Your health care data is for sale. Here's how Big Pharma is using it.

In this video, we're going to explain how Big Pharma buys your health care data

and uses it to target doctors who don't prescribe their drugs. It sounds like a HIPAA violation. Insurance companies are selling your health care information

to pharmaceutical companies so they can target your doctor. It's legal because they remove your

name and replace it with a number. They know your age, your sex, your medications

your hospitalizations, your illnesses, and the zip code where you live. But as long as your name isn't attached to that information

but you're identified by a number, that's considered anonymized, patient-level information, and that is compliant with HIPAA laws

The prescription data sold by pharmacies de-identifies patient information and replaces doctors' names with their license numbers

But here's the key. The American Medical Association sells access to its Physician Master File

which contains the license information for nearly every doctor in America. This gives drug companies everything they need to connect doctors to their prescriptions

They know exactly what they're prescribing, and they also know what they're prescribing it for

because your insurance company sells your health information to these health information organizations as well

There's a $9 billion industry called Healthcare Commercial Intelligence that buys all this information from insurance companies and pharmacies and puts it together in one easy-to-use database

Drug companies subscribe to these databases and use the information to make inroads either in a new market or with a new drug

Definitive Healthcare, for example, sells itself as having all the answers to pharmaceutical companies' most important questions

How do you find the physicians who can prescribe your drug? Who are the key decision makers at your target account

How big is the market for your new device? Definitive has profiles on more than 2.6 million physicians, nurses, and other healthcare professionals

as well as billions of insurance claims on hundreds of millions of patients

The company updates its database daily. The physician profiles include clinical activity level, prescription activity level

and their propensity to prescribe brand name over generic drugs So when a drug rep walks into a doctor office they have the doctor profile in hand and a custom sales pitch based on their patients data

I started practicing 30 years ago, and even back then the pharmaceutical companies

could buy vendor data, they knew what your prescribing practices were, and they would use that to target, you know

specific medications, specific physicians based on prescribing patterns. Dr. Ami Bera has a unique perspective as a medical doctor and as a member of Congress

It could be used for good if you're not using the medications correctly or it seems like you're an outlier in those medications

I'm going to guess most of the time it's used to market those medications and try to get you to switch from one, let's say, antihypertensive to a different one

According to a 2022 report from the cloud software company Viva, 60% of health care providers meet with drug reps

Dr. John Dombrowski, an anesthesiologist based in Washington, D.C., counts himself among that crowd

How does that make you feel knowing that the drug rep knows exactly what you've been doing lately

I mean, that makes me a little uncomfortable. It seems like big brothers. I did not consent to that

I did nothing about this. This is all kind of being vacuumed up. It's very sad that, you know, the American Medical Association is then making profit off my data

that I didn't consent to, that they can then sell to big pharma. And what are you trying to get out of a drug rep and your interaction with a drug rep

What are you hoping to learn? Basically, I learn as much as I can. Obviously, I go to meetings

I have journal club. But maybe there's a new medication out there that I may not know about that I would certainly listen to them

They can leave a leave behind. Obviously, I know from a drug representative, they're here to push a product

I know what they're selling, and you should always be aware of that. But just because there's a new product out there doesn't mean it's good or bad

It means I should take a look at it to see maybe there's something I'm missing

And that's appropriate. Pharmaceutical companies spend billions of dollars a year on what's called prescriber detailing, which is face-to-face sales meetings

One of the most popular ways to do that is with a meal. Drug reps take doctors out to dinner or deliver lunch to their office

In exchange, the doctor listens to the sales pitch while they eat

Some doctors have become so fed up with drug reps that they either won't meet with them or have time limits

Some hospital systems have banned them entirely. Did you ever have an interaction with a drug rep where it seemed like they might have been pressuring you You know I never felt pressure But again I think they doing their job which is selling their medication I think we have to do our job and I think we could do a better job

educating medical students in residency to understand what the real world is going to be

like. So our job is to push back, ask questions, gather information, but then make the most cost

effective decisions. This is all allowed under the Health Insurance Portability and Accountability

Act of 1996, or HIPAA, which was written to protect private health information

HIPAA works by saying to the doctors and the hospitals and the health insurers

here's a bunch of rules that you have to follow about this data, no matter what the patient says

The patient gets these rights just by existing. They don't have to agree to anything

HIPAA only applies to personally identifiable information, so insurance companies can legally

de-identify information and sell it. There are two ways to de-identify data, the expert method

and the safe harbor method. The expert method is pretty simple. An expert must examine the data to

ensure there is a very small risk a company could figure out who it is. The safe harbor method

requires the removal of 18 identifiers, including name, zip code, telephone numbers, email addresses

and social security numbers. According to the Department of Health and Human Services

de-identified health information created following these methods is no longer protected by HIPAA

But they wrote it and said, if you go through this de-identification process

essentially, as long as it's still de-identified, you can do whatever you want with the data

So nobody in that chain knows that you were one of the 400 patients that the doctor prescribed

for any drug. So the patient data isn't a part of this

Insurance companies spell out exactly what they do in their disclosures. It's just so few people

read them. Take Cigna as an example. Their notice of privacy practices states, in some circumstances

we may use your protected health information to generate aggregate data or summarize data that

does not identify you, to study outcomes, costs, and provider profiles, and to suggest benefit

designs for your employer or health plan. These studies generate aggregate data that we may sell

or disclose to other companies or organizations. United has a very similar disclosure. Their notice

of privacy practices states, we may collect, use, and disclose health information

needed to operate and manage our business activities related to providing and managing your healthcare coverage We may also de health information in accordance with applicable laws After that information is de the information is no longer subject to this notice

and we may use the information for any lawful purpose. Is that a sufficient disclosure in your

mind? I mean, that almost exactly word for word tracks the rules, pretty much. SAN reached out to

the major insurance companies, health care commercial intelligence providers, and the nation's largest pharmacy chains. Despite multiple inquiries, these household names

including United, Cigna, and CVS, never returned our calls or emails. But one of the nation's

leading privacy and cybersecurity attorneys pushed back on the idea that selling data is

inherently bad. This idea that your privacy is being violated because your data in an anonymous

de-identified format is being used for other purposes, there's a disconnect there. I mean

And it's a little hard to frame what your privacy interest is in having data that none of the recipients know is about you

Nara explained how this practice could help lead to better care for patients

because it helps all health care professionals track what works and what doesn't

You want to be able to follow a patient across a journey

I don't care that it's you. I just need to know that it's the same patient who had this diagnosis on this day

this test, this procedure, this, you know, whatever they're going to do, and had that result

I need to know that it's the same person in order to evaluate whether it's working and whether you're doing that across the healthcare system

I've practiced in 150 specialty medical group. We would want to have the information to get a sense of how are doctors prescribing, what are they prescribing

how are they using their medications, so that we could actually take that feedback and give it back to our doctors

compare them to a panel of their peers and see where they're at

That, I think, is all valuable information, but that's not the pharmaceutical company

That's the medical group. That's the hospital system, per se. Interactions between drug reps and medical professionals have changed since the turn of the century

In 2002, the Pharmaceutical Research and Manufacturers of America created a code to police interactions between reps and healthcare professionals

The self-imposed rules were updated in 2009, further restricting gifts and meals

For more coverage of the health care industry, head to san.com or download the Straight Arrow News app and search health care