The tumult over the new cholesterol drugs just got a little more tumultuous.
In addition to the existing controversies involving the high cost of the drugs and the fact that their clinical benefit has not yet been demonstrated, it now turns out that in order to afford one of these expensive new drugs some patients will be required to give up their privacy.
Doctors, pharmacists, patients and others are now starting to learn that in order to receive financial assistance from Amgen for its expensive new cholesterol drug Repatha, patients are being required to surrender rights to their personal information, including their personal health information. The information will be freely available, with few restrictions, not only to the company but to unspecified third parties.
"The Amgen privacy policy is much broader than is necessary to achieve the purposes of the copay program and requires, among other things, that patients consent to disclosure of their medical records to unnamed third parties, with no assurances that the information will be kept confidential. I suggest the policy be revised so that patients in financial need can receive assistance without having to agree to such a wholesale waiver of their privacy rights," said Marilyn Mann, a respected patient advocate who has family members who have familial hypercholesterolemia. She is also a member of the editorial board of Circulation: Cardiovascular Quality and Outcomes.
The Repatha copay program is part of the larger program which supplies "support services to help you start and stay on Repatha."
The most important feature of the program is a copay card which gives patients access to the drug for only $5 a month, but the program also includes reminder emails and a free needle-disposal container. But patients can't register for the program without first authorizing Amgen to use their personal information, as the web site makes clear:
No Effect on Treatment
I understand that I do not have to agree to the uses and disclosures of my personal information contained in this Notice and Authorization. I understand that Amgen, as well as Health Care Providers, cannot require me, as a condition of receiving medications, prescription drugs, treatment or other care, to sign this Authorization. However, I also understand that Amgen cannot provide me with any of the services contained in the Notice and Authorization without my authorization, including but not limited to, my enrollment or continued participation in patient support services. Under these circumstances, I may be responsible for the full costs of my treatment.
And this is not a one-time deal:
I understand that Amgen may use my personal information, including my personal health information, for 10 years once I accept this Authorization or for a shorter time period if required by state law.
The agreement specifically states that by agreeing to the terms patients may lose federal HIPAA protection. Further, the company specifically warns that there is nothing to prevent it from sharing your information with third parties:
Information Received from Health Care Providers
I understand that where a Health Care Provider discloses my personal health information to Amgen for the purposes contained in this Notice and Authorization, the personal health information disclosed may not be covered by any federal law relating to the use of my personal health information or how it is disclosed. There is no guarantee that my personal health information received by Amgen from a Health Care Provider might not be released to a third party. I further understand that if a Health Care Provider is disclosing my personal health information on an on-going basis to Amgen, this Authorization only permits Health Care Providers to do so for 1 year once I sign it or a shorter time period if required by state law. By checking this box, I give my permission to use my personal information to receive product and disease-state information from Amgen, its affiliates, service providers, and co-promotion partners. I understand that I may revoke my permission at any time.
In sharp contrast, the corresponding disclosure authorization for Praluent copay program is much less burdensome. (Praluent, manufactured by Sanofi and Regeneron, is Repatha's only current competitor in the PCSK9 inhibitor category.)
Sanofi and Regeneron tell patients that they will use their personal data for some purposes but also specifically state that personal data will be de-identified for some purposes. They specifically state that they will not share identifiable data with third parties: "The Alliance respects your interest in keeping your personal information private. We will not use your personal information for any other purposes nor sell or rent your information to any third parties or mailing lists."
Earlier this week I spoke with (Senior Vice President of Clinical Research at the North Shore Long Island Jewish Health Care System) about his perspective on working with industry to help find patients. Berger explained that he is generally supportive of industry collaboration. But Berger had sharp words for the Amgen privacy policy when I asked him about it today:
"Amgen's policy seems to me to be an extraordinary overreach. My concern is that most patients won't read the small print, and sign to get the discount on their medication without realizing all their rights to privacy they are giving away. The agreement states that Amgen cannot guarantee that the patient's private health information -- their "entire medical file" -- won't be released to any third party of Amgen's choosing; that is inappropriate in my view. It states that the patient's signature allows Amgen and any partner of its choosing to send the patient promotional materials -- advertisements -- , by "mail, email, phone ... and text"; that too is awful, I believe.
