Protecting HTC Data Requires Reading the Fine Print
By Mike Glomb and Elizabeth (Issie) Karan 

Under the auspices of 340B Program compliance, manufacturers recently requested extensive data from covered entities related to drugs dispensed through contract pharmacies. Two manufacturers, Merck and Sanofi, are using the same third-party vendor to gather, deidentify, and transmit the data. The platform is called 340B ESP and is operated by a Silicon Valley startup, Second Sight Solutions (Second Sight).  
 
The Hemophilia Alliance is encouraging hemophilia treatment centers (HTCs) to request an exception from reporting from the manufacturer directly. However, Second Sight’s “Terms of Use” provide a practical example of why careful consideration always is necessary before releasing any data to a third party. 
 
Data related to drug transactions is both protected health information, subject to the Health Insurance Portability and Accountability Act (HIPAA), and valuable. The Terms of Use give Second Sight, a “royalty-free, perpetual, irrevocable license” to disclose and sub-license all the data the covered entity submits. This essentially allows Second Sight to monetize covered entities’ data without any compensation to covered entities. In addition, under these Terms of Use, covered entities must: waive the option for a class action lawsuit; submit an invoice number with every claim; submit data on all drugs sold by the manufacturer (not just those related to Medicaid); promise data is accurate; and submit and correct data in the timeframes selected by 340B ESP. Second Sight also disclaims any HIPAA liability in the event of a privacy breach.  
 
In its current form, the Second Sight’s Terms of Use appear to be patently unfair, give manufacturers and Second Sight competitive advantages, do not appropriately compensate covered entities for their data, and create unnecessary administrative burden for covered entities. However, Second Sight is not the only vendor seeking to make money off covered entities’ data. As such, HTCs should always view data requests skeptically and obtain legal counsel before signing any data use agreements or transmitting data to a third party.