Specialty Pharma and Patient Privacy Protection

Continued growth in the specialty pharma sector, due in part to advances in areas such as novel therapies, genomics, and personalized medicine, means protecting patient data must be a top priority. At the same time, if privacy concerns throttle innovation, there will be less data sharing and fewer drugs coming to market.

Specialty pharma is no longer the preserve of larger companies. These days, many companies regardless of size can be considered part of this sector. In fact, small pharma companies, typically those with annual revenues less than $1 billion, represent a growing percentage of newly approved drugs.

In the US market, the specialty sector accounted for 80% of dollar growth for the entire industry. Leading the pack are drugs that treat hepatitis, autoimmune diseases, and cancer. The medicines are approaching 40% of overall spending and 70% of hospital spending. In addition to the US, Japan and Europe make up 88% of global biologics sales and 98% of biosimilars sales. It may not be long until China becomes a major consumer, and competitor.

But as the name suggests, specialty pharma involves large upfront investments which leave many companies short on cash and passionate about cutting costs. Data privacy is also a cost, especially when the sharing of data is often crucial to new drug development. If you don’t invest in data protection, especially the de-identification of data that contain patient information, you may be reluctant to share, making research advances and breakthroughs less likely. 

If you share without legally required protections in place, you run the risk of penalties for violating HIPAA, private law suits from aggrieved patients and costly damage to your reputation. A typical data breach can cost an average of $200 per patient record even if no harm to individuals occurs. (Ponemon Institute, 2011) If you share and use techniques like data masking, you lower the risk of re-identification, but the data may be rendered useless for secondary purposes.

Smaller populations, bigger risks

Another risk for specialty pharma companies is that they deal with smaller populations in their trials. The more studies the better, because quantity and quality of studies lead to more breakthroughs, which produce more medicines, generate greater sales, and make more sick people well again.

The smaller the population, the greater the re-identification risk, even if the data sets are redacted. Because of the greater risk and the overarching goal to comply with federal regulations, there’s even more interest from privacy officers at specialty pharma companies to use tools like data masking even though it means the remaining data are no longer valuable to researchers.

How can these companies remain in legal compliance, share their valuable data, and lower the risk of re-identification to the lowest possible level-realizing that 100% risk free is unattainable? How best to balance the risk of reaping maximum analytic utility with protecting patient privacy?

The role of the privacy officer at the company is one of the keys. The officer approves whether a study can be done based on the ability to protect patient privacy.  The officer wants to say “yes,” to a proposed study but must be assured that patient information is protected. There are sometimes tensions between the privacy officer and the drug brand manager whose interest is getting test results and being in compliance. It’s important for both of them-and company management¾to work together to find the best approach.

Increasingly, that approach is risk-based analysis and and anonymization of patient information.  Available in the market now is a risk-based methodology that preserves data useful to researchers while anonymizing the rest within the optimal risk tolerance of around one percent. It is called the expert determination method, which uses statistical probabilities to oversee the de-identification process to ensure a very low risk of re-identification. 

Expert determination has traditionally been challenging because it required a heavily manual process of risk assessment by a trained expert. Technology now allows for the expert determination method to be automated and scalable which means that more data sets of all sizes can be de-identified and shared with confidence for a wide range of secondary uses. In this regard such tools are well-suited for small drug trials and datasets typical of the development process for specialty medicines.

The tools show the data analyst where the areas of highest risk are in the dataset and then use techniques to lower risk by obfuscating information that can cause re-identification while preserving data points that are valuable for analytics and other secondary purposes. This approach can be tailored to the data owners’ specific requirements, and data is treated in a holistic sense rather than focusing primarily on the math involved in the proprietary algorithms.

There is a cost to acquire and utilize these tools, and it probably exceeds that of cruder methods available in the market. As mentioned earlier, crude gets the job done in terms of compliance, but at a potentially huge cost in diminished data value. For specialty pharma, the expert determination method is like having cake and eating it to. In the end, we need successful companies, continued innovation, patient privacy protection, and healthier people. Today, it’s possible to have all of them together.

Pamela Buffone is Director, Product Management at Privacy Analytics.