The Junk Food Marketing Debate: A First Amendment Right or Just Making Sure Kids Aren’t What They Eat?

Photo by trp0 via flickr.

Remember the Omnibus Appropriations Act of 2009 (H.R. 1105) that President Obama signed on March 11, 2009?   No?  Good, me neither, but my excuse is that I was busy applying to law schools.  If you and I had been paying closer/any (take your pick) attention, we would have seen that the Act included, among other things, a provision calling for the Federal Trade Commission, the Centers for Disease Control and Prevention, the Food and Drug Administration, and the Department of Agriculture to create an Interagency Working Group on Marketed Food to Children (”Working Group”) composed of representatives from each agency.  The Working Group would research and recommend standards for the marketing and advertising of food to children age 17 years and younger.   These recommendations would be presented to Congress down the road.

Well, a couple of years passed, but in April 2011 the Working Group released its 26-page “Preliminary Proposed Nutrition Principles to Guide Industry Self-Regulatory Efforts” for public comment (which you can submit by clicking here before July 14). The Working Group notes that

… in the FTC’s 2008 study on Marketing Food to Children and Adolescents, three food categories — breakfast cereal, restaurant foods, and snack foods — represented approximately 70% of food marketing expenditures directed to children under 12. Similarly, three categories of foods — carbonated beverages, restaurant foods, and non-carbonated beverages — represented 69% of the food marketing expenditures for adolescents ages 12-17 year….  [Overall] [t]he categories most heavily marketed to children and adolescents, ages 2 -17 years are: breakfast cereals; snack foods; candy; dairy products; baked goods; carbonated beverages; fruit juice and non-carbonated beverages; prepared foods and meals; frozen and chilled deserts; and restaurant foods. The Working Group is therefore recommending that the food industry focus its efforts on ensuring that any advertising or marketing of food products within these ten categories meet the nutrition principles set out below. (Emphasis added.)

The Working Group focuses on two nutritional principles “that both improve the nutritional quality of foods marketed to children and can be feasibly implemented by industry with sufficient time to accomplish reformulation,” namely, “Meaningful Contribution to a Healthful Diet” (Principle A)  and “Nutrients with Negative Impact on Health or Weight”  (Principle B).  Principle A ensures that foods marketed to children contain two or more of the following food groups: “fruit, vegetable, whole grain, fat-free or low-fat milk products, fish, extra lean meat or poultry, eggs, nuts and seeds, or beans.”  Principle B ensures that foods marketed to children have limited amounts of saturated fat, trans fat, sodium, and added sugars.  The Working Group makes sure to point out (several times in fact) that its recommendation are based on the 2010 Dietary Guidelines for Americans.

Really, this all sounds quite sensible, if not a little over-protective… but considering, as The Washington Post has reported, that Type 2 diabetes has significantly increased among people age 20 years and younger, what else can this country do to curb obesity and poor eating habits?  Even if we could reduce the cost of nutrient-rich and quality foods so that everyone could afford them, how do we neutralize the marketing of junk food to children?  In a report last month, NPR noted how

[the Working Group] broke from the past by seeking to include 12- to 17-year-olds in its guidelines. Traditionally, limits on marketing focused on the very young. But the government sought to expand them to older children, in part because they are heavy consumers of social media, cell phone messages and online games — the new frontier for ads.

That new frontier of advertising to children through online games — also known as “advergaming” (forgive my use of Wikipedia but Merriam-Webster doesn’t list the word) — includes Asylum 626 and Hotel 626, two advergames sponsored by Doritos.  As NPR reported,

“[w]hat we’re talking about are very complicated and very subtle forms of marketing that aren’t always clear as such,” says Kathryn Montgomery, a professor of communications at American University and an advocate for limiting food ads to teens.

[...]

Montgomery says such ads work subliminally and use friends to influence other friends.

But efforts to restrict ads to teens draw lots of opposition from the food and advertising industries. The industries say the overlap between teen and adult audiences makes the proposed restrictions impractical.

