Inquiry By Senate Finance Representatives Finds Pharmacies Fail to Protect Privacy of Medical Records

Alongside Representative Pramila Jayapal (D-Wash) and Representative Sara Jacobs (D-Calif), Senate Finance Committee Chair Ron Wyden (D-Ore) revealed inquiry results that demonstrate major pharmacy chains fail to protect the privacy of their patients. To better protect Americans’ prescriptions and health records held by pharmacies, the representatives called on the Department of Health and Human Services (HHS) to improve federal health privacy regulations. The representatives note that follow-ups on pharmacy privacy policy surveys will be conducted, and the findings will be published.

Image credit: Dragana Gordic | stock.adobe.com

Representatives Wyden, Jayapal, and Jacobs began their inquiry by they asked 8 major pharmaceutical chains—CVS Health, Walgreens Boots Alliance, Cigna, Optum Rx, Walmart Stores, The Kroger Company, Rite Aid Corporation, and Amazon Pharmacy—how they handle law-enforcement requests for prescriptions and other health records. The report’s findings reiterate the importance of revising federal privacy regulations so that law enforcement warrants for individuals’ health records are required. This would result in American citizens’ medical records receiving the same protections under federal law as their locations and email data.

“Americans' prescription records are among the most private information the government can obtain about a person,” said Wyden, Jayapal, and Jacobs to HHS Secretary Xavier Becerra in a written letter. “They can reveal extremely personal and sensitive details about a person’s life, including prescriptions for birth control, depression or anxiety medications, or other private medical conditions.”

The representatives found that none of the 8 pharmaceutical chains require warrants to share prescription records with law enforcement agencies, unless a state law requires it. Further, CVS Health was found to be committed to publishing annual transparency reports about law enforcement requests for records. Both Walgreens Boots Alliance and The Kroger Company had also agreed to release transparency reports during the inquiry.

Further, the inquiry determined that 3 of the companies—CVS Health, The Kroger Company, and Rite Aid—had notes that they do not require demands for records to be reviewed by a lawyer or paralegal; however, pharmacy staff are instead instructed to respond immediately to any law enforcement demands. Only Amazon Pharmacy has a policy in place in which customers are notified about law enforcement demands for records, with a legal prohibition on doing so.

“Americans deserve to have their private medical information protected at the pharmacy counter and a full picture of pharmacies’ privacy practices, so they can make informed choices about where to get their prescriptions filled,” the representatives wrote to HHS Secretary Becerra. “Our oversight has uncovered significant differences between the practices of major pharmacy chains under current HIPAA regulation and this initial inquiry resulted in immediate policy changes at some of these companies. If the landscape were made clearer, patients will finally be able to hold pharmacies with neglectful practices accountable by taking their business elsewhere.”

Reference

United States Senate Committee on Finance. Wyden, Jayapal and Jacobs Inquiry Finds Pharmacies Fail to Protect the Privacy of Americans’ Medical Records; HHS Must Update Health Privacy Rules. News release. December 12, 2023. Accessed December 18, 2023. https://www.finance.senate.gov/chairmans-news/wyden-jayapal-and-jacobs-inquiry-finds-pharmacies-fail-to-protect-the-privacy-of-americans-medical-records-hhs-must-update-health-privacy-rules