In Health Care, Privacys the Best Prescription

To connect with MS patients, Teva's portal had to inject a dose of security.

Copaxone was not the first multiple sclerosis drug on the market in North America, nor was it the second. When Teva Neuroscience Inc. introduced it in early 1997, it was third to market.

That timing shouldnt matter to the MS patients who inject Copaxone to treat the effects of this chronic, often-debilitating degenerative disease of the central nervous system, which now affects about 350,000 people in the United States. But it did matter to Teva Neuroscience, a joint venture of Teva Pharmaceutical Industries Ltd., of Jerusalem, and Hoechst Marion Roussel Pharmaceutical Corp., of Frankfurt, Germany. Teva had a lot riding on Copaxone: Pharmaceuticals companies typically spend between $300 million and $500 million to develop drugs such as Copaxone, for which Teva will charge $10,000 per year per patient. Clearly, each physician who heard about the new drug and each patient who converted to its use were crucial to profitability.

But how to reach all those potential customers? Rather than use the traditional and expensive approach—print and television advertising—Teva officials decided to try launching an online portal featuring discussion forums; live nurse counselor support; secured personal diaries used by patients to record their health status, drug injections and physician appointments; and news and educational material about MS. The experiment has been a success, helping Teva attract new patients to Copaxone while also allowing the company to cut marketing costs. Along the way, however, the company had to overcome a major hurdle: ensuring that all patient information on the portal—dubbed MSWatch—could be kept secure and private.

Since its launch in July 1998, the site has grown to approximately 37,000 registered users and remains the centerpiece of Tevas marketing strategy for Copaxone. The site has allowed Teva to coax many MS patients to switch from other medications to Copaxone. In fact, 8 percent of MSWatch visitors in the summer of last year reported switching from other medications to Copaxone during that period, according to Atul Singh, Tevas head of e-business, in Kansas City, Mo.

Moreover, the portal helped Teva keep marketing costs under control. According to research released last year from Cyber Dialogue Inc., a CRM (customer relationship management) consultancy in New York, the cost to generate consumer requests for drug information from the Internet is a mere $14, compared with $220 from print ads and $197 from television ads. Added to this attractively low cost was the fact that Tevas market research showed that MS patients are extremely well-educated and eager to learn about new products and therapies as well as about the disease itself. In other words, they were ripe to use a portal such as MSWatch.

First, however, Teva officials had to be sure that, if they were going to put patient information online, they could keep it secure and private. Like financial services enterprises, health care industry companies such as Teva face regulations that, among other things, require them to make patient information available only to appropriate, authenticated individuals and to track and record all accessing of patient records. In the case of health care, the regulations are known as HIPAA (Health Insurance Portability and Accountability Act). HIPAA doesnt become law until 2003, at which time transgressions will be punishable by fines and imprisonment, depending on their severity.

Teva turned to SoftWatch Inc.s SRS (SoftWatch Relationship Server) to power the site in a way that would address such health care-specific privacy needs. The software, running on Microsoft Corp.s Windows NT Server and SQL Server, manages access to site content. SRS uses SSL (Secure Sockets Layer) encryption to protect patient information as it moves over the Internet and as it resides in the MSWatch database.

Besides encrypting data, Teva had to be able to keep track of each constituency using the MSWatch site. That includes tracking physicians, pharmaceutical companies, drugstores, health insurance providers, patients, doctors and nurses, to tailor the data access rights of each group and track and archive who has accessed what particular data—all strictures that potentially will be mandated by HIPAA regulations.

The SRS software being used by Teva employs a rule-based system to determine who has access to what information on the site. Users are categorized by data owner type or data owner ID. Using those classifications, a permission-based access control mechanism built into SRS ensures that only users with authorization can access information such as patient records or messages. Log-ins and passwords serve to authenticate users before access to personalized content is granted.