Yesterday, Bloomberg reported that drugmakers are working with third-party companies to link pharmacy records with online accounts, to tailor drug ads to a person’s particular needs.  In other words, if you buy drug X at the pharmacy – the example drug trotted out in the Bloomberg piece is Viagra – a drugmaker will know you bought drug X, and will tailor online ads accordingly (buy more of drug X! buy drug Y, which treats the same condition as drug X! etc). The links between pharmacy records and online accounts, called “matchbacks,” are made without names changing hands, meaning drugmakers don’t know the names of the patients that they are targeting with particular ads.  But, nevertheless, a number of quotes in the article raise privacy concerns.  And when I tweeted this story, my spouse’s immediate response was “creepy.”

But is it creepy? Or, at least, is it any creepier than how our other purchases are tracked?

Anyone who buys something online – or looks at something online – and then constantly sees ads for that product, should know our shopping is tracked quite closely.  And it’s not limited to online shopping, brick and mortar shopping is tracked too.  A couple of years ago, there was a really interesting New York Times piece about how Target, and other major retailers, collect (online and in-store) data on their shoppers, and use that data to sell shoppers more products.  One of the most salient anecdotes from the story was that Target figured out that a teenager was pregnant – and started sending her baby-related coupons – before her dad knew.

This suggests two things to me.

First, pharmacy records may not provide information that is significantly more sensitive than information derived from records of other kinds of purchases. Bloomberg’s piece says “a prescription for, say, Viagra or Prozac isn’t the same as grocery receipt.”  And maybe that’s right in some sense.  Maybe there’s something really special about health information.  But I bet companies can tell a heck of a lot about you from your grocery receipts.

And second, it’s completely unsurprising that drugmakers are using pharmacy records data to target ads.  In fact, it’s a little surprising to me that this is the first we’re hearing about it, and that Bloomberg reported that the Department of Health and Human Services’s Office for Civil Rights, which enforces HIPAA, was not aware of this practice until Bloomberg contacted them.

According to a Federal Trade Commission attorney quoted in the Bloomberg story, the third-party companies performing the matchbacks may violate privacy laws if they don’t notify consumers that their data is being used for matchbacks.  But assuming this matchback practice is legal, I’m not sure it’s more troubling, from a privacy perspective, than other kinds of shopping surveillance.

That said, there may be some public health concerns here.  Scholars and commentators have long been concerned about direct-to-consumer (DTC) advertising of prescription drugs doing things like driving overuse of medications, driving inappropriate use of medications, and increasing health care spending (see, e.g., this 2007 New England Journal of Medicine piece). I could imagine tailored ads increasing the problems associated with DTC ads, by increasing the effectiveness of promotional campaigns.  But I could also imagine tailored ads decreasing problems associated with DTC ads, by limiting advertising to patients who are more likely to legitimately need a particular drug (based on those patients’ pharmacy records).  It will be interesting to see if tailored ads heighten or mitigate concerns about DTC ads in general, and what regulators choose to do about it, in either scenario.