CVS, Kroger, Rite Aid share sensitive patient data without a warrant, say lawmakers

Law enforcement agencies have been accessing patient prescription records from pharmacies without warrants, a congressional investigation has found. Consumers often are not aware that their private information is being handed over to authorities.

Democratic Sen. Ron Wyden of Oregon, chair of the Senate Finance Committee, and two other lawmakers sent a letter to the U.S. Department of Health and Human Services outlining their findings on Dec. 11.

“Through briefings with the major pharmacies, we learned that each year law enforcement agencies secretly obtain the prescription records of thousands of Americans without a warrant,” the letter said. “In many cases, pharmacies are handing over sensitive medical records without review by a legal professional. Although pharmacies are legally permitted to tell their customers about government demands for their data, most don’t. As a result, many Americans’ prescription records have few meaningful privacy protections, and those protections vary widely depending on which pharmacy they use.”

The letter asked the agency to strengthen HIPAA regulations to protect sensitive medical information from being disclosed. “Pharmacies can and should insist on a warrant and invite law enforcement agencies that insist on demanding patient medical records with solely a subpoena to go to court to enforce that demand,” the letter said.

The congressional investigation began in June, a year after reproductive health advocates and some lawmakers have raised privacy concerns regarding access to birth control and abortion medication.

Lawmakers surveyed eight major pharmacy chains — CVS Health, Walgreens Boots Alliance, Cigna, Optum Rx, Walmart Stores Inc., The Kroger Co. and Rite Aid Corp. — along with Amazon Pharmacy. Only Amazon Pharmacy said it had a policy of informing customers when law enforcement requested their records. None of the companies said it requires a warrant before providing pharmacy records to law enforcement agencies.

The pharmacies mentioned in the letter said they are following privacy laws and federal health rules, which don’t require a judge-signed warrant. In many cases, law enforcement presents subpoenas signed by a government agency but not reviewed by a judge.

Five of these companies have legal professionals review any demands for pharmacy records before a response is sent. CVS Health, Kroger and Rite Aid said their staffs faced extreme pressure to provide an immediate response. CVS Health and Kroger both argued that their staffs are trained to respond to these requests and have access to legal departments if they have questions.

Related: Which pharmacies are sharing sensitive health data with Facebook?

CVS Health, Walgreens and Kroger committed before or during the course of the congressional inquiry to publishing annual transparency reports about law enforcement demands.

“Americans’ prescription records are among the most private information the government can obtain about a person,” the letter said. “They can reveal extremely personal and sensitive details about a person’s life, including prescriptions for birth control, depression or anxiety medications, or other private medical conditions.”