On Tuesday, a congressional investigation discovered that the biggest pharmacy chains in the United States have all handed patients’ medical records over to authorities despite no warrants being provided.
As Axios reports, concerns about the pharmacy chains’ breach of customer privacy were voiced in a letter signed by three members of Congress: Senator Ron Wyden (D-Ore.), Congresswoman Pramila Jayapal (D-Wash.), and Congresswoman Sara Jacobs (D-Calif.). In the letter, addressed to the Department of Health and Human Services (HHS), the legislators reveal that the three largest pharmacy chains – CVS Health, Kroger, and Rite Aid – all regularly instruct their staff to respond to law enforcement demands instantly, even if warrants are not presented.
Five other chains don’t require warrants unless mandated by state law, but nevertheless require legal professionals to review any demands from law enforcement before responding. These chains are Amazon, Walmart, Walgreens Boots Alliance, Optum Rx, and Cigna.
In the current system, Americans are generally required to ask for their medical record disclosure data from health care providers; the providers do not go out of their way to inform patients when their information has been accessed by third parties.
“Few people ever request such information, even though many would obviously be concerned to learn about disclosures of their private medical records to law enforcement agencies,” the letter states, demanding that HHS update HIPAA regulations in order to better protect the privacy of Americans’ health records.
“Americans’ prescription records are among the most private information the government can obtain about a person,” the letter continued. “They can reveal extremely personal and sensitive details about a person’s life, including prescriptions for birth control, depression or anxiety medications, or other private medical conditions.”
CVS has defended its actions by claiming that it received a single-digit number of requests from customers about law enforcement access of their data. Amy Thibault, a spokeswoman for CVS, said that the company has suggested the implementation of a warrant- or judge-based subpoena requirement for pharmacies to hand over such information to law enforcement. But, nevertheless, Thibault insisted that CVS’ practices are in compliance with HIPAA and standard industry practice.
Several companies, including Walgreens and Kroger, recently made commitments to publishing annual transparency reports detailing any and all law enforcement demands. CVS made a similar promise at the start of the current congressional investigation, with the first report scheduled to be released in early 2024.