A congressional inquiry has found that law enforcement agencies have accessed the prescription records of thousands of Americans from major pharmacy chains without a warrant, raising concerns about patient privacy.
Three of the largest pharmacy groups — CVS Health, Kroger and Rite Aid — do not require legal review before releasing requested information to law enforcement, the inquiry found. The other five — Walgreens, Cigna, Optum Rx, Walmart and Amazon — said that they do require legal review before honoring such requests.
These policies were revealed in a letter from Senator Ron Wyden of Oregon and Representatives Pramila Jayapal of Washington and Sara Jacobs of California, all Democrats, to the secretary of health and human services, Xavier Becerra.
The inquiry, initiated a year after the Supreme Court ended the constitutional right to an abortion, found that the pharmacies receive tens of thousands of legal requests annually for their patients’ pharmacy records, and a vast majority of the requests were submitted in connection with civil litigation.
Nearly 50 Democratic members of Congress urged the Health and Human Services Department to expand regulations under the Health Insurance Portability and Accountability Act (HIPAA) that would require law enforcement agencies to obtain a warrant to gain access to medical records and would require that patients be notified when their records are requested.
According to the inquiry, CVS, Kroger and Rite Aid “indicated that their pharmacy staff face extreme pressure to immediately respond to law enforcement demands.”
The Health and Human Services Department has already taken steps to protect data involving reproductive health.
The inquiry went on to urge for stronger regulations under HIPAA to more closely align with Americans’ reasonable expectations of privacy and constitutional principles.
In response, a CVS spokeswoman said that the company’s processes are consistent with HIPAA and that they have suggested a warrant or judge-issued subpoena requirement should be considered.
Law professor Michelle Mello argued that requiring a warrant instead of a subpoena for the release of pharmacy records would not necessarily preclude concerns about privacy.
She also said that targeting pharmacy employees, who could be found in contempt of court for not complying with a law enforcement demand for records, adds another layer of complexity.
Efforts by congressional Democrats to strengthen HIPAA may reveal a longstanding misconception about the law.
“People think HIPAA has broader protection than it does,” Professor Mello said. “It wasn’t designed to enable health care providers to resist attempts to enforce laws that impact patients in a negative way.”
