Several major pharmacies are handing over customers' medical information to local law enforcement and federal investigators without warrants, a congressional investigation revealed Monday night.
RiteAid, CVS Health, and Kroger representatives said the companies allow pharmacy staff members to give law enforcement officers the medical records of customers, including prescription history, in stores without proof of a warrant. The companies also do not have a policy in place that requires the staff to notify customers when they share the information.
SHADOW OF DOUBT: HOW 2020 ELECTION CHALLENGES IN ARIZONA AND GEORGIA ENDED
Lawmakers notified the Department of Health and Human Services about the relaxed pharmacy policies in a letter on Monday, which was signed by Senate Finance Committee Chairman Ron Wyden (D-OR) and Reps. Pramila Jayapal (D-WA) and Sara Jacobs (D-CA).
“Through briefings with the major pharmacies, we learned that each year law enforcement agencies secretly obtain the prescription records of thousands of Americans without a warrant," the lawmakers told Health and Human Services Secretary Xavier Becerra in the letter. "In many cases, pharmacies are handing over sensitive medical records without review by a legal professional. Although pharmacies are legally permitted to tell their customers about government demands for their data, most don’t."
Representatives from five of the eight companies that the lawmakers spoke to said they require demands for pharmacy records to be reviewed by legal professionals before a response is sent, but they said they do not require a warrant. The lawmakers said the records are provided in response to a “mere subpoena," instead.
The other companies were Walgreens Boots Alliance, Cigna, Optum Rx, Walmart, and Amazon Pharmacy. Amazon does notify customers if law enforcement sought out their medical records.
A CVS Health spokeswoman said the company's processes are consistent with the Health Insurance Portability and Accountability Act, which is a federal law that helps protect patient privacy. Other chains also noted that their policies were in line with HHS regulations, which allow them to disclose records if required by law or pursuant to a legal process.
“The Office for Civil Rights, the agency that enforces HIPAA, has reviewed our processes on multiple occasions and deemed them to be compliant,” CVS Health spokeswoman Amy Thibault told the Washington Examiner in a statement. "Additionally, our processes are consistent with industry practices."
Thibault added that the pharmacy has suggested a warrant or judge-issued subpoena requirement be considered company-wide moving forward. CVS will also be issuing transparency reports about third-party record requests, including those from regulatory agencies and law enforcement. The first report will be published in the first quarter of 2024.
The lawmakers have urged the department to strengthen its guidelines as a result of the investigation to align more closely with the public's reasonable expectation of privacy.
CLICK HERE TO READ MORE FROM THE WASHINGTON EXAMINER
“Pharmacies can and should insist on a warrant, and invite law enforcement agencies that insist on demanding patient medical records with solely a subpoena to go to court to enforce that demand," the lawmakers wrote. "The requirement for a warrant is exactly the approach taken by tech companies to protect customer privacy.”
The Washington Examiner has reached out to HHS for comment.