Contact:
Beth Givens, PRC Director, (619) 298-3396, bethg(at)privacyrights.org
Linda Gross, LCG Communications, (718) 853-5568, linda(at)lcgcommunications.com
Lou Gordon, (212) 219-7777, lougordon77(at)hotmail.com
Q: What is the PRC v. Albertsons case about?
A: Albertsons, Inc. is the nation’s second largest supermarket chain with over 2,500 stores including 1,556 combination food-drug stores and 707 stand-alone drugstores generating annual revenues exceeding $35 billion. Albertsons has more than 700 supermarkets and drugstores in California alone, representing about 28 percent of its store base. It conducts its pharmacy operations under the banners Albertsons, Jewel, Sav-On Drugs, Osco Drugs and Jewel-Osco (hereafter collectively “Albertsons”).
Albertsons collects its customers’ confidential medical information by surreptitiously reviewing customer prescriptions - required to be kept confidential and used only as authorized by the patient - and creates a retrievable database including customer addresses, phone numbers and drug regimen. The information is made available for use to satisfy pharmaceutical companies willing to pay Albertsons to fulfill drug marketing objectives. The result is unsolicited mailings and/or phone calls directed at consumers attempting to convince them to buy more or different medications.
Also developed in this manner is a lucrative profit center for Albertsons that violates laws and regulations intended to protect consumers from unauthorized intrusions into their private life and the unnecessary sharing of confidential medical data. The sharing occurs through an ever-widening circle of marketing personnel working on the Albertsons program.
Q: What does it have to do with privacy?
A: Consumers have the right to expect that their confidential medical information provided to a pharmacy to purchase medication will not be otherwise used, except as legally required or explicitly authorized in writing. This is especially true when that information involves personally identifiable medical information that effectively discloses a person’s underlying medical condition. Albertsons’ customers are entitled to feel secure in the belief that the California medical confidentiality laws place strict limits on when and how personally identifiable medical information can be shared and used. Excepting necessary administrative functions, the law reserves use of this medical information to modes chosen by the customer. Albertsons represents this to be the case on its website and then disregards the assurance it provides.
Q: Why has the PRC chosen to be a plaintiff in this case?
A: The PRC was established in 1992. It has many years’ experience handling consumer complaints and responding to consumer questions and concerns. The PRC has learned of numerous instances in which sensitive, confidential medical information had been used improperly with serious adverse consequences to the consumer. In this lawsuit, the PRC is acting on behalf of all consumers whose privacy has been violated by Albertsons in California and elsewhere. Since most consumers don’t want to be publicly identified in a primary case as a victim, wanting to protect their privacy, the PRC acts as a plaintiff on behalf of such unnamed individuals and acts in the public’s collective interest by safeguarding consumers from Albertsons’ improper and illegal business practices.
Q: Is what Albertsons did illegal?
A: Yes, under California law and the laws of many other states. As statutes vary from state to state, the law being violated in any specific jurisdiction will depend on the laws on the books in that state. However, the remedy sought by the California-filed lawsuit can reach beyond the California borders.
Q: How exactly does Albertsons improperly use its customers' prescription information?
A: Albertsons has carefully devised and implemented a multi-step plan to exploit consumer medical information for profit. Here’s how it works:
Consumers provide confidential medical information to Albertsons for the purpose of filling their prescription(s). The customer is not advised or informed it will be used for other purposes.
The information provided by Albertsons customers includes personally identifiable medical information including the pharmacy customer’s name, address, telephone number, the medication prescribed and, by deduction, the underlying medical condition.
Albertsons promotes access to its customers’ confidential medical information to pharmaceutical companies anxious to increase name recognition, sale of their drugs, alternative medications, successor drug formulations, or the like.
Albertsons secretly enters into commercial arrangements with pharmaceutical companies willing to pay to participate in Albertsons’ Drug Marketing Program, which is based on the information taken from customer prescriptions.
Albertsons attracts pharmaceutical companies to participate in using this medical information for direct marketing (either undertaken directly by Albertsons or through contracted direct marketing service companies) to increase or initiate the sale of specific prescription drugs. The pharmaceutical companies pay large amounts to participate in Albertsons’ drug marketing program. The success or failure of a program is determined and monitored with reference to increased sale of drugs.
The drug marketing program allows pharmaceutical companies to advertise and market a drug of choice directly to thousands of pre-qualified and targeted consumers who use a specific drug or who may be convinced to increase use of a branded drug or class of drugs based on their underlying medical condition. These companies ably target Albertsons’ customers deemed receptive to the marketing pitch of the particular drug at issue.
The pharmaceutical companies prepare and/or have final approval of the text of the direct marketing letters (or other communication – e.g., phone calls) that are the basis of Albertsons’ drug marketing program. The marketing letters are sent to pharmacy customers under Albertsons’ letterhead, and blatant sales objectives are disguised as being solicitous of a patient’s well being. The communications are never shared with the customer’s doctor; similarly, the customer is not aware (or told) that the solicitation is prepared by the drug company, though disclosure of the “sponsor” is embedded in the message’s text. An opportunity to “opt-out” and not receive further letters is provided by the letter; the law specifies the only acceptable procedure to receive communications is for a customer to “opt-in.”
The pharmaceutical company paying Albertsons for participation in the drug marketing program pays for retrieval of customer profiles and implementation of specific marketing objectives. Albertsons receives an amount per letter and a contract may similarly provide an additional incentive fee for enhanced results from sale of the drug being marketed. In addition to payment from the pharmaceutical company financing the project, Albertsons benefits economically from increased drug sales.
