A congressional probe launched after the Supreme Court's decision in 2022 to overturn Roe v. Wade has found eight of the nation's largest pharmacy chains allow pharmacy staff to share customer records with police and government investigators without a warrant, according to a Dec. 12 report from The Washington Post.
The inquiry, which involved briefings with the nation's largest pharmacy chains, found privacy practices varied widely across companies. Officials with CVS, Kroger and Rite Aid indicated pharmacy staff are instructed to hand over medical records on the spot when requested by police and investigators who present only a subpoena, not a warrant.
Amazon, Cigna, OptumRx, Walmart and Walgreens attested that they require demands for pharmacy records first be reviewed by lawyers before handing them over, though they also provide records with just a subpoena. Amazon was the only company that said it had a policy to notify customers when law enforcement demanded pharmacy records as long as there is not a legal prohibition.
"Through briefings with the major pharmacies, we learned that each year law enforcement agencies secretly obtain the prescription records of thousands of Americans without a warrant," Sen. Ron Wyden, D-Ore., and Reps. Pramila Jayapal, D-Wash., and Sara Jacobs, D-Calif., said in a letter describing the findings to HHS Secretary Xavier Beccera. "In many cases, pharmacies are handing over sensitive medical records without review by a legal professional. Although pharmacies are legally permitted to tell their customers about government demands for their data, most don't. As a result, many Americans' prescription records have few meaningful privacy protections, and those protections vary widely depending on which pharmacy they use."
Under a HIPAA rule, Americans may request companies tell them if their data has been disclosed, though few do, the lawmakers said in their letter. They called on HHS to bolster HIPAA's regulations and ensure pharmacies can insist on a warrant.
Spokespeople from CVS, Walgreens and Walmart in comments to The Washington Post said they are compliant with HIPAA. Amazon said they cooperate with law enforcement as required. Rite Aid declined the news outlet's request for comment and other companies had not responded in time for publication.
"We have suggested a warrant or judge-issued subpoena requirement be considered and we look forward to working cooperatively with Congress to strengthen patient privacy protections," CVS spokesperson Amy Thibault told the Post, adding that most investiagtive requests for records come with a directive to keep them confidential. Those that do not specify a confidential directive are considered on "a case-by-case basis" to determine whether it is appropriate to notify a patient.