When Blue Cross and Blue Shield chose Rite Aid as a preferred pharmacy, the health insurance company also turned over the names of its members to the drugstore chain.
Rite Aid wants to send the 570,000 members regular mailings to market products and to offer discounts.
Although individuals can opt out of the promotion, this little-noticed arrangement has aroused privacy concerns among some subscribers. And now state officials.
They oppose health insurance companies sharing information, even names and addresses, with outside businesses.
Colleen Bogdan's angry reaction is shared by others.
"I'm scared. I signed up for health insurance with the expectation of privacy," said Mrs. Bog
dan of Amherst. "Instead, I feel as though they're selling my name to someone else."
Privacy concerns aside, the ill feeling refuses to die down over the decision to limit where the health insurers' members can fill prescriptions.
Not just individuals are upset. As might be expected, so are drugstore competitors.
The company that owns Vix drugstores has filed a complaint in federal court here, alleging that Blue Cross and Blue Shield violated antitrust laws by directing members to use a select group of pharmacies that excludes Vix.
Ohio-based Drug Emporium claims the deal will restrict it from doing business with a significant portion of the region's pharmacy customers and could result in a revenue drop of $10 million a year because of fewer sales of prescriptions and products.
Blue Cross and Blue Shield stresses that it is sharing members names and addresses, not medical information. But some subscribers find troubling the sharing of any information.
"Please consider this letter as putting you and Community Blue on notice that I do not give you permission to release any type of information to anyone without my written request," wrote one unhappy subscriber in a letter received by the insurer and the state Office of the Attorney General.
"I would expect a higher level of respect from a mail order catalog house," added the letter-writer.
Disgruntled subscribers say they expect total privacy from a health insurance company, just as they do from a doctor.
They oppose secondary use of information by a health insurer -- gathering information for one purpose and using it for unrelated purposes -- especially for marketing.
Perhaps more than anything, they fear the potential for abuse.
"Are they going to know my prescription habits someday and then market me products and services based on the drugs I use?" asked Mrs. Bogdan. "If that's where we're headed, how do you know what they're telling you is the best thing for you?"
In an age of linked computers, managed care and the widespread collection of data in electronic form, Mrs. Bogdan and others say they have seen their fears realized elsewhere and figure it could happen here.
Customers' privacy concerns
Last year, for instance, CVS Corp. got caught up in controversy when it and Giant Food Inc. sent confidential prescription information to a Massachusetts company that tracks customers who don't refill prescriptions. The company used the data to send personalized letters that reminded customers to keep taking their medicine or pitch new products to treat the customer's condition.
The effort raised questions about confidentiality from patients and privacy experts because, like an increasing number of incidents, it blurred the line between marketing and medicine.
CVS and Giant defended the effort, saying it could help patients comply with their treatments. But they stopped the mailings after receiving many complaints.
Nationwide, there is growing concern among consumers over drug companies using prescription records to market directly to patients instead of doctors, pharmacy benefit managers steering patients toward prescription choices, and employers mining medical data before hiring individuals.
"We're seeing a large increase in complaints across the country. With powerful computers, it is easier to create customer profiles and to engage in aggressive marketing," said Beth Givens, project director of Privacy Rights Clearinghouse, an organization that keeps tabs on privacy issues.
The Blue Cross-Rite Aid deal
In June, Blue Cross and Blue Shield announced that their members would face restrictions on where they could fill prescriptions. HealthNow New York Inc., the parent company of Blue Cross and Blue Shield, applied the new policy to all of its divisions in New York State, saying it sought to control escalating drug costs.
Originally, Blue Cross and Blue Shield limited the network to Rite Aid, Tops Markets and select independent pharmacies.
After receiving many complaints, Blue Cross and Blue Shield later added Wegmans, Kmart and Wal-Mart stores, as well as all independent pharmacies, in a compromise reached with state Attorney General Eliot Spitzer.
The Eckerd, Walgreens, CVS and Vix pharmacy chains remain excluded from the network.
Talks with Spitzer also led Blue Cross and Blue Shield to agree to mail letters recently to members, telling them they could opt out of Rite Aid's "Rite Rewards" discount and marketing program.