Albertsons does not disclose the drug marketing program to its customers when their prescriptions are filled and Albertsons proceeds without customer authorization. “Authorization” is a term of art under California law requiring written permission on an informed basis. Albertsons similarly does not disclose its program to a customer’s prescribing physician(s) (or other caregiver) and proceeds, notwithstanding the interference in the physician-patient relationship.
Albertsons never discloses the full underlying relationship of the pharmacy to its customers and seeks to conceal the purpose of the drug marketing program. It disguises the direct marketing campaign as being for the salutary purpose of reminding consumers to renew their prescriptions or informing them of alternative drugs that are available for their medical conditions. This rationale is a sham.
Albertsons publicly disseminates misrepresentations to consumers regarding its use, disclosure, control, and protection of customer confidential and private medical information. Albertsons publicly assumes a stance acknowledging a consumer’s legitimate and strong interest in maintaining the confidentiality and privacy of customer medical information, but acts to the contrary.
Q: Why would Albertsons even do this?
A: The practice of selling consumer medical information is extremely lucrative. Health care spending in the United States is at record levels, and much of this is driven by the high cost of prescription drugs. Pharmaceutical companies are also always looking to encourage successor drugs utilization after patent protections of older medication lapse and when they face chronic competition from generic drugs.
Q: Do they make a lot of money by engaging in this practice?
A: Albertsons is paid at least $3.00 - $4.50 per letter it sends and between $12-15 for each phone inquiry. Hundreds of thousands of communications are sent annually and the pharmaceutical companies accordingly pay millions of dollars to Albertsons annually. This is a big business with substantial margins in part because the same process is used (i.e. effectively twice) to identify and sell physician prescribing patterns and influence physician conduct.
Q: Is the practice of selling private medical information a chronic problem? Do other
pharmacies similarly violate privacy rights and medical confidentiality?
A: In 1998, CVS, another large multi-state drug store chain, signed a contract with Elensys Care Services and Glaxo Wellcome, a major pharmaceutical manufacturer. The agreement provided for Elensys, a data management company based in Massachusetts, to send targeted mailings to CVS customers. Some were aimed at promoting Glaxo’s new smoking cessation drug, Zyban, but all of the mailings - - based on prescriptions filled for each customer - - sought to influence consumers to buy new products. When the scheme became public, the adverse publicity and litigation forced Elensys to change its name to Adheris, Inc. In 2002, Elensys Chief Executive Matt Glaser told the Washington Post that “we changed the name as part of a branding process for the company.”
Finkelstein & Krinsk, the law firm that brought the case against Elensys on the above facts, is litigating the PRC case against Albertsons. In 2002, the New York Times reported that mailings of samples of Prozac were sent to potential customers even though they hadn’t filled prescriptions for the drug. In early 2003, the Boston Globe reported on pharmaceutical company mailings that identify patients by name and medical condition on the outside of the envelope. Dr. James F.X. Kenealy, an ear, nose and throat specialist, was quoted as saying, “When my postman knows what diseases my wife has, that’s not appropriate.” (Boston Globe: January 11, 2003)
Q. Even if Albertsons did improperly use confidential information to benefit pharmaceutical companies, does any real harm result? What’s so bad about that?
A: The ramifications of the Albertsons case clearly extend to a number of areas:
Financial and emotional repercussions for customers if their information gets into the wrong hands. For example, a customer using a business address can become an undesirable employee if an expensive medical condition is revealed to a self-insured employer. Another example: a patient living in a condominium community lives in fear of disclosure of his condition by the mis-delivery of mail.
Financial incentives for unethical behavior. If companies act improperly to gain an advantage here, what other conduct will be allowed and what private details will be disclosed next?
Q: What should you do if you receive an unsolicited letter or are called by a pharmaceutical
company?
A: If you receive a letter or phone call from your pharmacy or from a drug company in which you are advised to switch to a certain brand, it is likely that your pharmacy has entered into a marketing program similar to Albertsons’ drug marketing program. If this has happened to you, we encourage you to contact the Privacy Rights Clearinghouse via its web site’s inquiry form. Be sure to save the letter, or if you’ve received a phone call, note the date, time of day, and any other details about the phone call.
As a general rule, always ask your pharmacy if they sell or share your personal information with any other companies before you decide to do business with them. If they say “yes,” either find another pharmacy to serve your needs, one that does not profit from exploiting your sensitive personal information, or tell your current pharmacy in writing to not sell, share or use any personal information with other companies, or with their affiliates or business partners. Be sure to ask for written confirmation from your pharmacy that they indeed will not sell, share, use or give your personal information to/with others. Be sure to read the privacy notice, often called an HIPAA notice, of any pharmacy that you use.
Q: Where can a consumer get more information about protecting his or her privacy,
especially when it comes to medical records?
A: The Privacy Rights Clearinghouse offers two guides on its web site on the subject of medical records privacy:
- “How Private Is My Medical Information?”
- “HIPAA Basics: Medical Privacy in the Electronic Age”
There is also a form letter consumers can tailor and send to their pharmacy to ensure that their prescription information will not be used for marketing purposes. Remember: Not all states have laws that require authorization before providing medical information to be used for marketing.
You can also learn about the medical privacy laws in your state by visiting the web site of the Health Privacy Project at http://www.cdt.org/healthprivacy/.
