"Pharmacies share medical data with police without a warrant, inquiry finds" 12 December 2023

The nation’s largest pharmacy chains have handed over Americans’ prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy.

Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store.

The policy was revealed in a letter sent late Monday to Xavier Becerra, the secretary of the Department of Health and Human Services, by Sen. Ron Wyden (D-Ore.) and Reps. Pramila Jayapal (D-Wash.) and Sara Jacobs (D-Calif.).

The members began investigating the practice after the Supreme Court’s decision last year in Dobbs v. Jackson Women’s Health Organization ended the constitutional right to abortion...Pharmacies’ records hold some of the most intimate details of their customers’ personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control...

...In briefings, officials with eight American pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records...

...CVS, the country’s largest pharmacy by prescription revenue, said in a statement that it is compliant with HIPAA and that its pharmacy teams are “trained on how to appropriately respond to lawful requests from regulatory agencies and law enforcement.”

“We have suggested a warrant or judge-issued subpoena requirement be considered and we look forward to working cooperatively with Congress to strengthen patient privacy protections,” company spokeswoman Amy Thibault said.

HHS did not immediately respond to requests for comment.

A Walgreens spokesman said the company’s law enforcement process follows HIPAA and other applicable laws. A Walmart spokeswoman said the company takes its “customers’ privacy seriously as well as our obligation to law enforcement.”

An Amazon spokeswoman said that the company cooperates with law enforcement requests as required and that such requests “represent a very small percentage of the prescriptions we fill for customers.” ...

...Rite Aid declined to comment. The other companies did not respond to requests for comment.