IQVIA: The Healthcare Data Giant the FTC Examined for Selling Patient-Level Prescription Data Without Adequate Privacy Protections

IQVIA Holdings Inc., the world's largest health data and analytics company, faced Federal Trade Commission scrutiny over its collection and sale of patient-level prescription data — information about which drugs specific patients had been prescribed, at what doses, for what conditions, and through which pharmacies — questioning whether the company's privacy protections adequately reflected the sensitivity of this health information and whether patients whose data was being commercialized had meaningfully authorized those data flows or received any benefit from them.DOCUMENTED

The FTC's examination of IQVIA was part of the agency's broader focus on the commercial health data market — a sector that has grown substantially as the digitization of pharmacy and prescribing records has made large-scale aggregation and sale of patient-level health information technically and commercially feasible, creating a market whose privacy implications have received increasing regulatory attention as awareness of the scale and sensitivity of the underlying data has grown.

The Prescription Data Market

IQVIA's core business involves aggregating prescription dispensing data from pharmacies and other sources, linking that data to create longitudinal patient-level records of medication use, and selling analytics derived from that data to pharmaceutical companies, health insurers, benefit managers, and other healthcare industry participants. The pharmaceutical industry uses this data for sales force management — identifying which physicians are prescribing which drugs at what volumes — and for market research, patient support program targeting, and competitive intelligence. Health insurers and pharmacy benefit managers use similar data for formulary management and utilization review.REVIEWED

The commercial value of this data market is substantial: IQVIA is a large-cap public company whose data and analytics segment generates billions of dollars in annual revenue, reflecting the pharmaceutical industry's dependence on granular prescribing and patient data for commercial operations. From the patient's perspective, this market involves the commercialization of information about the most sensitive dimension of their medical care — what conditions they are being treated for and what drugs their physicians are prescribing — in a transaction from which patients typically receive no notice, compensation, or opportunity to opt out.DOCUMENTED

The Privacy Gap in the Prescription Data Model

Prescription data flows through a chain of entities — prescribing physicians, pharmacies, pharmacy benefit managers, and data aggregators like IQVIA — in ways that are permitted by various exceptions to the Health Insurance Portability and Accountability Act and by contractual relationships within the healthcare supply chain. HIPAA allows covered entities to share patient data for treatment, payment, and healthcare operations purposes, and the chain of relationships through which prescription data reaches companies like IQVIA typically relies on these exceptions to justify the data flows without individual patient authorization.REVIEWED

The FTC's concern is not solely about HIPAA compliance — the agency's authority extends to unfair and deceptive practices regardless of whether HIPAA applies, and the FTC has taken the position that the commercialization of sensitive health data without meaningful patient notice or control can constitute an unfair practice under the FTC Act even when the data flows are technically permitted under HIPAA's framework. The agency's scrutiny of IQVIA reflected this broader view that the commercial health data market has grown beyond what patients reasonably expect when they fill a prescription, and that the regulatory framework governing that market may not adequately protect patient privacy interests.

A patient who fills a prescription at their pharmacy understands they are sharing information with their doctor and their insurer. They typically do not understand that the same information is being sold to pharmaceutical companies who will use it to market to their physician.

The Consent and Control Question

The fundamental patient rights question in the commercial prescription data market is whether individuals should have notice and control over the use of their health information for commercial purposes beyond their direct care. The opt-out mechanisms that exist in some state frameworks — most notably Vermont's data privacy rule for prescription data before it was struck down by courts — reflect a policy judgment that patients should be able to limit the commercial use of their health information. The FTC's examination of IQVIA touched on whether federal consumer protection authority provides a basis for requiring notice and opt-out mechanisms that the commercial health data market has not voluntarily adopted.REVIEWED

The stakes of this policy question extend well beyond prescription data to the broader commercial health data market, which includes claims data, genomic information, fitness and wearable device data, and the emerging category of consumer health data collected by apps and retail health services that may not be subject to HIPAA at all. The FTC's engagement with IQVIA is part of a broader regulatory conversation about what patient privacy in a data-intensive healthcare system should look like — a conversation that is likely to shape the commercial health data market's regulatory environment for years to come.

The Patient's Perspective on Health Data Commercialization

From the patient's vantage point, the commercialization of prescription data by companies like IQVIA is largely invisible. A patient who fills a prescription at their pharmacy does not receive notice that their prescription information — combined with their other dispensing history — will be sold to pharmaceutical companies and other buyers as part of a commercial data product. The patient's consent to share information with their pharmacy for the purpose of filling the prescription does not constitute meaningful consent to the commercial use of that information in ways that were never disclosed to them. As consumer awareness of data privacy issues has grown, this invisibility has become an increasing source of public concern about the commercial health data ecosystem — concern that has motivated both state legislative activity and federal regulatory interest in whether the existing framework adequately protects patient privacy in an environment where the technical capacity to aggregate and commercialize health data has far outpaced the regulatory frameworks that were designed when health data sharing occurred at much smaller scale. The FTC's engagement with these issues, and its authority to address unfair and deceptive practices in data markets, positions the agency as a potential source of federal standards for commercial health data use that could complement or supplement HIPAA's framework in the areas where that framework's gaps are most consequential for patient privacy.

Have documents relevant to this story? Reach us through our tips channel.