Privacy Commissioner releases his finding on the prescribing patterns of doctors

PIPEDA Case Summary #2001-15

Ottawa, October 2, 2001 - Because of widespread public interest, the Privacy Commissioner of Canada, George Radwanski, today released the following finding under the Personal Information Protection and Electronic Documents Act. The finding is a letter to the complainant.

This letter constitutes my report of findings with regard to the complaint you filed against IMS Health Canada (IMS Health) under the Personal Information Protection and Electronic Documents Act (the Act). In the complaint you filed with my office on June 13, 2001 you alleged that IMS Health Canada sells information about your prescribing habits without your consent.

I have determined, first of all, that the subject matter of the complaint does fall within my jurisdiction under the Act. Section 30 excludes certain organizations and personal health information from the ambit of the Act until 2002 or 2004, as the case may be. But since IMS Health was alleged to have disclosed personal information across borders for consideration, Section 30 operates to apply to IMS Health as of January 1, 2001. On this basis, therefore, I accepted and investigated the complaint under section 12 of the Act.

Before providing you with my findings, let me first outline the facts that were obtained during the course of our investigation. It was determined during the investigation that IMS Health gathers the following information from Canadian pharmacies:

• store number, transaction date;
• drug identification number, drug name, form, strength, manufacturer, quantity, cost, selling price, whether a new or refill prescription, prescription number, repeat authorizations, reference codes identifying the reason for use, reasons for a 'no substitution' order;
• prescriber first and last name, identification number, phone number;
• information regarding the insurance carrier (if any) including deductible, form of payment, co-payment;
• patient gender, date of birth.

The information is transmitted to IMS Health's data processing center in Philadelphia, where IMS Health produces customized information products for its pharmaceutical company clients. These products are then transferred to the IMS Montreal operation, where they are stored. Two typical products are the Xponent and ProMap reports.

Xponent is a prescriber linked sales management service. Each report lists all of the doctors within a pharmaceutical company detailer's sales territory, by name, specialty, and business address. It contains aggregated information about the drugs in a drug class, (form, strength, number of units) and the prescriber name, specialty and address. The aggregated average number of prescriptions written by groups of physicians for all drugs in the therapeutic class is provided. The report ranks each one of the doctors in the territory by their relative level of prescribing activity.

ProMap is a report which tracks the monthly prescribing activity of a group of physicians, identified by a pharmaceutical company, who have attended a Continuing Medical Education (CME) event sponsored by the company. The report shows the number of those doctors writing new prescriptions for targeted drugs on a monthly basis. ProMap is used to evaluate the effectiveness of the CME activity.

Pharmaceutical sales representatives from several Canadian provinces regularly obtain access to the Xponent and ProMap products, for a fee. The data is regularly transmitted across borders for consideration. On this basis, therefore, I am satisfied that the activities of IMS in this regard are disclosures of information outside of a province for consideration within the meaning of subsection 30(1) of PIPEDA.

I must now consider whether this information concerning prescribing habits of physicians is personal information within the meaning, scope and purpose of the Act.

In Section 2 of the Act "personal information" is defined as:

". information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization."

The word "individual" means a natural person, so it follows that it does not include legal persons such as corporations, partnerships or associations. There may be circumstances where information relating to an entity such as a sole proprietorship is so closely linked to an individual person, that the information can be said to be about that individual but for the most part "personal information" must be about an identifiable individual and not merely associated with the individual, by name for example. In my view, therefore, the meaning of "personal information", while broad, is not so broad as to encompass all information associated with an individual.

Clearly a prescription directed to a pharmacist to dispense a certain medication in a certain dosage to an identified patient, is personal health information about that patient. By extension, all of the prescriptions directed to pharmacists by a physician are also the personal health information of the patients. But is this prescription information-whether an individual prescription or the totality of prescriptions- anonymized as far as the patient is concerned, also personal information about the prescribing physician?

