Security, Privacy and The Law : Security & Privacy Lawyer & Attorney : Foley Hoag Law Firm : Boston, Washington D.C.

Background

The case concerned Vermont’s 2007 Act Relating to Increasing Transparency of Prescription Drug Pricing and Information. The Vermont law prohibited pharmacies and similar entities from selling information about physician prescription patterns (“prescriber-identifiable data”), and prohibited pharmaceutical manufacturers from using such data for marketing purposes without the express consent of prescribers. As a result, the law severely restricted the ability of pharmaceutical sales representatives to tailor their “detailing” presentations (the trade term used to describe routine pharmaceutical marketing presentations) to the needs of individual prescribers. The law did include an exception for the use of prescriber-identifiable data in healthcare research.

IMS Health, an entity that collects and sells prescriber data, challenged the law in the United States District Court in Vermont. The District Court upheld the law, finding that it was a valid and constitutional restriction on commercial speech, given Vermont’s asserted interests in both healthcare cost containment and public health. On appeal, the Second Circuit Court of Appeals reversed, finding that these justifications were inadequate. The Second Circuit ruled that the law violated the First Amendment by burdening the speech of pharmaceutical marketers and data mining entities. The United States Supreme Court granted certiorari in order to reconcile the conflict between the Second Circuit’s decision to strike down the Vermont law, and the First Circuit’s recent decision to uphold a similar New Hampshire law.

Supreme Court Ruling

In ruling in favor of IMS Health and affirming the Second Circuit, the Supreme Court first found that the text of the Vermont law constituted more than an incidental burden on speech, as it explicitly disfavored both specific speakers (pharmaceutical manufacturers) and specific contents of speech (marketing activities), and was thus subject to a “heightened” standard of judicial scrutiny. The Court also observed that the law’s legislative history clearly indicated that its express purpose was to diminish the effectiveness of brand-name pharmaceutical marketing efforts. Second, the Court concluded that the Vermont law directly regulated the content of that speech, and was therefore not solely a commercial regulation (whose constitutionality could have been analyzed using a level of judicial scrutiny more deferential to Vermont). Third, the Court ruled that the Vermont law restrained the use and dissemination of information about prescriber habits, and thus specifically burdened the marketing speech of pharmaceutical companies. As a result, the Court ruled that the Vermont law violated the First Amendment.

Futher, the Court noted that even if the Vermont law were viewed only as a limitation on commercial speech, the law still would have failed to pass constitutional muster, as it did not directly and proportionately advance any of Vermont’s asserted reasons for its necessity: physician privacy, healthcare cost control, or public health generally. First, the Court reasoned that the law could not be said to protect physician privacy, because the law still authorized pharmacies to share prescriber-identifying information with essentially anyone for any reason other than marketing. Second, the Court found that Vermont’s indirect approach to controlling healthcare costs — passing a law that restrained speech in an effort to diminish the perceived influence of detailing — constituted a disproportionate burden on free speech. Third, the Court emphasized that the dissemination of truthful information about pharmaceuticals may actually improve public health, by helping prescribers make more informed decisions. Indeed, the Court observed that far from being either false or misleading — two situations in which the Court has previously permitted limited regulation of commercial speech — there was no evidence that the “detailing” at issue here was anything but truthful. In conclusion, the Court observed that the mere fact that Vermont “finds [certain forms of] expression too persuasive does not permit [Vermont] to quiet the speech or to burden its messengers.”

In dissent, Justice Breyer (joined by Justices Ginsburg and Kagan) argued that although the Vermont law may have adversely affected speech, it did so only as part of a lawful governmental effort to regulate a commercial enterprise. Breyer emphasized that the prescriber information is only retained because pharmacists are required by law to do so, and argued that in such a situation, the First Amendment does not require the Court to apply a heightened level of judicial scrutiny. Breyer further argued that even if “intermediate” scrutiny were applied to the Vermont law (the legal standard that is usually applied to a review of restrictions on purely commercial speech), the Vermont law would have met this test. Breyer concluded that the law directly advanced Vermont’s substantial interest in public health because it would encourage detailing discussions that focused on safety, effectiveness, and cost, rather than on past prescribing history.

Outlook

The Supreme Court’s Sorrell decision is an important development for the pharmaceutical, medical device, biotechnology, and related sectors, because it confirms the legal right of industry sales staff to access prescriber-identifiable data for marketing and other purposes. The Sorrell ruling will almost certainly require a reexamination of similar statutory and regulatory restrictions in other states, particularly if those state laws burden the access to and use of this type of prescriber information.

Finally, it remains to be seen whether Sorrell represents a move toward granting commercial speech greater constitutional protections than it has been afforded in the past. The Court concluded that the Vermont law would have been unconstitutional under either the “intermediate” scrutiny standard traditionally applied to commercial speech regulations or the “heightened scrutiny” standard alluded to by the majority. However, the implication that a new “heightened” standard exists in the commercial speech context — and precisely what such a standard would look like in practice — is a development that merits being monitored closely.

The payment card industry has long been leading the charge in protecting personal data. Governments often react to issues rather than regulate proactively, but private industry must try to anticipate problems before they happen. As such, private standards generally are better at protecting personal information than state statutes and regulations. Businesses always must be two steps ahead of identity thieves in order to protect consumer data and thrive in the marketplace; the price of not doing so is high, as Sony and others have learned and continue to learn. Given this, it’s not a surprise the AG looked to PCI DSS as a new legal standard.

 

In response to these concerns, the National Institute of Standards and Technology (NIST) released guidance earlier this month entitled Smart Grid Cyber Security Strategy and Requirements. The three-volume guidance document is intended for “Smart Grid stakeholders” including vendors of energy information and management services, equipment manufacturers, utilities, system operators, network specialists and regulators. 

• Volume 1 presents a risk assessment framework and describes high-level security requirements;
• Volume 2 focuses on privacy issues in personal dwellings and recommends how entities that participate in the Smart Grid might address these issues; and
• Volume 3 is a compilation of supporting analyses and references.

Kudos to anyone who can decipher the NIST’s “Logical Reference Model” pictured below. Nevertheless, the guidance provides a useful framework for addressing these complex issues.