington, DC, pharmacy chains, CVS and Giant Foods, sent patient prescription records to a database marketing firm, Elensys.^{1 - 3} Elensys mailed patients reminders to refill prescriptions or information about new drugs. One mailing informed patients who had purchased products for nicotine replacement therapy about bupropion, a new pill for smoking cessation. Drug manufacturers paid the pharmacy chains and Elensys for these mailings. Until they received the letters, patients did not know that their medical information was being used in this way. Elensys said that drug companies had no direct access to pharmacy records and that patients could opt out of the program by returning a form. Although critics objected that the program crossed the line between medicine and marketing, the president of Elensys said, "This is good medical and good entrepreneurial practice, which is the nice thing about it."¹

The pharmacy chains canceled the program after news stories elicited public outrage.² A Giant Foods spokesperson said, "The customer response was extremely negative, and because of privacy concerns we decided to discontinue. . . . Our phones rang off the hook."²

The appropriate use of personal health information is a timely policy issue. The Health Insurance Portability and Accountability Act required Congress to pass health privacy legislation by August 1999 or the secretary of Health and Human Services to establish health privacy regulations by January 2000.⁴ Because Congress failed to act, the secretary recommended proposed regulations in October 1999.⁵

The proposed regulations allow health care plans, providers, and clearinghouses to use or disclose individually identifiable health information in electronic format for treatment, payment, and health care operations without patient authorization.⁵ Pharmacy benefits management is not specifically mentioned in the proposed regulations. However, authorization probably would not be required because case and disease management are considered treatment, and the definitions of treatment and payment are to be "construed broadly."⁶ We discuss later whether statutory authorization is ethically justified for pharmacy benefits management.

Organizations that provide or pay for health care routinely collect information on patient diagnoses, prescriptions, and health services utilization. Computer databases linking many sources of information allow such beneficial activities as quality improvement and outcomes research.⁷ However, breaches of confidentiality may be more serious than with paper records because databases allow access to large amounts of information on many individuals.⁷

We focus herein on the confidentiality of prescription drug information. Because pharmacy costs are the fastest rising sector of health expenditures, pharmacy benefits management is increasingly common.^{8 - 9} The Elensys case dramatizes that patients may not realize how health care organizations may use prescription information, either internally or through contracts with external service organizations. We use this case to identify confidentiality issues that arise in a broader range of pharmacy programs. The term pharmacy benefits management covers a wide range of activities,^{9 - 10} some of which resemble the Elensys program in ethically significant ways. Despite these concerns, debates over federal confidentiality policies have given little explicit attention to pharmacy benefits management.⁶

Professional ethics requires physicians to maintain patients' confidentiality,^{11 - 12} which enables people to seek medical care and to disclose information to physicians. It also prevents stigma and discrimination in health insurance or employment.^{11 - 12} Furthermore, confidentiality ensures respect for patients as persons because patients are offended by breaches of confidentiality, even breaches that health care professionals consider commonplace. (eg, using patients' names in discussion).¹³ In addition, statutes place role-specific obligations on health care providers to protect confidentiality.^{14 - 15}

Although confidentiality is important, there are exceptions, including patients authorizing disclosure of information. Even without patient permission, health care providers may be required by law to report certain infectious diseases to public health officials, gunshot wounds to police, and serious threats of violence by psychiatric patients to intended victims.^{11 ,14 ,16 - 17} These exceptions to confidentiality are ethically justified because they prevent physical harm to third parties or protect the public health.

Other exceptions to confidentiality are ethically justified because patients benefit from the efficient flow of personal health information.^{18 - 19} State laws may permit disclosure of information without patient consent for the direct care of the patient; for authorization, billing, and payment for services; and for utilization review, quality control, and peer review.^{14 ,20}

Critics who condemned the Elensys project as advertising implicitly distinguished it from pharmacy benefits management, for which use of personal health information is generally considered appropriate. However, the line between these categories is blurred.

Some pharmacy benefits management programs are quality improvement programs, warning physicians of adverse drug interactions or underuse of beneficial drugs. Others are disease management programs, reminding patients to refill prescriptions. Still others are cost-containment initiatives, switching patients to lower-cost, equivalent drugs.^{21 - 22} Patients may be contacted about regimen changes by the prescribing physician, the dispensing pharmacist, or the pharmacy benefits management program. Patients may not realize that the pharmacy benefits management program prompts physicians and pharmacists to consider changing drug regimens.

