Think Flock Was Bad? Big Pharma Is Building a Surveillance State Out of Your Personal Health Records. Forever.

Members of Congress, we have a question for you. When you last filled a prescription back home, whether at the hospital, your neighborhood drugstore or a specialty pharmacy, who did you think could see the record?

Your doctor. Your pharmacist. Maybe your insurer. We doubt you pictured Eli Lilly, Merck, Novartis or GSK. But that is where the record of your prescription is headed. And once a drug company has it, you will never get it back.

At least 20 drug companies now require America's safety-net hospitals and clinics to hand over records of the 340B prescriptions they dispense as the price of a discount Congress already guaranteed. Not only Medicaid claims. Every patient, every payer, every drug, every date of service.

And the demands keep growing. More than a dozen of those companies now reach all the way into the hospital's own pharmacy, and several of them, Merck most recently as of Oct. 1, demand the medical claim as well as the prescription, within 45 days, or the hospital can lose its discounts.

Lilly has already cut off dozens of hospitals that refused. And in July a Republican attorney general, Tim Griffin of Arkansas, sued 13 drug companies and their data vendor over this scheme.

Congress never asked for any of this.

Big Pharma Plays By Its Own Rules

When Congress wrote the 340B statute in 1992, it gave drug companies exactly one tool for checking a hospital's compliance: an audit of the records that bear on duplicate discounts and diversion, conducted under procedures set by the Secretary of Health and Human Services, at the manufacturer's expense.

Nothing in that law requires a hospital to upload its patients' prescriptions to a drug company's data vendor every six weeks. Nothing in it says a drug company may cancel a federally guaranteed discount when the hospital says no. Drug companies read the statute, found nothing that gave them your patients' records, and decided to take them anyway.

Seventy-two of your colleagues, Republicans and Democrats, wrote to Secretary Kennedy on June 29 that these demands extend "beyond the statutory framework established by Congress." He has not answered.

Now consider where the records go. They flow into a private platform called 340B ESP, run by a vendor for the drug companies. The platform's own terms grant that vendor a "worldwide, sublicensable, non-exclusive, royalty-free, perpetual, irrevocable license to collect, process, disclose, create derivative works of and otherwise use" the claims data.

Perpetual. Irrevocable. Derivative works. That is not an audit. That is ownership.

Lilly alone says it has received nearly 800,000 claims. And ownership can change hands. The vendor's parent company is now putting Second Sight Solutions up for sale, Axios reported recently, which means every prescription record in that database, and the license to use it, goes to whoever writes the check. The license says "sublicensable." Now you know why.

Here is what the drug companies will tell you: They never ask for your name. That is true, and it is beside the point.

What they ask for, by the platform's own list, is the prescription number, the date it was written, the date it was filled, the drug, the quantity, the pharmacy and the prescriber. A prescription number and a pharmacy point to exactly one prescription for exactly one person; that is what a prescription number is for. The companies say the number is scrambled before it is sent. A scrambled prescription number is not anonymity, which is why the HIPAA expert who assessed the 340B ESP platform wrote that the data is fully de-identified only "when in Second Sight's control, not when in the hands of the covered entities or pharmaceutical manufacturers."

That finding sits in a formal complaint to the HHS Inspector General. And these are the same companies that already buy prescription records from data brokers to aim their sales forces at your doctor; the Supreme Court decided a case about that trade in 2011.

They do not need your name. They need the key that unlocks the rest, and that is what your hospital is being forced to hand over. Asked what HIPAA exception permits any of it, and how demanding every payer's claims squares with HIPAA's "minimum necessary" rule, which says you disclose only the health information required for the purpose, Lilly had no answer.

Public Backlash

You have seen this movie before. It is playing right now in your districts. Americans of every political stripe have risen up against Flock, the company whose license plate cameras track where millions of people drive. More than 50 cities and counties have torn out the cameras or canceled their contracts. Gov. Greg Abbott paused funding for them in Texas. Gov. Josh Shapiro has invited a bipartisan ban in Pennsylvania.

The country looked at a private company holding a record of everyone's movements and said no.

So which is worse: a camera that knows where you went in your car last Tuesday, or a database that knows what your doctor prescribed for you and why?

Flock, under pressure, cut its data retention to seven days. Big Pharma's license to your health records is perpetual and irrevocable. Flock is a surveillance state built by a tech company with the government's help. Prescription claims data-collection is a surveillance state built by the richest industry in America, aimed at tens of millions of Americans, with Secretary Kennedy holding the door wide open. Flock's cameras already feed software that, the ACLU warns, flags whose driving looks "suspicious." Your health records are headed into Big Pharma's AI data centers the same way, and once they are inside, they will be there forever.

Even though you never voted for this as a member of Congress, when you, your family and your constituents are treated by a 340B hospital or clinic, the prescriptions written there — and, when the drug was administered by the provider, the medical claim behind it, which carries the diagnosis codes and the insurer — can go into Big Pharma's database.

A 340B patient is not necessarily a poor or uninsured patient. Under HRSA's rules, anyone who gets outpatient care at a 340B hospital or clinic and fills the prescription through its pharmacy — or one of its contract pharmacies, which include the big chains and many independent drugstores — is a 340B patient, whatever their insurance. Your, your family's and your constituents' antidepressants. The anxiety medication. The erectile dysfunction prescription. The weight-loss shot. The HIV prevention pill. The addiction treatment. Captured, stored, licensed in perpetuity, and available to the most sophisticated marketing and artificial intelligence operations on earth.

No consent form. No opt-out. And nobody at HHS is even asking the question.

Who gave Eli Lilly the right to your medical records? Not you. Congress wrote a drug discount law. Big Pharma turned it into a data collection scheme, and Secretary Kennedy let them.

Fifty cities just told a camera company that Americans will not be tracked without their consent.

Meanwhile the drug companies walked in through a side door you never built, carrying your records and the records of every constituent you represent. And once your personal health information is inside Big Pharma's surveillance state, you'll never be able to get it out.

340B Matters advocates for the 340B Drug Pricing Program, which enables safety-net hospitals, rural health clinics, and federally qualified health centers to stretch scarce resources to serve vulnerable patient populations.