All major pharmacy chains in the United States are sending sensitive medical records to the police without a warrant – and some of them do so without even consulting a legal professional, according to a parliamentary investigation.
Serious Concerns About Medical Privacy
This revelation raises serious concerns about medical privacy, especially in the post-Dobbs era where many states are criminalizing reproductive healthcare. Even if individuals in states with restrictive laws cross state lines for care, pharmacists at major chains like CVS can access records across borders.
Pharmacy Requirements for Disclosing Medical Records
Lawmakers noted the pharmacy policies for disclosing medical records in a letter dated Tuesday to Secretary of Health and Human Services (HHS) Xavier Becerra. The letter – signed by Senator Ron Wyden (D-Oregon) and Representatives Pramila Jayapal (D-Washington) and Sara Jacobs (D-California) – stated that their investigation gathered information from briefings with eight major prescription drug suppliers.
Pharmacies Included in the Study
The seven largest pharmacies in the country include: CVS Health, Walgreens Boots Alliance, Cigna, Optum Rx, Walmart Stores, The Kroger Company, and Rite Aid Corporation. Lawmakers also spoke with Amazon Pharmacy.
No Requirement for a Warrant
The eight pharmacies stated that they do not require police to obtain a warrant before sharing sensitive and private medical records, which can include the prescription drugs a person is using and their medical condition. Instead, all pharmacies provide such information with nothing more than a subpoena, which can be issued by government entities and does not require review or approval from a judge.
No Consultation with Legal Professionals
Three pharmacies – CVS Health, The Kroger Company, and Rite Aid Corporation – told lawmakers that they do not even require pharmacy staff to consult with legal professionals before responding to police requests at pharmacies. According to lawmakers, CVS, Kroger, and Rite Aid stated that “pharmacy staff are under intense pressure to respond immediately to police demands and as such, the companies instruct their staff to处理这些请求在商店中.”
Other Pharmacy Requirements
The remaining pharmacies – Amazon, Cigna, Optum Rx, Walmart, and Walgreens Boots Alliance – require at least a review of police requests by legal professionals before pharmacists respond. However, only Amazon said it has a policy to inform customers about police requests for pharmacy records unless there are legal restrictions preventing that, such as a gag order.
Health Privacy and Transparency Laws
Lawmakers noted that pharmacies are not violating regulations under the Health Insurance Portability and Accountability Act (HIPAA). Pharmacies pointed to language in HIPAA regulations that allows healthcare providers, including pharmacists, to provide medical records if required by law, and that court subpoenas are a legally sufficient process for such requests. However, lawmakers noted that the Department of Health and Human Services has discretion in determining the legal standard here – meaning it has the authority to enhance regulations to require a warrant, which lawmakers say it should do.
Call for Improved Pharmacy Policies
Lawmakers urged pharmacies to do better, encouraging them to follow technology companies’ policies. They stated: “Pharmacies can and should insist on a warrant, and call on law enforcement agencies that demand patient records under a subpoena to simply go to court to enforce that request. The requirement for a warrant is exactly the approach that technology companies take to protect customer privacy.” The trio noted that Google, Microsoft, and Yahoo have required law enforcement to have a warrant to obtain customer messages since 2010.
Encouragement
Transparency and Annual Reporting
Lawmakers also pointed to the leadership of tech companies and encouraged pharmacies to publish annual transparency reports. During the inquiry, CVS Health only stated that it plans to do so.
Patient Rights and Awareness of Access to Their Health Records
HIPAA regulations grant patients the right to know who accesses their health records. However, to do this, patients must specifically request that information – and very few people do. The lawmakers noted that “the average American is likely not even aware of this issue.”
The three lawmakers conveyed their message at the end of the news by saying: “Americans deserve to have their private medical information protected at the pharmacy counter and a full picture of privacy practices at pharmacies, so that they can make informed choices about where to get their prescriptions.”
Currently, HIPAA regulations give patients the right to know who accesses their health records. However, to do this, patients must specifically request that information – and very few people do. The lawmakers noted that “the average American is likely not even aware of this issue.”
The three lawmakers conveyed their message at the end of the news by saying: “Americans deserve to have their private medical information protected at the pharmacy counter and a full picture of privacy practices at pharmacies, so that they can make informed choices about where to get their prescriptions.”
About the Author
Beth Mole is the senior health reporter at Ars Technica. Beth holds a Ph.D. in microbiology from the University of North Carolina at Chapel Hill and participated in the science communication program at the University of California, Santa Cruz. She specializes in covering infectious diseases, public health, and microbes.
Leave a Reply