Public Comments: August 2007 – iPledge Program / FDA ….. World Privacy Forum testifies at FDA advisory committee hearing on the iPledge program; requests attention to privacy issues
or Read comments below
Written statement of Pam Dixon, executive director, World Privacy Forum
Hilton Washington DC North/Gaithersburg,
to The FDA Dermatologic and Ophthalmic Drugs Advisory Committee and the Drug Safety and Risk Management Advisory Committee Regarding rivacy and the iPledge Program
620 Perry Pkwy
August 1, 2007
The World Privacy Forum is a non-profit public interest research group. We focus our work on in-depth analysis of privacy issues. We also conduct original research. Health care privacy is a core area for the World Privacy Forum. 
Our principal concern with iPledge is that the FDA has failed to set privacy standards for the iPledge program  or for similar programs that mandate patient tracking. As a result, the iPledge registry has privacy shortcomings that may potentially impact the individuals who take Accutane or Isotretinoin generics.
I. Analysis of privacy issues in the iPledge Program
The World Privacy Forum has analyzed the iPledge program, and has found substantial privacy issues. The specific areas that need to be improved include the following items:
First, the original iPledge marketing clauses allow marketing through an intermediary and give Covance the ability to contact patients on behalf of a marketer or for any marketing purposes whatsoever. Here is what that policy provides:
“We provide the information to trusted partners who work on behalf of or with iPLEDGE under confidentiality agreements. These companies may use your personal information to help iPLEDGE communicate with you about offers from iPLEDGE and our marketing partners. However, these companies do not have any independent right to share this information.” 
Any possible use of iPledge information for marketing should be prohibited. There is no reason iPledge information should be treated differently in this regard than any other patient information covered by the HIPAA marketing limitations.
B. Patient information
All patient educational materials should address privacy issues clearly, directly, and consistently. Patients should be told the legal status of the protection of their data, that the data is not protected by HIPAA, and should be told of any state law privacy restrictions that apply. We note that in the 16 -page printed patient introductory brochure, there is no mention of privacy or confidentiality.
Currently, the only place a patient can find official information about whether or not HIPAA applies to iPledge is if he or she happened to read the Prescriber section of the iPledge FAQ on the FDA web site. This is insufficient explanation for patients.
C. Physician information
D. Pregnancy registry
Specifically, in the Patient and in the Prescriber Isotretinoin kits, the word confidential is used a number of times to describe certain aspects of the iPledge pregnancy registry. This occurs in the 23-page patient guide to Isotretinoin on page 9.  The use of confidential also occurs in the 32-page guide to best practices for Isotretinoin.  Because the FDA has determined that HIPAA does not apply to the program, and because the FDA has not set privacy standards, the term confidential does not have a clear meaning. Patients have no way of knowing exactly what confidential means, and the FDA has not mandated a way for patients to understand precisely how their information can be used and disclosed. Covance’s reservation of the ability to use patient information for marketing is not likely to be consistent with the average patient’s definition of confidentiality for health information.
Given the sensitivity of the pregnancy registry information as well as the potential value of pregnancy status information to marketers, patients deserve clear, consistent and transparent statements about how the pregnancy registry data will be used, stored, and shared.
E. Patient informed consent
II. Recommendations for correction
We do not know what changes will be proposed by Covance to the iPledge program at the August 1, 2007 hearing. We hope, however, that the FDA will carefully consider the issues we raise here and correct the lack of standards and oversight in this program, as well as correct the specific issues we discuss briefly here.
The following are our recommendations for correcting the immediate problems in the iPledge program.
- The FDA needs to make its position on HIPAA and RiskMAPs clear to physicians in its printed best practices for physicians. If prescribers do not have a clear and well-informed idea of privacy protections afforded to patients, then their patients will not be able to obtain accurate information from the best source of information about program consequences. It is unreasonable to ask physicians to go to a web site to search for an FDA statement about the lack of applicability of HIPAA.
- The privacy standards governing the iPledge pregnancy registry need to be greatly clarified for physicians and for patients. What does the word confidential mean in this context? If the pregnancy registry does not fall under HIPAA, then patients and physicians need to be told this, and very clear explanations of the precise standards that will applied need to be given to patients and physicians in writing, in print format (not just on the web) prior to patient sign-up in the program.
World Privacy Forum
 See <http://www.worldprivacyforum.org>.
 Patients who go on the medication Accutane or its generics must register in a mandatory, computer-based drug registry and patient tracking program called iPledge. The program began March 1, 2006.
 The FDA’s iPledge Program Frequently Asked Questions as of October 6, 2006 states: “Under HIPAA, covered entities are defined as three groups: health plans, health care providers and health care clearinghouses. Pharmaceutical manufacturers are not included in any of these groups, therefore, the manufacturers of isotretinoin are not covered entities under HIPAA and HIPAA does not apply to the iPLEDGE Program.” See <http://www.fda.gov/cder/drug/infopage/accutane/FAQ200610.pdf> at 13.
 See Guide to Isotretinoin for Female Patients who can get pregnant, p. 9: “The confidential iPLEDGE Program Pregnancy Registry is a way to collect that information” and “Your doctor will tell you about the confidential iPLEDGE Program Pregnancy Registry.”
 See iPLEDGE Program Guide to Best Practices (Prescriber Guide), p. 14: “Female patients of childbearing potential: Inform patient about confidential iPLEDGE Program Pregnancy Registry (bullet 8); See also footnote on same page: “Refer to page 24 for information about reporting pregnancies to the confidential iPLEDGE Program Pregnancy Registry.” See also p. 24, “Reporting Pregnancy: The iPLEDGE Program Pregnancy Registry /The iPLEDGE Program Pregnancy Registry collects data on pregnancies that occur in female patients who become pregnant while taking isotretinoin or within 1 month of their last dose. Data from the registry are reported to the FDA and are used to assess the effectiveness of the iPLEDGE program. The data are also used to evaluate further ways to reduce fetal exposure. Information gathered in the iPLEDGE Program Pregnancy Registry will be used for statistical purposes only and will be held in the strictest confidence.”