Some pharmacy benefits management projects resemble advertising because they promote products of a particular manufacturer. The primary goal of advertising is to increase market share; benefit to consumers is a secondary end point. Pharmacy benefits managers with ties to a drug manufacturer have promoted drugs made by that manufacturer.^{8 ,23 - 24} In one case, pharmacists were paid to switch patients from a diabetes drug that had generic competitors to another drug from the same manufacturer that had patent protection.²⁵ Such a switch does not benefit patients and may violate restraint of trade regulations.^{8 ,23 - 25}

Critics of the Elensys project objected that its goal was self-interest rather than patient benefit, that patients did not authorize it, that third parties had access to confidential health information, and that safeguards for confidentiality were lacking. These criticisms may also apply to some pharmacy benefits management programs.

The ethical guideline of beneficence may justify the use of personal health information in pharmacy benefits management. However, concerns about regimen changes and formulary restrictions have provided impetus for state patient protection legislation.²⁶ Two questions need to be addressed when assessing the benefits to patients of pharmacy benefits management.

Is the Claim of Patient Benefit Warranted? The Elensys program claimed to benefit patients by encouraging smoking cessation. However, at the time there was no rigorous evidence that the recommended product was superior to alternatives. The next year, a randomized controlled trial showed that the recommended product was more effective than other approaches to smoking cessation.²⁷

Patients may benefit from reduced costs as well as improved clinical outcomes by using products promoted by pharmacy benefits management programs. However, it may be difficult to determine the extent of savings to patients.^{8 - 9} Drug discounts negotiated by health care organizations are business secrets. In addition, the savings from negotiated discounts may be directed to enhancing the profitability of health care organizations rather than keeping premiums and co-payments affordable.²⁸ Furthermore, the risk-benefit ratio of changing drugs must be determined. Risks include adverse effects of new drugs as well as office visits and laboratory tests to adjust the dosage. Also, formulary restrictions that reduce drug costs may be associated with increased hospitalizations and total health care costs if beneficial drugs are excluded.^{29 - 30}

Do Financial Conflicts of Interest Undermine Benefits to Patients? Some critics objected to the profit motive of Elensys and the drug company,¹ which they contrasted with the patient-oriented beneficence of clinical care. However, the distinction between self-interest and beneficence can be blurred in a market-driven health care system. Both not-for-profit and for-profit organizations need to pursue their financial self-interest and generate returns. The concern is that some financial incentives may interfere with beneficial care.³¹

Financial arrangements in some pharmacy benefits management plans are as ethically problematic as the direct payments for information in the Elensys program. Some pharmacy benefits managers pay pharmacists to switch a patient to a preferred drug.^{10 ,25 ,32} These payments are allegedly for record review, patient education, and discussion with the physician. However, the pharmacist receives such payment only if a switch is made. Offering a bonus for specific clinical decisions is a grave conflict of interest. For physicians, such a direct connection is considered an unethical and illegal kickback.^{33 - 34}

Even when the goals of a project are laudable, its means may be problematic. Ethical concerns about the means used in pharmacy benefits management projects include authorization, access, and safeguards.

Many patients in the Elensys program felt wronged because they had not authorized the sale of their personal health information.² Moreover, they could not withdraw from the program before their information was accessed, because they learned of the program only when they received a letter advising them about a drug or refill.

Patient authorization is not generally obtained for pharmacy benefits management, whether the program is carried out within a health care organization or contracted out to external organizations. Individual patient authorization would be an administrative burden, reduce the cost-effectiveness of these programs, and deter their use.⁴

Current confidentiality discussions have focused on privacy as an aspect of autonomy: people want control over personal health information.^{20 ,35} However, such control is constrained by the need to restrain health care costs, particularly drug costs. If patients restrict the use of personal health information for pharmacy benefits management, their costs will likely increase and their choices may be limited to paying more out of pocket for care, changing providers or health plans, or making special arrangements with the health care organization.¹⁸ Respect for persons may be a more appropriate philosophical foundation than respect for autonomy.¹² Even if realistic choices are limited, authorization is important because it promotes respect for patients as persons.

It is hard to imagine that patients would object if their personal physician examined their medical records to determine if they need drug refills or help with smoking cessation. When seeking care, patients choose to share information with physicians and trust them to maintain confidentiality. However, patients may not realize that physicians play a secondary role in pharmacy benefits management. Frequently, changes in drug regimens under pharmacy benefits management are implemented through a letter from the physician to the patient.⁹ However, the pharmacy benefits management program prepares letters for physicians to sign if they agree with the regimen change. The patient's health information already has been analyzed by the program before the physician receives the letter. Thus, the physician cannot ensure that confidentiality has been maintained in this process.

