Amgen Requires Patients in Repatha Copay Program To Surrender Their Privacy

(This story was updated on October 23 with a statement from Amgen. It was again updated on October 27 with new information about Amgen’s patient privacy policy for a second drug, Enbrel.)

(For an important followup to this story please see:  Amgen Takes The Pledge To Respect Patient Privacy)

The tumult over the new cholesterol drugs just got a little more tumultuous. In addition to the existing controversies involving the high cost of the drugs and the fact that their clinical benefit has not yet been demonstrated, it now turns out that in order to afford one of these expensive new drugs some patients will be required to give up their privacy.

Doctors, pharmacists, patients and others are now starting to learn that in order to receive financial assistance from Amgen for its expensive new cholesterol drug Repatha, patients are being required to surrender rights to their personal information, including their personal health information. The information will be freely available, with few restrictions, not only to the company but to unspecified third parties.

“The Amgen privacy policy is much broader than is necessary to achieve the purposes of the copay program and requires, among other things, that patients consent to disclosure of their medical records to unnamed third parties, with no assurances that the information will be kept confidential. I suggest the policy be revised so that patients in financial need can receive assistance without having to agree to such a wholesale waiver of their privacy rights,” said Marilyn Mann, a respected patient advocate who has family members who have familial hypercholesterolemia. She  is also a member of the editorial board of Circulation: Cardiovascular Quality and Outcomes.

The Repatha copay program is part of the larger RepathaReady program which supplies “support services to help you start and stay on Repatha.” The most important feature of the program is a Copay card which gives patients access to the drug for only $5 a month, but the program also includes reminder emails and a free needle-disposal container. But patients can’t register for the program without first authorizing Amgen to use their personal information, as the web site makes clear:

No Effect on Treatment

I understand that I do not have to agree to the uses and disclosures of my personal information contained in this Notice and Authorization. I understand that Amgen, as well as Health Care Providers, cannot require me, as a condition of receiving medications, prescription drugs, treatment or other care, to sign this Authorization. However, I also understand that Amgen cannot provide me with any of the services contained in the Notice and Authorization without my authorization, including but not limited to, my enrollment or continued participation in patient support services. Under these circumstances, I may be responsible for the full costs of my treatment.

This is not a one-time deal:

I understand that Amgen may use my personal information, including my personal health information, for 10 years once I accept this Authorization or for a shorter time period if required by state law.

The agreement specifically states that by agreeing to the terms patients may lose federal HIPAA protection. Further, the company specifically warns that there is nothing to prevent it from sharing your information with third parties:

Information Received from Health Care Providers

I understand that where a Health Care Provider discloses my personal health information to Amgen for the purposes contained in this Notice and Authorization, the personal health information disclosed may not be covered by any federal law relating to the use of my personal health information or how it is disclosed. There is no guarantee that my personal health information received by Amgen from a Health Care Provider might not be released to a third party. I further understand that if a Health Care Provider is disclosing my personal health information on an on-going basis to Amgen, this Authorization only permits Health Care Providers to do so for 1 year once I sign it or a shorter time period if required by state law. By checking this box, I give my permission to use my personal information to receive product and disease-state information from Amgen, its affiliates, service providers, and co-promotion partners. I understand that I may revoke my permission at any time.

In sharp contrast, the corresponding disclosure authorization for Praluent copay program is much less burdensome. (Praluent, manufactured by Sanofi and Regeneron, is Repatha’s only current competitor in the PCSK9 inhibitor category.) Sanofi and Regeneron tell patients that they will use their personal data for some purposes but also specifically state that personal data will be de-identified for some purposes. They specifically state that they will not share identifiable data with third parties: “The Alliance respects your interest in keeping your personal information private. We will not use your personal information for any other purposes nor sell or rent your information to any third parties or mailing lists.”

