Senate Inquiry Reveals Widespread Flaws in Maintaining Pharmacy Customer Data Privacy
No major pharmacy chains across the United States require a warrant to release sensitive prescription data, including data regarding birth control or mental health conditions, with law enforcement agencies.
Results of a new inquiry conducted by the Senate Finance Committee revealed major flaws regarding how pharmacy chains protect, or fail to protect, customer data.1
The inquiry, helmed by Senate Finance Committee Chair Ron Wyden (D, Oregon), Representative Pramila Jayapal (D, Washington), and Representative Sara Jacobs (D, California), found that unless a state law is established that requires it, major pharmacy chains do not need a warrant to share prescription data and other health records with law enforcement agencies. The pharmacies to which these findings apply include household names such as CVS Health, Walgreens Boots Alliance, Cigna, Optum Rx, Walmart Stores, the Kroger Company, Rite Aid Corporation, and Amazon Pharmacy.
In light of these findings, inquiry members called upon the Department of Health and Human Services (HSS) to update federal health privacy regulations. They echoed writing from 47 members of Congress published previously in a July 2023 letter that urged the HSS to expand federal protections of sensitive information, like those given to emails and location data, to include Americans’ medical records.2
“Americans’ prescription records are among the most private information the government can obtain about a person,” wrote Congress members in the July letter to HHS Secretary Xavier Becerra.2 “They can reveal extremely personal and sensitive details about a person’s life, including prescriptions for birth control, depression or anxiety medications, or other private medical conditions.”
Further inquiry findings revealed that out of the 8 major pharmacies investigated, only CVS Health had committed to publishing annual transparency reports about law-enforcement requests for records. Promises were made by Walgreen Boots Alliance and the Kroger Company during the inquiry to begin producing the same kind of data.
Rather than wait for further scrutinization by a lawyer or paralegal, the inquiry also showed that CVS Health, the Kroger Company, and Rite Aid instructs pharmacy staff to respond immediately to law enforcement demands. Amazon Pharmacy is the only pharmacy out of the 8 that established a policy of notifying customers about law enforcement requests for records.
As a result of their findings, Wyden, Jayapal, and Jacobs wrote a new letter to HHS Secretary Becerra doubling down on the need for federal health privacy regulation revisions. The letter also emphasized the autonomy that the revisions would grant to patients to make more informed decisions about their health data.
“Americans deserve to have their private medical information protected at the pharmacy counter and a full picture of pharmacies’ privacy practices, so they can make informed choices about where to get their prescriptions filled,” wrote the inquiry members.1 “Our oversight has uncovered significant differences between the practices of major pharmacy chains under current HIPAA regulation and this initial inquiry resulted in immediate policy changes at some of these companies.”
“If the landscape were made clearer, patients will finally be able to hold pharmacies with neglectful practices accountable by taking their business elsewhere,” inquiry members concluded.1
