Lilly discloses e-mail addresses of Prozac patients

July 6, 2001

NDIANAPOLIS - New fears about the online security of private information were stirred yesterday when Eli Lilly and Co. said it had inadvertently released over the Internet the e-mail addresses of more than 600 people on Prozac.

''It just seems like such gross negligence that they let this happen, and then blame it on a programming error and apologize,'' said Evan Hendricks, who publishes the Privacy Times newsletter in Washington.

Hundreds of patients had signed up at a Lilly Web site for an automated e-mail reminding them to take their dose of the anti-depressant.

Lilly spokesman Jeff Newton said a message sent June 27 announcing the end of the service mistakenly included the e-mail addresses of all the subscribers in the message header.

''It's really just a human programming error,'' Newton said.

Experts said exposing the patients' e-mail addresses made it possible to trace their real names and other information about them, including some medical history.

''Once you put health care information into electronic form, you magnify the harm,'' said Janlori Goldman, director of the Health Privacy Project at Georgetown University.

The American Civil Liberties Union has asked the Federal Trade Commission to investigate.

It accused the Indianapolis-based pharmaceutical giant of violating its own Internet privacy policy.

''Whether they did it inadvertently or not, they did it,'' ACLU associate director Barry Steinhardt said. ''The FTC isn't a privacy cop, it's an honesty cop.''

FTC spokeswoman Claudia Bourne Farrell declined to comment on the incident but noted that the agency has taken legal action in the past against companies that have violated their own online policies.

The FTC and other authorities stepped in when Toysmart.com went out of business last year and put its customer records up for sale.

Two years ago, RealNetworks of Seattle apologized amid complaints that its software allowing customers to listen to music on computers secretly collected details about people's listening preferences.

Experts said the Lilly incident shows the need for more careful handling of sensitive information.

This story ran on page 2 of the Boston Globe on 7/6/2001.