Critics, including the U.S. Chamber of Commerce, have questioned the constitutionality and logic of the Working Group’s nutritional proposals.  The Hill’s Healthwatch has reported that some critics see a First Amendment issue because

“[w]hat they’re doing is trying to simultaneously … suppress speech, while insulating it from judicial review,” said Northwestern law Professor Martin Redish, one of the panelists at a Chamber of Commerce discussion Thursday. “Because if these regulations were truly just advisory, there would be no case or controversy.”

[...]

“Industry’s rights are being violated here,” Redish said, “but there’s something deeper and darker that’s going on: The government is treating us like sheep.”

While constrained to commercial speech, Redish said that attitude has broader implications. People, he said, “can’t be sheep in the commercial realm and then all of a sudden, in the political realm, they’re free-thinking adults who can make basic choices.”

NPR has reported that other critics question the logic behind the proposal and the implicated age range.

Elaine Kolish directs an industry-funded program called the Children’s Food and Beverage Advertising Initiative. For the past five years this initiative sponsored its own voluntary standards that focus only on the 12-and-under set.

“You know, we let kids drive and we let them hold jobs when they’re 16. They can get married in some states, and they can join the military with permission, and they can be held criminally responsible for their actions in a number of situations,” she says. “So I think that the notion that you’d have to have nutrition standards that say you can’t let a kid see an ad for a french fry but you can let them join the military doesn’t really make a lot of sense.”

So where do we go from here?  Is industry self-regulation the answer to making products that better fit on MyPlate?  As I’ve noted in a previous post about McDonald’s Happy Meal toys, sometimes the answer can be stricter parenting (just say “no”).  Yet how can parents instill and maintain healthy eating habits in their kids when advertisements for unhealthy food bombard them through television, social media, and online games?

Functional Foods: What Happens When Advertising Misleads Consumers?

An article recently published in the New York Times focuses on the complexities of modern-day food labeling. It seems that almost every product in the grocery store touts a label boasting of some health benefits, from supporting heart health to lowering cholesterol levels. These items are referred to as functional foods or nutraceuticals, and they are foods that claim to provide health benefits beyond the traditional nutrients they contain. Functional foods are one of the fastest growing areas in the food industry.

While companies cannot claim that functional foods actually prevent or cure diseases, they can market foods with having health-promoting or wellness-maintaining properties. The article explains how economists refer to items like functional foods as credence goods. For these foods, most consumers are unable to assess the utility of health claims and therefore rely on advertisements to be true. Misleading marketing and advertising can leave consumers confused about what they are buying and about just how helpful some products are in maintaining overall health.

The Federal Trade Commission (FTC) oversees food advertising and has filed recent complaints of deceptive marketing against Kellogg and Dannon. Frosted Mini-Wheats can no longer claim that they are clinically shown to improve children’s attentiveness by nearly 20 percent, and boxes of Rice Krispies are no longer emblazoned with a claim that they support children’s immunity. Dannon was forced to remove claims that its Activia yogurt improves intestinal transit time, as the FTC found no scientific proof for such a claim.

The Food and Drug Administration (FDA), which oversees food labeling, has also noted the problems with false or misleading claims on functional foods. Commissioner Margaret Hamburg wrote an open letter to the industry urging them to examine product labels to avoid violating established labeling standards. But the issue seems too complicated for an open letter to solve. As the FDA’s deputy commissioner for foods Michael Taylor wrote last year,

“Going after [misleading marketers] one-by-one with the legal and resource restraints we work under is a little like playing Whac-a-Mole, with one hand tied behind your back.”

