If subpoenaed, pharmacy chains hand over customers’ private medical information; lawmakers say warrants should be required
“The nation’s largest pharmacy chains have handed over Americans’ prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy,” reports Drew Harwell of The Washington Post. “Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store.”
Sen. Ron Wyden of Oregon and Reps. Pramila Jayapal of Washington and Sara Jacobs of California, all Democrats, revealed the policy in a letter Monday to Health and Human Services Secretary Xavier Becerra. They investigated the practice “after the Supreme Court’s decision last year in Dobbs v. Jackson Women’s Health Organization ended the constitutional right to abortion,” Harwell reports. In Kentucky, the legislature has banned abortion except to save the woman’s life or prevent serious impairment of a life-sustaining organ.
“Pharmacies’ records hold some of the most intimate details of their customers’ personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control,” Harwell notes. “Because the chains often share records across all locations, a pharmacy in one state can access a person’s medical history from states with more restrictive laws. Carly Zubrzycki, an associate professor at the University of Connecticut law school, wrote last year that this could link a person’s out-of-state medical care via a ‘digital trail’ back to their home state.”
Officials with eight large pharmacy chains — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena from law enforcement, not a warrant issued by a judge, to share the records. The lawmakers said employees face “extreme pressure to immediately respond.” Harwell notes, “To obtain a warrant, law enforcement must convince a judge that the information is vital to investigate a crime.”
The companies told the investigators that they get “tens of thousands of legal demands every year, and that most were in connection with civil lawsuits,” Harwell reports. “It’s unclear how many were related to law enforcement demands, or how many requests were fulfilled. Only one of the companies, Amazon, said it notified customers when law enforcement demanded its pharmacy records unless there was a legal prohibition, such as a gag order, preventing it from doing so, the lawmakers said.”
The Health Insurance, Portability and Accountability Act allows Americans to ask drug companies if they’ve disclosed their information, “but very few people do,” Harwell reports. “CVS, which has more than 40,000 pharmacists and 10,000 stores in the United States, said it received a ‘single-digit number’ of such consumer requests last year.”
Carmel Shachar, a Harvard Law School professor who studies health law and policy, said pharmacies have a “ton of sensitive data” and pharmacists are likely not trained to “evaluate the merits or validity of a police request — or to turn an officer down,” as Harwell put it. Shachar said, “These need to go to someone who understands privacy law for review. probably feels very nerve-racking to get a subpoena and tell the person who gave it to you, ‘Oh, you’ll have to wait.’”
Harwell writes, “The pharmacy data could be especially concerning for the nearly one in three women ages 15 to 44 who a Post analysis found live in states where abortion is fully or mostly banned,” including Kentucky. “In Texas, Attorney General Ken Paxton has warned pharmacies they could face criminal charges for providing women with ‘abortion-inducing drugs,'” which are used for most abortions in the U.S.