The Elensys episode illustrates how the issue of who has access to health information is intertwined with why they have access. Pharmacy chains and pharmacy benefits managers need to access personal health information when dispensing medications to identify contraindications to a prescribed drug. Access is also appropriate for billing and payment, quality improvement, disease management, and cost containment because patients will benefit. In contrast, there is little justification to access identifiable clinical information to advertise products that are not known to be better than alternatives, unless the patient wants to receive such information.

Self-insured employers need to have prescription information to pay for prescription drug benefits. However, employers could also use personal health information in personnel decisions.⁸ Concerns about confidentiality are particularly troubling with regard to prescription information because employers often hire pharmacy benefits management firms to manage drug benefits.¹⁰

Patients in the Elensys program objected that strangers had access to their personal health information. In some pharmacy benefits management programs, health care organizations or employers contract with an external service organization with expertise in analyzing computerized databases.¹⁰ Patients may fear that service organizations fail to safeguard confidentiality.

Safeguards reduce the risks of projects that use personal health information. Recent reviews discuss in detail how current law may not adequately protect confidentiality.^{15 - 16 ,36} State confidentiality statutes and case law may apply only to health care providers^{15 - 16 ,21} and not to data management firms.^{32 ,37} Statutes usually concern disclosure of personal health information by health care providers to third parties, not the use of information within a health care organization.¹⁵ Furthermore, current security of computerized health information may be inadequate.^{8 ,15}

The Elensys case illustrates how service organizations can be a weak link in confidentiality. After this incident, legal uncertainty prompted state legislators in Maryland and Virginia to introduce bills to strengthen confidentiality of pharmacy records.¹ The debates over federal health privacy legislation or regulation offer an opportunity to craft policies that can both protect confidentiality and allow the appropriate use of personal health information in pharmacy benefits management programs.

There are strong policy reasons to identify underuse of beneficial drugs, enhance adherence, and restrain increases in prescription costs.^{23 ,38 - 39} Quality improvement, disease management, and cost containment are praiseworthy goals for pharmacy benefits management. However, the means used to achieve these goals also must be appropriate. Our recommendations go beyond those of the Department of Health and Human Services (DHHS) by requiring clear evidence of benefit to patients, an oversight committee, patient authorization, disclosure or prohibition of conflicts of interest, and additional safeguards for sensitive medical conditions.⁴

Benefit to patients is a necessary condition for using personal health information in pharmacy benefits management. To reduce controversies over whether a particular program benefits patients, 2 operational questions about benefit should be asked: What standards should be used to determine benefit? Who decides whether a project is beneficial?

The standard for benefit should be evidence-based medicine. Recommendations to change drug regimens should be based on critical review of published evidence or expert consensus. Programs that inform patients of new drugs should be justified by published evidence that the drugs are superior to alternatives.

The decision maker should be an impartial and balanced oversight committee. Because of concerns about conflicts of interest, the majority of committee members should have no financial stake in the decisions, pharmaceutical companies, the organization holding the data, or a contracting entity and should not be employees of the organization or a contracting entity. The committee should determine whether the benefits of the program are sufficiently well established to justify the risk of breaches of confidentiality; whether adequate safeguards for confidentiality are in place; whether other ethical concerns about the program have been addressed; and whether a project should be characterized as advertising and therefore subject to heightened scrutiny.

To carry out these tasks, the oversight committee needs membership different than that of a formulary committee. It should include patient advocates and experts in the confidentiality of computerized databases as well as pharmacists and physicians. Independent review as a means to protect patients has a precedent in institutional review boards for research on human subjects. These entities are charged with protecting research subjects and ensuring that the risk-benefit balance in a research project is acceptable. Institutional review boards are required to have members who are not associated with the institution, who are nonscientists, and who are primarily concerned with the welfare of subjects.⁴⁰

The DHHS recommendations regarding confidentiality allow personal health information to be used without patient authorization for clinical care, billing and payment, and core business functions, as well as for pharmacy benefits management.⁴ The DHHS argues that signing an authorization form does little to promote confidentiality.⁵ However, as previously discussed, notification and authorization show respect for patients as persons.

