Lilly admits e-mail privacy lapse
July 4, 2001
Drugmaker Eli Lilly and Co. last week inadvertently divulged the e-mail addresses of patients with depression, bulimia or obsessive-compulsive disorder, company officials said Tuesday.
A June 27 e-mail message listed the addresses of more than 600 people who had signed up for an Internet service provided by Lilly to routinely send them reminders about taking the company's Prozac medicine or attending to other matters.
Over the past two years, such messages were addressed only to individuals. Last week's message, announcing the end of the program, was sent to every participant and included all of their e-mail addresses because of a computer programming error, Lilly spokeswoman Laura Miller said.
Miller said the company has taken steps to prevent a recurrence, including a temporary halt to sending e-mail to patients. "We apologize for this error." Miller said Lilly considers privacy a priority: "We take it very seriously."
Privacy specialists said the lapse demonstrates the difficulties of protecting sensitive information collected and shared by computers on the Interent.
"This shows the danger of the massive amounts of data that are being collected" without adequate safeguards, said Evan Hendricks, publisher of Privacy Times. "Most organizations have not put enough work into ensuring sensitive data is handled properly."
"These events set a dangerous precedent. Eli Lilly had a duty of care and a duty under the Federal Trade laws to protect the confidentiality of the medical consumers who used (its) product."
Several patients also have complained to the company that they expected the e-mails to be confidential.
One patient, a 30-year-old graduate business student in New York, said he found the messaging system at www.prozac.com, a Lilly marketing site on the World Wide Web, when he was looking for more information about depression.
Until last week's disclosure, he said, he liked receiving the notes and trusted Lilly to protect the fact he was being treated for mental illness. "I was just made to believe this would be private," said the student. "Isn't that a bummer?"
By Robert O'Harrow Jr., The Washington Post, Copyright © 2001, Federated Publications, Inc.