Consumer Law

Website Collects Medical Data and Uses That Data for Drug Company Solicitations

By Jeff Sovern

by Jeff Sovern

Today's Times includes Online Age Quiz is a Window for Drug Makers, about a web site, RealAge, which tells you your "biological age" if you answer some 150 questions and offers suggestions for reducing that age.  Sounds great. But, the article explains, the information collected is then used to identify patients who might be candidates for medications, and the company sends these patients emails sponsored by drug companies that sell the medications.  Some excerpts:

?Our primary product is an e-mail newsletter series focused on the undiagnosed at-risk patient, so we know the risk factors if someone is prehypertensive, or for osteoarthritis,? said Andy Mikulak, the vice president for marketing at RealAge. ?At the end of the day, if you want to reach males over 60 that are high blood pressure sufferers in northwest Buffalo with under $50,000 household income that also have a high risk of diabetes, you could,? he said.

RealAge?s privacy policy does not specifically address the firm?s relationship with drug companies, but does state, in part, ?we will share your personal data with third parties to fulfill the services that you have asked us to provide to you,? and it adds test results to its database only when respondents become RealAge members. Some critics, however, charge that consumers do not have enough information when they join.

?Literally millions of people have unknowingly signed up,? said Peter Lurie, the deputy director of the Health Research Group at Public Citizen, a public interest group in Washington. The company, he said, ?can create a group of people, and hit them up and create anxiety even though the person does not have a diagnosis.?

The article explains that the company does not provide the drug companies personally identifiable information.  But this business model strikes me as meriting FTC review.  I don't think the privacy policy is clear enough about what the company is doing with the information, especially given the sensitivity of medical information.  See Weld v. CVS Pharmacy, Inc., 1999 WL 494114 (Mass. Super. Ct. 1999) (noting that consumers "arguably possess a greater expectation of privacy as to the use of their names in connection with their prescriptions and medical information . . . ."). And then there's the widely-held suspicion that few consumers even read privacy policies, and many misinterpret them.  For example, one survey found that 75% of American adult users of the internet believe that the fact that a web site has a privacy policy means that the site won't reveal their information to others.  See Joseph Turow, Lauren Feldman, and Kimberly Meltzer, Open to Exploitation: American Shoppers Online and Offline 3 (2005).  If you can give RealAge your information without actually reading their privacy policy, as is common on web sites, which usually permit you to read the privacy policy only if you click on it, RealAge can probably tell how many of its members actually go to its privacy policy page, and if it's not very many, and the company knows that, it raises questions about whether this conduct is unfair within the meaning of the FTC Act.  On top of that, their privacy policy goes on forever, raising questions about how many people who set out to read it make it through the whole thing.  RealAge also reserves the right to change its privacy policy.  My own opinion is that before seeking private medical information, the company should make clear even to those who don't click on the privacy policy what it will do with that information.  But then, I've taken the view, which thus far the FTC has not embraced, that collecting and selling consumer information without the consumer's knowledge or consent violates the FTC Act and UDAP statutes.  See Jeff Sovern, Protecting Privacy with Deceptive Trade Practices Legislation, 69 Fordham L. Rev. 1305 (2001).  

Full post as published by CL&P Blog on March 26, 2009 (boomark / email).