Authorization is particularly important for pharmacy benefits management because of concerns about the nature of patient benefits and about conflicts of interest. Requiring authorization gives the patient more control over the use of personal health information than placing the burden on patients to object. The legal formality of signing a document calls attention to the possibility of choice and objection.⁴¹ An authorization requirement increases the likelihood that patients will act on serious concerns.¹⁸ As in research studies, participation rates are likely to be lower if affirmative consent is required than if patients are entered into the program unless they object.⁴²

Authorization as a Condition of Care. Patient choice is constrained by the economic reality that drug costs need to be controlled. Health care organizations and plans should be allowed to make use of personal health information for pharmacy benefits management a condition of care. The burdens of keeping records of individual authorization or allowing individuals to opt out will reduce the cost-effectiveness of pharmacy benefits management. A patient who does not participate is a "free rider," obtaining the benefits of cost-effective care without sharing the risks to confidentiality. When physicians alter a drug regimen, they tend to make the switch for other patients as well.⁷ If pharmacy benefits management is a condition of care, the options for patients who object may be limited to paying for care out of pocket, changing providers or plans, or seeking an exception.¹⁸

Authorization Need Not Be Burdensome. On annual enrollment or first clinical contact, health care organizations now commonly obtain authorization to release information to third-party payers. At those times, patients also could be asked to authorize the use of their health information for pharmacy benefits management. Separate authorization for each use of information, as recommended by some health privacy advocates, would be prohibitively burdensome. A policy of one-time permission is feasible middle ground between statutory authorization and specific authorization for each use.¹⁸

Disclosure of financial arrangements may deter projects that are ethically problematic, as ultimately occurred in the Elensys case.² Disclosure of financial arrangements in pharmacy benefits management also may help patients make several important decisions, including whether to choose a particular benefits plan, to appeal a formulary restriction, or to pay more out of pocket for a drug not on the plan's list of preferred products.

Some conflicts of interest are so severe that they should be prohibited rather than merely disclosed.^{11 ,43} For example, pharmacy benefits management programs should not pay pharmacists for switching patients to specific drugs.³² If reimbursement truly is for record review, patient education, and discussion with the physician, the pharmacist should be paid for these activities even if no switch is made.

Some conditions, such as human immunodeficiency virus (HIV) infection, mental illness, and substance abuse, carry greater risks of discrimination and stigma. Many states have enacted stricter confidentiality protections for such conditions, for example, requiring specific written consent to disclose HIV test results or mental health records.^{15 ,21 ,44} However, effective therapies are underused in these conditions. For instance, primary care physicians underdiagnose and undertreat depression.⁴⁵ Therefore, patients with these conditions could benefit from pharmacy benefits management.

We believe that pharmacy benefits management should be permitted for such sensitive conditions designated by state law, subject to several additional safeguards. First, authorization for access to information regarding sensitive conditions for pharmacy benefits management should be separate from authorization to access other personal health information. Second, there should be earlier and more significant physician involvement in planning projects as well as notifying patients when changes in therapy are recommended. Such physician involvement helps ensure that programs truly benefit the patient. Third, organizations carrying out such programs should consult with advocates for persons with the condition. Such consultation will help health care organizations address patient concerns about confidentiality and thereby increase acceptance of the program. For example, a pharmacy benefits management program dealing with mental illness may be better accepted if the program has no access to psychotherapy notes. Finally, comprehensive safeguards are particularly important for sensitive conditions.

Policies regarding pharmacy benefits management make sense only in the context of comprehensive protections for personal health information. Administrative, technical, and physical safeguards for confidentiality have been extensively analyzed.^{8 ,46 - 47} Such safeguards should include:

Some programs calling themselves pharmacy benefits management are more accurately characterized as advertising. Patient authorization to use personal health information for advertising should be separate from authorization for pharmacy benefits management.^{7 ,19} A separate authorization highlights differences between advertising and other uses of personal health information. Furthermore, authorization for advertising should not be permitted as a condition of care. Patients should be told that they may refuse authorization for advertising without compromising their care. Patients also should be able to withdraw such authorization.

In conclusion, deadlines for federal regulations on health privacy offer the opportunity to develop coherent confidentiality policies. Comprehensive policies can both relieve patient concerns about confidentiality and also allow appropriate use of personal health information in pharmacy benefits management. Sound policies for these programs should require clear evidence of benefit to patients, an oversight committee, patient authorization, disclosure or prohibition of conflicts of interest, additional safeguards for sensitive medical conditions, adequate confidentiality safeguards, and additional restrictions for advertising.