Subpoenaed, pharmacy chains hand over customers' private medical information; lawmakers say warrants should be required

Associated Press photo illustration; other chains are involved

"The nation’s largest pharmacy chains have handed over Americans’ prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy," reports Drew Harwell of The Washington Post. "Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store."

Sen. Ron Wyden of Oregon and Reps. Pramila Jayapal of Washington and Sara Jacobs of California, all Democrats, revealed the policy in a letter Monday to Health and Human Services Secretary Xavier Becerra. They investigated the practice "after the Supreme Court’s decision last year in Dobbs v. Jackson Women’s Health Organization ended the constitutional right to abortion," Harwell reports. In Kentucky, the legislature has banned abortion except to save the woman's life or prevent serious imparment of a life-sustaining organ.

"Pharmacies’ records hold some of the most intimate details of their customers’ personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control," Harwell notes. "Because the chains often share records across all locations, a pharmacy in one state can access a person’s medical history from states with more-restrictive laws. Carly Zubrzycki, an associate professor at the University of Connecticut law school, wrote last year that this could link a person’s out-of-state medical care via a 'digital trail' back to their home state."

Officials with eight large pharmacy chains — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena from law enforcement, not a warrant issued by a judge, to share the records. The lawmakers said employees face “extreme pressure to immediately respond.” Harwell notes, "To obtain a warrant, law enforcement must convince a judge that the information is vital to investigate a crime."

The senators and representatives asked Becerra to strengthen HIPAA’s rules and make pharmacies insist on a warrant, noting that the tech industry did likewise a decade ago.

The companies told the investigators that they get "tens of thousands of legal demands every year, and that most were in connection with civil lawsuits," Harwell reports. "It’s unclear how many were related to law enforcement demands, or how many requests were fulfilled. Only one of the companies, Amazon, said it notified customers when law enforcement demanded its pharmacy records unless there was a legal prohibition, such as a gag order, preventing it from doing so, the lawmakers said."

The Health Insurance, Portability and Accountability Act allows Americans to ask drug companies if they’ve disclosed their information, "but very few people do," Harwell reports. "CVS, which has more than 40,000 pharmacists and 10,000 stores in the United States, said it received a 'single-digit number' of such consumer requests last year."

CVS, the largest pharmacy chain by prescription revenue, told Harwell that most subpoenas include a directive that the information remain confidential, and if it does not, the company considers “on a case-by-case basis whether it’s appropriate to notify the individual.”

"A Walgreens spokesman said the company’s law enforcement process follows HIPAA and other applicable laws," Harwell reports. "A Walmart spokeswoman said the company takes its 'customers’ privacy seriously as well as our obligation to law enforcement.' An Amazon spokeswoman said that the company cooperates with law enforcement requests as required. . . . Rite Aid declined to comment. The other companies did not respond to requests for comment."

Carmel Shachar, a Harvard Law School professor who studies health law and policy, said pharmacies have a “ton of sensitive data” and pharmacists are likely not trained to "evaluate the merits or validity of a police request — or to turn an officer down," as Harwell put it. Shachar said, “These need to go to someone who understands privacy law for review. probably feels very nerve-racking to get a subpoena and tell the person who gave it to you, ‘Oh, you’ll have to wait.’”

Harwell writes, "The pharmacy data could be especially concerning for the nearly one in three women ages 15 to 44 who a Post analysis found live in states where abortion is fully or mostly banned," including Kentucky. "In Texas, Attorney General Ken Paxton has warned pharmacies they could face criminal charges for providing women with 'abortion-inducing drugs'," which are used for most abortions in the U.S.