It is certainly diffficult to discern how an individual prescription can constitute personal information about the physician who wrote it. While it can be revealing with regard to the patient-the nature of an illness or condition, for instance, and perhaps its severity-it discloses little or nothing about the physician as an individual. Indeed, a prescription is not normally treated as personal information about himself or herself by the prescribing physician. The patient is not enjoined to secrecy, remaining entirely free to show it to anyone at will or to leave it unattended in a public place.

This is not surprising, because the prescription is not, in any meaningful sense, "about" the physician. It does not tell us how he goes about his activities, whether he is casual or formal, whether he works mornings or afternoons, whom he meets, where he goes, what views he holds, or any of the other myriad details that might constitute personal information. Rather, a prescription is the outcome of the professional interaction between the physician and the patient: the physician meets the patient, carries out an examination, perhaps reviews the results of tests, and then issues the prescription. Hence, the prescription can perhaps most appropriately be regarded as a "work product." I find it to be information not about the physician, but about something once removed, namely the professional process that led to its issuance.

If an individual prescription is not personal information about the physician, can the prescribing patterns deduced from analyzing a multiplicity of prescriptions nevertheless constitute such personal information?

In approaching this question, I am mindful of the purpose clause in section 3 of the Act, which states that:

"The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances."

That purpose would not be fulfilled by giving an overly broad interpretation to the concept of "personal information" in the commercial context of the law, though the determination must be made on a case-by-case basis.

If the prescribing patterns of a physician-for instance, a tendency to prescribe one medication rather than another for a given ailment-were deemed to be information "about" the physician, then the same determination would logically have to be made about identifiable patterns with regard to the work products arising from a broad variety of other activities.

Does the chef in a restaurant predominantly focus on cooking fish, does she have a heavy hand with the tarragon or use very little salt? Does a contractor tend to use the very newest roofing materials, or does he predominantly stick with what was in vogue 10 years ago? Does a garage mechanic tend to fix only the problem that was reported, or is there a pattern of discovering other purported problems that run up the bill?

Therefore, regarding the patterns discoverable in such work products as personal information could have the effect of precluding many kinds of legitimate commercial consumer reporting that, while clearly of potential value, might fall outside the Act's exemption for journalistic activity.

For that matter, in the case of federal works, undertakings or businesses covered under the Act, interpreting personal information so broadly as to encompass work products could have the effect of including under the rubric of personal information about employees such things as letters written by employees in the course of their employment, legal opinions, or reports prepared by employees for use by management.

I do not believe that such results would be consistent with the stated purpose of the Act. Rather, it is my view that the balance is properly struck by establishing whether the information is indeed about the individual, or rather about the tangible result of his or her work activity, namely the work product.

In the case of the present complaint, I find the latter to be true. Accordingly, I find that prescription information-whether in the form of an individual prescription or in the form of patterns discerned from a number of prescriptions-is not personal information about the physician.

Having determined that the information that IMS Health collects and discloses is not personal information subject to the protections afforded by the Act, I must therefore conclude that your complaint is not well-founded. Please note that IMS Health has been informed of my finding in this matter.

Now that you have my report, I must inform you that my finding is not necessarily a final determination of this issue, should you wish to proceed further. Pursuant to section 14 of the Act, you have the right to apply to the Federal Court-Trial Division for a hearing in respect of any matter that you complained about or that I have dealt with in my report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by the Act, in subsection 5(3) or 8(6) or (7) or in section 10.

Should you wish to proceed to Court, I suggest that you contact the Trial Division of the Court Office nearest you. It is located . . . Normally, an application must be made within 45 days of the date of this letter.

I should also inform you that because of widespread interest and questions as to the effects of the Act in its application to the health sector, I consider knowledge of this finding to be in the public interest and will therefore make it public.

This concludes my investigation of this complaint.

Yours sincerely,

George Radwanski
Privacy Commissioner of Canada