Earlier this week I spoke with Peter Berger (Senior Vice President of Clinical Research at the North Shore Long Island Jewish Health Care System) about his perspective on working with industry to help find patients. Berger explained that he is generally supportive of industry collaboration. But Berger had sharp words for the Amgen privacy policy when I asked him about it today:

“Amgen’s policy seems to me to be an extraordinary overreach. My concern is that most patients won’t read the small print, and sign to get the discount on their medication without realizing all their rights to privacy they are giving away.  The agreement states that Amgen cannot guarantee that the patient’s private health information– their “entire medical file”–  won’t be released to any third party of Amgen’s choosing; that is inappropriate in my view. It states that the patient’s signature allows Amgen and any partner of its choosing to send the patient promotional materials– advertisements–, by “mail, email, phone…and text”; that too is awful, I believe. The agreement also includes language that by signing the agreement, the patient “authorizes any health care providers, health care plans, pharmacies, pharmaceutical companies, laboratories and/or their contractors (“Health Care Providers”) to disclose any of the patient’s personal health information to Amgen as requested by Amgen” for any of the above purposes! I am surprised that consumer protection agencies, patient advocates, ethicists and the government aren’t all over this. I wish that this would not be allowed, and I hope that Amgen will think better of it and stop this practice voluntarily.”

Asked to comment, Harlan Krumholz (Yale University( said that “Privacy in medicine, despite the protections of HIPAA, is falling the way of the house call. The question is whether people know that by participating in this program that their personal health information may be released to a third party– or whether most people do not notice this language.”

Lauren Weinstein is a technology expert who has long been interested in privacy issues. He has consulted for Google and is the creator of the Privacy Forum. He offered the following comment:

“Amgen’s required authorization agreement is astoundingly broad, especially the bizarre statement that ‘There is no guarantee that my personal health information received by Amgen from a Health Care Provider might not be released to a third party.’ What does this even mean? Are they planning to give away your medical info? Sell it? To whom?  Under what conditions? What about the privacy policies — if any — of those third parties? Or is Amgen trying to cover themselves in case of accidental release? On its face, it sounds like, ‘if you don’t have the money to pay our full inflated prices, you will never have medical privacy again!'”

A Personal Data And Big Data Connection?

Copay cards have traditionally been used by patients to offset their out of pocket costs, but, as Joe Ross (Yale University) wrote in the New England Journal of Medicine, there’s “no such thing as a free lunch.”  In the past the copay cards were used by companies to gain and maintain market share as part of a long-term strategy to maintain profitability.

The Amgen plan, however, may well represent “a completely different strategy,” Ross said in an interview. It appears, he said, the company is “clearly gaining something completely different and important,” very likely a “novel data source.” He speculated that the use of patient data might well be part of the broader strategy (which I wrote about earlier this week) to find more patients by mining new sources of data. It’s “pretty audacious,” said Ross.

In my opinion this move by Amgen represents the next step in the merger of digital technology and biotechnology. I suspect that people on the biological side of things are going to have to learn the lesson that many in the digital world have long absorbed: “If you’ re not paying for the product, you are the product.”

I have asked Amgen to comment on their policy. I have also asked the FH Foundation for a comment. I will update this story when and if I receive these comments.

Update, October 23–

In response to this article Amgen said that it was assessing its privacy policy “to determine whether we can improve it.” The company said that it follows all relevant laws and that its “robust privacy program… ensures that patients’ privacy is respected.” Amgen said that it “does not sell patient personal healthcare information to any third parties.”

Here is the full statement:

“External observers have raised good questions about our privacy policy with regard to Repatha, and as a result we are assessing the privacy notice and authorization to determine whether we can improve it. In the meantime, it is important to make clear for what purposes patient personal healthcare information is collected and how such information is used.   Amgen and our contractors take both the provision of critical medicines and the protection of patient privacy seriously.  We are committed to offering a full range of patient support services and additional product and disease state information recognizing that patients who take our products are battling serious illnesses.   To provide such services requires obtaining personal health information from patients.  Our robust privacy program, however, ensures that patients’ privacy is respected.  Not only are our practices consistent with all federal and state privacy laws, but we are careful only to collect or use information that is necessary to provide the services and to operate the programs the patient chooses to enroll into.   Amgen does not sell patient personal healthcare information to any third parties.  We will work to clarify the privacy authorization statement to assure patients that their privacy is being maintained.”

Privacy expert Lauren Weinstein offered the following response to the Amgen statement:

“Amgen saying that they don’t sell this data to third parties is fine as far as it goes — but it doesn’t go very far. If they make this data available to third parties in any manner — whether sold or not — it’s crucial that those third parties be required to meet at least the same privacy standards — with suitable serious penalities for associatedfailures — as Amgen’s own privacy policy. Otherwise, Amgen’s privacy policy is effectively meaningless. The more parties that are involved in handling or storing this kind of data, the more likely that it’s going to leak or be abused in some manner, sooner or later.”