The Deputy Commissioner appears to be right, and not all food companies are willing to give up false or misleading claims or labeling without a fight. In 2010, the FDA found that the makers of POM Wonderful pomegranate juice had violated the Federal Food, Drug, and Cosmetic Act by making therapeutic claims that “establish that the product is a drug because it is intended for use in the cure, mitigation, treatment, or prevention of disease.” When POM did not retract its claims, the FTC filed a complaint against the maker for deceptive advertising based on unsubstantiated scientific claims. POM was initially defiant (calling the FTC complaint unwarranted), but eventually settled and changed their advertising.

The company did, however, file a federal lawsuit against the FTC for acting outside its authority and violating the right to free commercial speech. As NYU Professor Marion Nestle pointed out in an article, POM’s suit is being brought “not because they are claiming they have science on their side, but because they think their health claims, believable or not, are protected by the First Amendment.”

There are other ways to confront misleading ‘healthy’ claims before they are printed on products and sold to consumers. The article notes the approach of the European Food Safety Authority, an independent panel of experts to whom food makers submit applications of scientific evidence backing their desired claims. The panel reviews each case and issues an opinion on the evidence, and will create a list of approved health claims for companies to use in the future.

The FDA’s approach is focused on the other end of the product line, and encourages consumers to learn to read nutrition labels and make wise purchasing decisions. This includes updating the Nutrition Facts Panel printed on the back of food packages, adding calorie counts to restaurant menus, and pushing the Let’s Move initiative to combat childhood obesity. A smarter consumer is an admirable and essential goal, but with the amount of money put into advertising on a global scale, the FDA must issue stricter guidelines for food companies. Hopefully, the outcome of the POM lawsuit will help empower the FDA to do just that.

HIPAA, The HITECH Act, and How Google May Still Be Able to Distribute, and Profit From, Your Personal Health Info

Photo by Jonathunder

Below I will explore what seems to be a gaping hole in the HITECH Act. However, as with any new legislation, it is often necessary to reexamine the laws that preceded it, which in this case is HIPAA.  This is particularly true given that the HITECH Act does not replace HIPAA. Rather, it provides–amongst other things–additional security and privacy safeguards with respect to health information. To that extent,  at least a cursory reexamination of HIPAA is required before understanding HITECH and the importance of comprehensive legislation.

HIPAA was a product of the 1990’s–an era triggering nostalgic memories of grunge music  for some, and the (in)famous Macarena dance for others. For a large part of this period, the Internet was accessed by a handful of tech savvy individuals who dialed into services like CompuServ, Prodigy, and AOL.  It was during this transition that Congress felt the need to make health insurance more portable, as well as standardize the variegated electronic systems that were conducting nonstandard healthcare-related transactions. There was a concomitant concern that health information needed better protection. Thus, in 1996 Congress adopted the Health Insurance Portability and Accountability Act (HIPAA), providing HHS with the responsibility to enforce it. However, the regulation enforcing privacy and security of health information would not be implemented until years later.

HIPAA’s Privacy Rule, which describes the appropriate use and disclosure of certain health information, came into force on April 14th, 2001, updated in 2002, with compliance required by April of 2003. The Security Rule, which establishes the policies and best practices for securing health information, came into force in 2003. Thus, the Privacy and Security Rules (referred to below as HIPAA) came to life in a period of technological transition. New technologies like residential broadband Internet access and Wi-Fi networks were becoming the norm. Electronic Health Record (EHR) systems had been developed, but had only marginal penetration within certain academic medical centers and government entities. Consequently, the threats to patient privacy from early EHRs was much smaller than it is today, since these systems were not widespread and did not often share data over disparate regions. Thus, access to the systems was not necessarily available outside of the intranets where the servers were located.

Acronyms of HIPAA & HITECH

d

Given the historical context of HIPAA’s passage, it is easy to appreciate HIPAA’s missteps in not specifically  focusing on EHRs or PHRs.  Rather, HIPAA regulates protected health information at a broader level, focusing primarily on the “use and disclosure” of PHI by CEs, and the best practices and policies for securing the PHI itself.   To be fair, the Security Rule does focus on PHI that is stored and transmitted electronically. However, even the most stringent best practices and policies are useless if the corresponding privacy regulations are inadequate.

