Pharmacies Shared Patient Records Without Court Order, Investigation Finds

Law enforcement agencies have obtained the prescription records of thousands of Americans from the country’s largest pharmacy chains without a warrant, according to a congressional investigation, raising concerns about how the companies handle the privacy of the patients.

Three of the largest pharmaceutical groups (CVS Health, Kroger and Rite Aid) do not require their staff members to contact an attorney before disclosing information requested by authorities, according to the investigation. The other five (Walgreens, Cigna, Optum Rx, Walmart and Amazon) said they do require legal review before complying with such requests.

The policies were revealed Tuesday in a letter Xavier Becerra, secretary of health and human services, Senator Ron Wyden of Oregon and Representatives Pramila Jayapal of Washington and Sara Jacobs of California, all Democrats.

The investigation began in June, a year after the Supreme Court ended the constitutional right to abortion and paved the way for Republican-controlled states to enact near-total bans on the procedure. Since then, reproductive health advocates and some lawmakers have raised privacy concerns regarding access to contraception and abortion medications.

“Although pharmacies are legally permitted to inform their customers of government demands for their data, most do not do so,” the lawmakers wrote. “As a result, many Americans’ prescription records have few meaningful privacy protections, and those protections vary widely depending on the pharmacy they use.”

The investigation found that pharmacies receive tens of thousands of legal requests about their patients’ pharmacy records annually. However, according to the letter, the companies indicated that the vast majority of requests were filed in connection with civil litigation.

In July, nearly 50 Democratic members of Congress he wrote to Mr. Becerra Urge the Department of Health and Human Services to expand regulations under the Health Insurance Portability and Accountability Act, or HIPAA, which would require law enforcement agencies to obtain a court order to obtain access to medical records and would require that Patients are notified when their records are requested.

Since then, lawmakers have been investigating the disclosure practices of major pharmacy chains.

During the Congressional investigation, CVS, Kroger and Rite Aid “indicated that their pharmacy staff face extreme pressure to immediately respond to law enforcement demands and, as such, the companies instruct their staff to process those requests in the store,” Wyden said. Ms. Jayapal and Ms. Jacobs wrote in their letter to Mr. Becerra.

“Americans’ prescription records are among the most private information the government can obtain about a person,” the lawmakers wrote. “They can reveal extremely personal and sensitive details about a person’s life.”

He went on to urge the Department of Health and Human Services to strengthen regulations under HIPAA “to align them more closely with Americans’ reasonable expectations of privacy and constitutional principles.”

“Pharmacies can and should insist on a court order and invite law enforcement agencies that insist on demanding patients’ medical records with only a subpoena to go to court to enforce that demand,” the letter said.

In a statement, a CVS spokeswoman said the company’s “processes are consistent with HIPAA” and that its pharmacy teams are trained to “appropriately respond to legal requests.”

“We have suggested consideration of a court order or subpoena issued by a judge and look forward to working cooperatively with Congress to strengthen patient privacy protections,” said spokeswoman Amy Thibault.

The Department of Health and Human Services has already taken steps to add language to HIPAA that would protect data related to reproductive health. In April, the department’s Office of Civil Rights proposed a rule That would prevent health care providers and insurers from giving information to state officials trying to prosecute someone for seeking or providing a legal abortion.

Michelle Mello, a health law and policy professor at Stanford, said requiring a court order rather than a subpoena for disclosure of pharmacy records “would not necessarily preclude concerns” about privacy. She also said that notifying patients about records disclosure, which lawmakers said “would be a huge step forward for patient transparency,” would likely happen only after the fact.

While Professor Mello said most pharmacy records should be kept private, she said targeting pharmacy employees, who could be found in contempt of court for failing to comply with a record demand by authorities, adds another layer of complexity.

“It’s not fair to put the burden on them of being found in contempt of court and then fight that,” he said.

But congressional Democrats’ efforts to shore up HIPAA reveal a long-standing misconception about the health care privacy law, which became law in 1996, he said.

“People think HIPAA has broader protection than it does,” Professor Mello said. “It was not designed to allow health care providers to resist very misguided attempts, in my opinion, to enforce laws that negatively impact patients.”