Update, October 27–

A reader in the comments section pointed out that Amgen has a similar policy for Enbrel, its rheumatoid arthritis drug. Here is the full comment:

“Amgen is also requiring Enbrel patients in their co-pay program for Rheumatoid Arthritis to surrender their privacy. This seems to be a broad change in policy not limited to one single medicine. Amgen also says nothing in the authorization form about its privacy responsibilities or about providing to the patient a list of who received medical information. What is Amgen’s purpose in ignoring patient privacy?.. .”

Here is the full text of the “Privacy Notice and Authorization” section on the Enbrel website:

 “Uses and Disclosure of Personal Information

I authorize Amgen and its contractors (“Amgen”) to use and/or disclose my personal information, including my personal health information, for the following purposes:

To enroll me in and/or continue my participation in Amgen’s ENBREL Support™ program or any other Amgen-affiliated patient support services and related activities (for example, the option to join the ENBREL Sharps Mail-Back Program to receive sharps disposal containers, co-pay card programs, reimbursement assistance programs, drug coverage verification, nurse educator services and disease management support);

To provide me with informational and marketing materials relating to Amgen products and services, and/or my condition or treatment; and/or

To improve, develop, evaluate and continue products, services, materials and programs related to my condition or treatment.

I also authorize any health care providers, health care plans, pharmacies, pharmaceutical companies, laboratories and/or their contractors (“Health Care Providers”) to disclose any of my personal health information to Amgen as requested by Amgen and as necessary for the purposes stated in this Authorization.

I understand that my personal health information includes any information, in electronic or physical form, in the possession of or derived from a health care provider, health care plan, pharmacy, pharmaceutical company, and/or contractor regarding: (1) my medical history, including my entire medical file and complete patient history; (2) my health care plan benefits; (3) limits or restrictions on payments covered by my health care plan policy; and/or (4) my health or my adherence to my treatment.

Expiration, Right to Obtain a Copy and Right to Cancel

I understand that Amgen may use my personal information, including my personal health information, for 10 years once I sign this Authorization or for a shorter time period if required by state law. I also understand that I can cancel this Authorization at any time by calling Amgen at 1-888-436-2735. Once Amgen receives and processes my cancellation, it will not use my personal information going forward; however, I understand that cancelling my Authorization will not affect any use of my personal information that occurred before my request was processed. I further understand that if a Health Care Provider is disclosing my personal health information to Amgen on an on-going basis as authorized herein, my cancellation with Amgen will only be effective with respect to any such Health Care Provider once they actually receive notice of my cancellation from Amgen.

No Effect on Treatment

I understand that I do not have to agree to the uses and disclosures of my personal information contained in this Notice and Authorization. I understand that Amgen, as well as Health Care Providers, cannot require me, as a condition of receiving medications, prescription drugs, treatment or other care, to sign this Authorization. However, I also understand that Amgen cannot provide me with any of the services contained in the Notice and Authorization without my authorization, including but not limited to, my enrollment or continued participation in patient support services. Under these circumstances, I may be responsible for the full costs of my treatment.

Information Received from Health Care Providers

I understand that where a Health Care Provider discloses my personal health information to Amgen for the purposes contained in this Notice and Authorization, the personal health information disclosed may not be covered by any federal law relating to the use of my personal health information or how it is disclosed. There is no guarantee that my personal health information received by Amgen from a Health Care Provider might not be released to a third party. I further understand that if a Health Care Provider is disclosing my personal health information on an on-going basis to Amgen, this Authorization only permits Health Care Providers to do so for 1 year once I sign it or a shorter time period if required by state law.

I understand that I may choose to be contacted by Amgen by mail, email, phone, and/or SMS/text for any of the purposes stated in this Authorization and that such communications may include the use of prerecorded voice messages and autodial systems. I further understand that if I allow Amgen to send me an SMS/text or leave a voice message, any such voice message or SMS/text may contain sensitive information regarding Amgen’s programs and/or my condition or treatment.

– See more at: https://www.enbrel.com/support/sign-up/?service=cc#sthash.hGbVN4gM.dpuf”