<p>A new policy proposed by major pharmaceutical companies could potentially compromise the privacy of Americans' medical data, raising concerns about the security of sensitive records.</p>
<p>This initiative is part of an effort by drug manufacturers to mitigate the financial effects of a federal drug discount program on their profits. Critics argue that the changes could expose sensitive patient health information, including data related to contentious cultural issues.</p>
<p>The companies involved, Eli Lilly and Novo Nordisk, announced plans to require pharmacies to submit claims-level patient data to qualify for drug discounts under the 340B program. This federal law mandates that drug companies selling to Medicare and Medicaid at taxpayer expense provide discounts to pharmacies associated with hospitals that serve a high percentage of low-income Americans. Many of these hospitals and pharmacies are located in conservative, rural areas.</p>
<p>While the proposed changes may seem innocuous, the claims-level data required could lead to the disclosure of various specific medical events. This includes diagnoses or treatments for conditions such as cancer, heart disease, depression, and anxiety. Additionally, it could reveal vaccination status, infertility treatments, or other sensitive health information.</p>
<p>Lilly and Nordisk argue that the requirement for healthcare providers to upload patient information to a third-party website is necessary to prevent misuse of 340B discounts. The financial volume of purchases under this program has increased significantly, from $16.2 billion in 2016 to an estimated $66.3 billion in 2024.</p>
<p>Despite the companies' claims that no protected health information will be collected, the new process necessitates the use of 340B IDs, drug types, and prescription numbers, which have been likened to digital fingerprints. Healthcare providers are already subject to strict privacy regulations, while the obligations for pharmaceutical companies regarding this data remain less clearly defined.</p>
<p>As privacy concerns grow across the nation, a 2024 poll by United States of Care indicated that 53% of voters believe Congress should oversee the protection of patient privacy and data. This concern is not limited to specific groups but resonates across the political spectrum.</p>
<p>Cybersecurity issues further complicate the situation. A recent cyberattack on Change Healthcare affected approximately 192.7 million individuals. Second Sight Solutions, responsible for managing 340B data, is owned by a company that previously experienced a significant ransomware attack, exposing data of over 100,000 individuals.</p>
<p>One pharmacist described the data being requested by Lilly and Nordisk as crucial for efficient healthcare delivery, but acknowledged the risks if such data were to fall into the wrong hands.</p>
<p>Hospital groups opposing the proposed changes have primarily focused on the administrative burden rather than privacy issues. Novant Health’s Matthew Webber stated that hospitals would need to outsource new reporting processes, while the American Hospital Association warned that the policy could increase costs and limit access to care for safety-net providers. Rural hospitals, which rely on 340B revenue to offset losses from Medicaid and Medicare, may be particularly affected.</p>
<p>The American Hospital Association has suggested a government-run clearinghouse for handling 340B claims, though this proposal raises its own concerns about data security, as evidenced by past breaches involving federal data.</p>
<p>With the national debt at $40 trillion and growing privacy concerns, the new policy from Lilly and Nordisk may be seen as excessive. If drug manufacturers wish to address their concerns, they need to propose solutions that do not jeopardize the medical histories of Americans.</p>
<p><em>Taylor Millard is a freelance journalist based in Virginia.</em></p>