GOOD FOR THEM OR SHAME ON THEM?

Pharmacies give medical records to police without warrants, probe uncovers

By April Rubin

 

Axios

Dec 12, 2023

 

The largest pharmacy chains in the U.S. give patients' medical records to law enforcement without warrants, a new congressional investigation found.

Why it matters: Legislators urged the Department of Health and Human Services — for the second time this year — to revise HIPAA regulations to protect Americans' medical records.

• Three of the country's biggest chains, CVS Health, Kroger and Rite Aid, instruct pharmacy staff to respond to law enforcement demands immediately, according to a letter dated Tuesday from Sen. Ron Wyden (D-Ore.), Rep. Pramila Jayapal (D-Wa.) and Rep. Sara Jacobs (D-Calif.).
• Five other chains, Amazon, Cigna, Optum Rx, Walmart and Walgreens Boots Alliance, require legal professionals to review law enforcement demands before responding, but they don't require warrants unless state law mandates it, the letter said.

State of play: Patients have a right to know who is accessing their health information, but the burden is on Americans to request their medical record disclosure data from health care providers.

• "Few people ever request such information, even though many would obviously be concerned to learn about disclosures of their private medical records to law enforcement agencies," the letter said.
• Amazon Pharmacy has a policy of notifying customers about law enforcement demands or pharmacy records, unless state law prohibits them from doing so, the letter said. CVS Health said it received a single-digit number of requests from consumers about law enforcement data.

CVS has suggested a warrant or judge-issued subpoena requirement for pharmacies to turn data over to law enforcement, said Amy Thibault, a spokesperson for CVS Pharmacy.

• At this point, though, the company's practices are compliant with HIPAA and industry practices, Thibault said.
• Rite Aid declined to comment on the letter. Representatives of the other seven pharmacies did not immediately respond to requests for comment.

What's next: Walgreens Boots Alliance and the Kroger Company recently committed to publishing annual transparency reports on law enforcement demands, the letter said.

• CVS Health committed to publish the same at the start of the congressional investigation. Its first report will be released at the start of 2024.

• The big picture: The legislators began investigating medical record privacy after the Supreme Court's Dobbs decision, which ended the constitutional right to abortion, per the Washington Post.

• Pharmacy chain records are often shared across locations in different states. So law enforcement in states with abortion bans could seek the records to determine whether a person received reproductive care in another state.
• Earlier this year, officials from 19 states objected to a proposed federal rule that would expand HIPAA to protect out-of-state health information from crossing state lines.
• "Americans' prescription records are among the most private information the government can obtain about a person," the letter to HHS said.
• "They can reveal extremely personal and sensitive details about a person's life, including prescriptions for birth control, depression or anxiety medications, or other private medical conditions."