1 Pharmaceutical Regulatory and Compliance Congress Dean Forbes, Esq. Director of Corporate Privacy...
-
Upload
silvester-bradford -
Category
Documents
-
view
217 -
download
1
Transcript of 1 Pharmaceutical Regulatory and Compliance Congress Dean Forbes, Esq. Director of Corporate Privacy...
1
Pharmaceutical Regulatory and Compliance Congress
Dean Forbes, Esq.Director of Corporate Privacy
Global Compliance and Business PracticesNovember 16, 2004
2
IPPC
What is the IPPC?
• The International Pharmaceutical Privacy Consortium (IPPC) has membership is an association with membership from 17 international pharmaceutical companies.
• The IPPC provides a forum for dialogue on approaches to privacy and information security issues facing the pharmaceutical industry, and to develop strategies and tools for managing and protecting the privacy of personal data.
3
Three Perspectives on Privacy• Consumer:
How do I know that my doctor / pharmacist are treating information about me appropriately?
If I provide my personal information to manufacturer X, can I trust manufacturer X to use my information appropriately?
• Research participant: If I take part in this research project, can I be sure
that health information about me will be treated confidentially?
• Chief Privacy Officer: How do I ensure that my company is compliant
with the myriad of federal and state privacy laws?
4
Consumer’s Perspective
5
GAO Report: Public Ill-Informed• Government Accountability Office issued report in September
on “First-Year Experiences under the Federal Privacy Rule”
• Report concludes that the general public is not well informed about their rights under the HIPAA Privacy Rule Nearly 2/3 of HIPAA complaints received by OCR were
found to fall outside scope of Privacy Rule
• 35% of complaints involved accusations of actions that are not prohibited
• 20% involved entities that are not “covered entities” Covered entity privacy notices are long and confusing
6
NCVHS Hearings
• National Committee on Vital and Health Statistics charged with advising Secretary of HHS on implementation of HIPAA Privacy Rule
• NCVHS Subcommittee on Privacy and Confidentiality held hearings in July 2004 on effect of Privacy Rule on marketing
• Findings conveyed in September 1 letter to HHS Secretary
7
NCVHS Hearings: HPP Witness Witness of Health Privacy Project testified that marketing provisions of Privacy Rule are insufficient in following respects:
1. Retail pharmacies are not required to inform their customers when pharmacies are paid by drug manufacturers to send letters and other communications
2. Some product promotion materials are mailed to individuals without any envelope, thereby disclosing information about the individual’s diagnosis
3. When a covered entity receives compensation from a third party to promote its products or services, this communication should be considered marketing rather than treatment or case management communications
11
Research Participant’s Perspective
12
Recommendations of HHS Secretary’s Advisory Committee on Human Research Protections
• Human subjects research is a complicated endeavor, governed by Common Rule, FDA regulations and now HIPAA
• Existing regulations and policy (pre-HIPAA) required the protection of subjects’ privacy In some areas, the application of HIPAA to the research context
has unnecessarily complicated research activities Cost of research should not be increased unless meaningful
protections are achieved • Complexity adds to confusion, both to subjects and researchers • HHS should consider the overall welfare and interests of
subjects, not simply their privacy interests alone and in the abstract, when revisiting these aspects of HIPAA
13
Responding to Consumers:State Privacy Legislation
14
States Proposing Pharma Privacy Legislation (2003-2004)
• California
• Florida
• Illinois
• Massachusetts
• Nebraska
• New Hampshire
• New York
• North Carolina
• North Dakota
• Texas
• Washington
• Wisconsin
15
Examples of Impact of State Privacy Laws onPharmaceutical Company Activities
Extends HIPAA-Like Requirements (e.g., notice, access, amendment)
Limits Disclosure by Pharma
Impacts Clinical Research
Impacts Pharma DTC
Impacts Pharma Programs Run Through Pharmacies & Health Plans
Impacts Contact with Physicians
16
Extends HIPAA-Like Requirements (e.g., notice, access, amendment)
Example: Adopts HIPAA Privacy Rule requirements but changes definition of covered entity
(a) Notwithstanding any general or special law to the contrary, the Department of Public Health shall adopt 45 CFR Parts 160 and 164, as promulgated on August 14, 2002, in their entirety, with the changes specified in this act.
(b) “§ 160.103 Definitions.” is amended as follows:“Covered entity” means any person who, for commercial, financial or professional gain, monetary fees, dues, or on a cooperative, non-profit or pro-bono basis, engages, in whole or in part, and with real or constructive knowledge, in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information.
17
Limits Disclosure By Pharma
Example: Limits disclosure by pharma; prohibits conditioning of treatment on patient signing an authorization
(a) A pharmaceutical company may not require a patient, as a condition of receiving pharmaceuticals, medications, or prescription drugs, to sign an authorization, release, consent, or waiver that would permit the disclosure of medical information that otherwise may not be disclosed.
