An inquiry discovered that law enforcement agencies had accessed the prescription records of thousands of Americans from the biggest pharmacy chains in the country without obtaining a warrant. This has raised concerns about how these companies handle patient privacy.
The inquiry also found that CVS Health, Kroger, and Rite Aid do not require their staff to consult a lawyer before releasing information requested by law enforcement. The other five companies, including Walgreens, Cigna, and Optum Rx, said that they do require a legal review before honoring such requests.
This information was revealed in a letter to Xavier Becerra, the Secretary of Health and Human Services, from Senator Ron Wyden of Oregon and Representatives Pramila Jayapal of Washington and Sara Jacobs of California.
There are concerns about patient privacy due to access to birth control and abortion medication and the need for stronger regulations under the Health Insurance Portability and Accountability Act (HIPAA).
The inquiry revealed that pharmacies receive tens of thousands of legal requests annually for their patients’ pharmacy records. And there have been calls for HIPAA regulations to require law enforcement agencies to obtain a warrant to access medical records and to notify patients when their records are requested.
According to the lawmakers, pharmacies should insist on a warrant and take law enforcement agencies demanding patient medical records with only a subpoena to court to enforce that demand.
In a statement, a CVS spokeswoman emphasized the company’s processes are consistent with HIPAA and they have suggested a warrant or judge-issued subpoena requirement be considered.
The Health and Human Services Department has already made moves to protect data related to reproductive health under HIPAA. But there are ongoing concerns and debates about privacy in relation to pharmacy records.
There was a call to strengthen regulations under HIPAA to align them more closely with Americans’ reasonable expectations of privacy and constitutional principles.
A professor of law and health policy at Stanford, Michelle Mello, highlighted the complexities and misconceptions around HIPAA and patient privacy. There is a need for more transparency and protections for patients’ medical records.