The agreement also includes language that by signing the agreement, the patient "authorizes any health care providers, health care plans, pharmacies, pharmaceutical companies, laboratories and/or their contractors ("Health Care Providers") to disclose any of the patient's personal health information to Amgen as requested by Amgen" for any of the above purposes! I am surprised that consumer protection agencies, patient advocates, ethicists and the government aren't all over this. I wish that this would not be allowed, and I hope that Amgen will think better of it and stop this practice voluntarily."
Asked to comment, , of Yale University said that "Privacy in medicine, despite the protections of HIPAA, is falling the way of the house call. The question is whether people know that by participating in this program that their personal health information may be released to a third party -- or whether most people do not notice this language."
Lauren Weinstein is a technology experts who has long been interested in privacy issues. He has consulted for Google and is the creator of the Privacy Forum. He offered the following comment:
"Amgen's required authorization agreement is astoundingly broad, especially the bizarre statement that 'There is no guarantee that my personal health information received by Amgen from a Health Care Provider might not be released to a third party.' What does this even mean? Are they planning to give away your medical info? Sell it? To whom? Under what conditions? What about the privacy policies -- if any -- of those third parties? Or is Amgen trying to cover themselves in case of accidental release? On its face, it sounds like, 'if you don't have the money to pay our full inflated prices, you will never have medical privacy again!'"
A Personal Data And Big Data Connection?
Copay cards have traditionally been used by patients to offset their out of pocket costs, but, as Joe Ross (Yale University) wrote in the , there's "no such thing as a free lunch." In the past the copay cards were used by companies to gain and maintain market share as part of a long-term strategy to maintain profitability.
The Amgen plan, however, may well represent "a completely different strategy," Ross said in an interview. It appears, he said, the company is "clearly gaining something completely different and important," very likely a "novel data source." He speculated that the use of patient data might well be part of the broader strategy () to find more patients by mining new sources of data. It's "pretty audacious," said Ross.
In my opinion this move by Amgen represents the next step in the merger of digital technology and biotechnology. I suspect that people on the biological side of things are going to have to learn the lesson that many in the digital world have long absorbed: "If you' re not paying for the product, you are the product."
I have asked Amgen to comment on their policy. I have also asked the FH Foundation for a comment. I will update this story when and if I receive these comments.
Update, Oct. 23
In response to this article Amgen said that it was assessing its privacy policy "to determine whether we can improve it." The company said that it follows all relevant laws and that its "robust privacy program... ensures that patients' privacy is respected." Amgen said that it "does not sell patient personal healthcare information to any third parties."
Here is the full statement:
"External observers have raised good questions about our privacy policy with regard to Repatha, and as a result we are assessing the privacy notice and authorization to determine whether we can improve it. In the meantime, it is important to make clear for what purposes patient personal healthcare information is collected and how such information is used. Amgen and our contractors take both the provision of critical medicines and the protection of patient privacy seriously. We are committed to offering a full range of patient support services and additional product and disease state information recognizing that patients who take our products are battling serious illnesses. To provide such services requires obtaining personal health information from patients. Our robust privacy program, however, ensures that patients’ privacy is respected. Not only are our practices consistent with all federal and state privacy laws, but we are careful only to collect or use information that is necessary to provide the services and to operate the programs the patient chooses to enroll into. Amgen does not sell patient personal healthcare information to any third parties. We will work to clarify the privacy authorization statement to assure patients that their privacy is being maintained."
Update, Oct. 27:
CardioBrief has learned that Amgen has implemented a similar program for Enbrel (etanercept), its rheumatology drug. Individuals signing up for the must agree to a "privacy notice" with provisions like those stated for Repatha.