"We began with the presumption that consumers should be the owners of their personal information unless they make an affirmative decision otherwise," said Spitzer.
Still, Spitzer said he's not entirely satisfied with the compromise.
"The state needs to come up with a policy that returns to consumers control of their information. I don't want the Blues sharing this information with others to market products," he said.
Blue Cross and Blue Shield as well as Rite Aid consider their arrangement a "partnership" and view the Rite Rewards program as a benefit for members, not an invasion of privacy.
At its heart, the Rite Rewards program provides discounts on Rite Aid products and mailings about other special deals and services.
Customers also receive a card that's swiped at the cash register when they make purchases. Rite Aid, which offers the discount program in selected markets, then uses the sales information to customize mailings to shoppers based on the type of products they buy most often.
Officials of Rite Aid and Blue Cross and Blue Shield say they are talking about creating health-related programs to help Rite Rewards users educate themselves about medical conditions and how best to treat them.
Members can opt out
All members of Blue Cross and Blue Shield will receive a Rite Rewards card unless they choose to opt out of the promotion. If members request, Rite Aid will provide discounts on its brand of products but not send out the targeted mailings, according to Jody Cook, spokeswoman for Rite Aid.
"We see what we're doing as an additional benefit to customers," she said.
Blue Cross and Blue Shield had good intentions, said spokeswoman Linda Soltis.
"This is a community that likes coupons and discounts. That was the context of our thinking when we came up with this," she said.
There is no federal law telling health-related businesses what they can do with medical information. Instead, privacy protection has been left to a patchwork of state laws.
"All bets are off today because information is flowing inside and outside of HMOs -- to benefit managers, pharmacy chains and other organizations -- all as a way to administer the health plans," said Jeffrey Gold, special counsel in the attorney general's health care bureau.
To Gold, the problem centers around the waivers health insurance subscribers sign when they obtain coverage.
He said health insurance companies avoid violating state confidentiality prohibitions because they share information with groups whose work can be considered part of a connected chain for managing subscribers' benefits or processing their claims.
"The waivers are so broad that they open the door to use information for anything an HMO feels it needs to do for business," Gold said.
Spitzer said he envisions unveiling proposals on a range of medical privacy issues by the end of the year, but he and Gold said fashioning laws will be difficult.
Health insurers argue that data can be used to benefit subscribers by, for example, pinpointing combinations of medications that pose a danger, suggesting lower-priced drugs that are as effective or customizing health information to patients with certain ailments.
In addition, information-sharing goes beyond health care.
Colleges sell lists of alumni to marketers. Government agencies, including the state Department of Motor Vehicles, sell names of drivers to organizations.
"The genie is out of the bottle," Gold said. "We have to find a way to balance the need for privacy with the need of companies to collect data for business, but there's no agreement yet on where to draw the line."
Suit charges consumers hurt
The privacy concerns erupted with the decision by Blue Cross and Blue Shield to limit where members could fill prescriptions, a move that generated the complaint filed Aug. 19 in U.S. District Court in Buffalo.
Drug Emporium contends the restrictions will hurt consumers as competitors locked out of the network raise prices to maintain revenues, and the network pharmacies increase prices to customers not in Blue Cross and Blue Shield.
Drug Emporium bought the 12-store Vix Deep Discount drugstore chain in February from Tops Markets for $31.5 million.
The complaint also alleges that Tops breached its contract with Drug Emporium by selling Vix without disclosing that it knew of the plan to form a limited drugstore network.
"Drug Emporium says its prescription sales are already dropping and it fears losing customers permanently," said Rodney O. Personius, a local attorney with Brown & Kelly involved in the case.
The parties are scheduled to report back to court Sept. 7. Based on the information presented at that session, said Personius, Drug Emporium may decide to seek a preliminary injunction to stop Blue Cross and Blue Shield from instituting the new network on Oct. 1.
Officials of Blue Cross and Blue Shield, as well as Tops, said they would not comment on pending litigation.
Representatives of CVS and Walgreens said their companies were not involved in the case, but the CVS spokesman said his pharmacy chain was considering all options. Eckerd did not return a telephone call for comment.