(b) A pharmaceutical company may not disclose medical information provided to it without first obtaining a valid authorization from the patient.
18
Impacts Clinical Research
Example: Requires anyone who uses or discloses health information for research to obtain authorization
(a) “Covered entity” means any person who collects or maintains protected health information.
(b) A covered entity may disclose protected health information to a person performing health research, regardless of the source of funding of the research, for the purpose of conducting health research, only if the person performing health research has obtained the express written authorization of the individual.
19
Impacts Pharma DTC
Example: Requires anyone who uses or discloses health information for marketing to obtain authorization
(a) “Covered entity” means any person who collects or maintains protected health information.
(b) A covered entity must obtain express written authorization to use or disclose protected health information for marketing
20
Impacts Pharma Programs Run Through Pharmacies and Health Plans
Example: Defines “marketing” as making a communication about a product in exchange for remuneration(a) “Marketing” means to make a communication about a product or service to encourage recipients of the communication to purchase or use the product or service, but does not include communications made as part of the treatment of a patient for the purpose of furthering treatment unless the covered entity receives direct or indirect
remuneration from a third party for making the communication. (b) A covered entity shall not use protected health information in its possession to provide marketing services to any entity.
21
Impacts Contact with Physicians
Example: Prescriber Data Opt-Out List
(a) “Prescribing data of a physician” means information that sets forth a prescription written by a physician in combination with any item that individually identifies the physician, including a unique identifier assigned for tracking purposes.
(b) A person may not transmit, sell, or release to a third party, in exchange for remuneration, any prescribing data of a physician, if the physician has placed his or her name on the list described in subdivision (c).
(c) The Attorney General shall maintain a DO NOT USE list on its Web site for physicians licensed in the state to place their names. The Attorney General may contract with a third party for the creation or maintenance of the
list.
22
Chief Privacy Officer’s Perspective
23
Privacy Is a Challenge• Requires understanding how personal data is used within the corporation
Pharma companies communicate with consumers through a variety of media and for a variety of purposes. Uses and disclosures of personal information vary by program.
• Requires understanding and keeping up-to-date with myriad of privacy regulations and guidance
US federal privacy laws State privacy laws
• HIPAA • COPPA • California
• TCPA • TSR • Texas
• CAN-SPAM Consumer protection laws Foreign laws
• FTC • EU Data Protection Directive
• State AGs • EU Member State Laws
• Canada PIPEDA
• Etc.
24
Current US Privacy Environment: Snapshot
• Stringent marketing requirements effective in Texas and California. States continue to consider legislation to close HIPAA “gaps” and require “opt-in” for marketing
• Continued interest by DOJ in privacy practices of pharma companies
• Criticism of pharma industry practices by some consumer privacy groups. Litigation pending
25
Pharma Privacy Challenges
• Global organizations
• Complex data
Pharmacovigilance
Medical research
• Complex business operations
• Public and regulatory mistrust of industry
26
Current Environment
• Governments around the world beginning to draft and enact comprehensive privacy and data protection laws to: remedy privacy violations that occurred under
previous authoritarian regimes promote electronic commerce by setting up
uniform rules promote consistency among privacy laws of
trading partners
• Conflicting national privacy laws, however, continue to make compliance and global data transfers challenging
27
European Union
• Myriad of national laws and interpretations
• No one compliance option resolves all issues
• EU expansion in May 2004
• Increased enforcement a reality
29
APEC Privacy Standard• Privacy Subgroup of the E-Commerce Steering
Committee developing Asia-Pacific Privacy Standard, with protocols for handling data transfers
• Released consultation draft of an APEC Privacy Framework in March 2004
• Released Privacy Framework on 29 October 2004• Framework seeks to balance information privacy with
business need and commercial interests• Framework notes:
• unnecessary restrictions adversely impact global economies• free flow of information is essential to sustain economical and
social growth
30
APEC Principles• I. Preventing Harm• II. Notice• III. Collection Limitation• IV. Uses of Personal Information• V. Choice• VI. Integrity of Personal Information• VII. Security Safeguards• VIII. Access and Correction• IX. Accountability
31
Privacy Office
• Role
• Responsibilities
• Organizational Design and Placement
• Access to Senior Management
32
Strategic Considerations
• Organization-wide position on privacy compliance
• Privacy principles
• Regulatory environment
• Risk management
• Influencing environment
33
Coordination
• Reporting developments
• Providing guidance on changes
• Ensuring compliance with emerging requirements
• Conducting privacy training programs
34
Outreach
• Regulators
• Industry associations
• Stakeholders