Protect Prescription Privacy

Section 1. Legislative findings and intent. Prescribing health care professionals should have a reasonable expectation that when they prescribe a medication for a patient, that decision will not be made available to an outside third party. However, disclosure of individual identifying information about patients and prescribers enables pharmaceutical companies to track the prescribing practices of physicians to target them for marketing, including gifts and payments. This marketing can distort prescribing practices to increase health care costs and undermine patient safety. The National Institutes of Health has found that nearly one-third of the increase in prescription drug prices over the last decade was attributable to marketing-induced shifts in prescribing practices. Published evidence shows that prescribers are often encouraged by sales representatives to prescribe medications in a manner that has not been approved by the Federal Food and Drug Administration.

Neither the state nor any other entity has the resources to effectively counter targeted marketing campaigns that exceed hundreds of millions of dollars.

The legislature finds that this legislation is necessary to protect health care professionals and their patients from the abuses of targeted marketing that are made possible by the disclosure of individual identifying information.

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD01487-01-7

A. 924 2

§ 2. Section 270 of the public health law is amended by adding two new subdivisions 15 and 16 to read as follows:

15. "Individual identifying information" means information identifying or tending to identify a prescriber or patient, where the information is derived from or relates to a prescription for any drug or device.

16. "Marketing" means, but is not limited to, advertising, detailing, marketing, promotion, or any activity that could be used to influence sales or market share of a drug or device, influence or evaluate the prescribing practices of a prescriber, or evaluate the effectiveness of marketing practices or personnel.

§ 3. The public health law is amended by adding a new section 276-a to read as follows:

§ 276-a. Prescription privacy. 1. No prescriber, pharmacist, pharmacy, pharmacy benefits manager, health plan, insurer, third party payer, data transfer intermediary, drug manufacturer or wholesaler or their agents shall disclose, sell, transfer, exchange or use any individual identifying information to any person or entity for the purpose of marketing any drug or device.

2. Notwithstanding subdivision one of this section, individual identifying information, subject to applicable law may be disclosed, sold, transferred or exchanged to: (a) the patient to whom the original prescription was issued or a person to whom the prescribed drug or device may be delivered;

(b) a person legally authorized to issue or fill a prescription for the patient, a person who treats the patient, or a person who provides disease management or case management to the patient;

(c) an officer, inspector or investigator for a government health, licensing or law enforcement agency acting under appropriate legal authority, where the request is made in writing;

(d) a person authorized by a court order to receive such information;

(e) a health researcher who is otherwise authorized to have access to health records of the patient that include the individual identifying information, for reasons including, but not limited to, conducting clinical trials or research regarding the effects of health care practitioner prescribing practices;

(f) conduct drug safety evaluations, product recalls and specific risk management plans, as identified or requested by the federal food and drug administration, or its successor agency;

(g) allow for the appropriate transfer of records that may take place when ownership of a pharmacy is changed or transferred;

(h) the patient's health plan, insurer, or third party payer, or an agent, for the purpose of payment or reimbursement for health care services, including determining compliance with the terms of coverage or medical necessity, or utilization review;

(i) a person or entity to whom, and for a purpose for which, disclosure or transfer is otherwise explicitly authorized or required by law;

(j) a person or entity acting as an employee or agent of a person or entity under any preceding paragraph of this subdivision, for the purpose of and consistent with that paragraph; or

(k) a government entity as provided by law.

3. Nothing in this section shall prohibit the collection, use, transfer, or sale of patient and prescriber data by zip code, geographic region, or medical specialty for marketing purposes, providing it does not contain individual identifying information.

4. This section shall not prevent any person from disclosing, selling, transferring, or exchanging for value individual identifying information

A. 924 3

pertaining to that person, for any purpose; provided that the information does not include individual identifying information pertaining to any other person.

5. Nothing in this section shall prohibit a pharmacy from using patient information to provide care management educational communications to a patient about the patient's health condition, adherence to a prescribed course of therapy or other information about the drug being dispensed, treatment options, or clinical trials.

6. No person or entity to whom or which individual identifying information is disclosed, sold, transferred or exchanged shall disclose, sell, transfer or exchange it to any person or entity other than for the lawful purpose for which it was disclosed, sold, transferred or exchanged to the person or entity, and without satisfactory assurance that the recipient will safeguard the records from being disclosed or used in the state for marketing purposes.

7. This section shall not be construed to authorize any disclosure, sale, transfer, or exchange of individual identifying information that is not otherwise authorized or required by law.

8. In addition to the commissioner's authority to enforce this section under section twelve of this chapter, the attorney general shall have the authority to bring an action to enforce compliance with this section without referral by the commissioner.

§ 4. This act shall take effect on the one hundred eightieth day after it shall have become a law.