But the times they are a-changin’–sort of.

Buried on page 112 of the American Recovery and Reinvestment Act (ARRA)–also known as the Stimulus Bill–is Title VIII of the bill, known as the Health Information Technology for Economic and Clinical Health Act, or more commonly, the HITECH Act. One (of the many) purposes of the HITECH Act is to fill in the gaps that have emerged since the Privacy and Security rules came into force.  But like before, we are in a transition period. Whereas HIPAA’s passage coincided with a period of generalized transition towards digital information, HITECH has coincided with its own transition: the implementation of personal health records (PHRs). Unfortunately, the current HITECH Bill and regulations have serious flaws in how they protect patient information stored in PHRs. However, before discussing the problems, it is only fair to discuss the benefits to privacy and security that HITECH’s passage has provided.

Specifically, HITECH introduces breach notification requirements. HITECH’s provisions govern the procedures which CEs and BAs must follow if health information has been compromised. HITECH also empowers the FTC to promulgate regulations pertaining to the notification procedures of PHR vendors (as well as those who offer services to PHR vendors). The FTC’s proposed breach notification requirements can be found here. Thus, CEs, BAs, and PHR vendors are, for the first time, required by law to notify individuals if their unsecured PHI has been accessed by unauthorized individuals.  Surprisingly, this was not required under HIPAA. CEs were obligated to notify individuals only insofar as the CEs were required by HIPAA to mitigate damages. But now, with the passage of HITECH, breach notification is no longer amorphous, but is spelled out in detail in HITECH’s regulations.

Additionally, HITECH requires BAs to abide by many of the same privacy and security requirements that CEs have had to abide by. Before HITECH, a BA, such as an attorney reviewing the PHI of a CE, was required to sign an agreement promising to protect the PHI that they were accessing, but were not themselves regulated by HIPAA. Thus, BAs had only contractual liability to the CE if the BA violated the rules of the agreement. On the other hand, if a CE violated HIPAA, it was subject to specific penalties and fines by the government.

Under HITECH, BAs must now comply with much of the Privacy and Security Rule, and face many of the same penalties and fines if they violate HIPAA regulations. That is, BAs are now accountable to the government if they improperly use or disclose PHI, or fail to adequately secure PHI.

HITECH also offers other benefits, such as increased enforcement of violations, a strengthening of the requirement that only the minimum necessary information is disclosed to other CEs or BAs, a more thorough framework of accounting for uses and disclosures, as well as a certain prohibitions on the sale of PHI.

The last benefit of HITECH–the prohibition on the sale of PHI–is a perfect springboard for discussing the potential pitfalls of HITECH. The benefits of HITECH may well be sufficient to shore up HIPAA’s gaps when it comes to regulating CEs and BAs. However, as HITECH’s regulatory language makes clear, there remains a gaping hole:

(d) Prohibition on Sale of Electronic Health Records or Protected Health Information-

(1) IN GENERAL- Except as provided in paragraph (2), a covered entity or business associate shall not directly or indirectly receive remuneration in exchange for any protected health information of an individual unless the covered entity obtained from the individual, in accordance with section 164.508 of title 45, Code of Federal Regulations, a valid authorization

The emphasis is added to underscore that PHRs are not included in this provision. There is no corresponding provisions in the FTC’s proposed regulations which concern breach notification. The upshot of this is that, as of the date of this posting, PHR services like Google Health and Microsoft HealthVault are not subject to this prohibition, nor is there a provision in HITECH mandating that PHRs comply with HIPAA’s Privacy and Security Rule. Therefore, PHR vendors can use, disclose–and possibly even sell–an individual’s health information outside of the HIPAA and HITECH regulations. This problem underscores a larger issue: PHRs are not regulated by HIPAA, and only regulated by HITECH insofar as the FTC’s interim rule requires certain breach notification procedures. Read more