Probe Shows No Warrant Needed for Pharmacy Information

The nation’s largest pharmacy chains reportedly turn over patients’ medical records to law enforcement officers even if they do not have a warrant, according to the results of a congressional investigation that began after the Supreme Court’s decision ending the constitutional right to an abortion. 

According to a letter sent late Monday from to Department of Health and Human Services Secretary Xavier Becerra, CVS Health, Kroger, and Rite Aid tell pharmacy staff employees to respond to demands for law enforcement immediately, Axios reported.

The letter was signed by Sen. Ron Wyden, D-Ore., and Reps. Pramila Jayapal, D-Wash., and Sara Jacobs, D-Calif.,

In addition, the letter reported that five other chains don’t require warrants unless there is a state law mandating them: Amazon, Cigna, Optum Rx, Walmart, and Walgreens Boots Alliance. Still, they do require that legal professionals review demands from law enforcement officials before employees respond. 

The lawmakers began investigating medical records privacy after the Dobbs decision because since pharmacy chain records are shared between different states, law enforcement officials in states where there are abortion bans can seek records to determine if a person received reproductive care in a state that allows abortions, The Washington Post reported.

“Americans’ prescription records are among the most private information the government can obtain about a person,” the letter to Becerra read. “They can reveal extremely personal and sensitive details about a person’s life, including prescriptions for birth control, depression or anxiety medications, or other private medical conditions.”

Officials from 19 states earlier this year objected to a proposed federal rule that would expand Health Insurance Portability and Accountability Act (HIPAA) guidelines so they keep out-of-state health information from going across state lines. 

Meanwhile, patients must request medical record disclosure data from their healthcare providers, even if they have the right to know who has requested information, the report notes. 

“Few people ever request such information, even though many would obviously be concerned to learn about disclosures of their private medical records to law enforcement agencies,” lawmakers said in the letter. 

Officials with eight American pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx, and Amazon Pharmacy — told investigators that their companies require only a subpoena and not a warrant to share records, The Post reported.

Unlike a warrant, a subpoena can be issued by any government agency and does not require approval from a judge. For a warrant, a judge must be convinced by law enforcement that the information sought is needed to investigate a crime. 

Amazon Pharmacy’s policy requires that customers are notified about law enforcement demands for patient records unless it is prohibited by state law, the letter said, adding that CVS Health reports that only a handful of people seek such information.

Amy Thibault, a CVS spokesperson, said the company has suggested a warrant or judge’s subpoena be required before pharmacies turn over data to law enforcement, but she said at this point the company complies with HIPAA standards and industry practices. 

The company also said in a statement that its teams are “trained on how to appropriately respond to lawful requests from regulatory agencies and law enforcement.”

Rite Aid declined to comment about the letter, and representatives from the other companies did not respond immediately to Axios’ requests for comment. 

The lawmakers’ letter said Walgreens and Kroger have committed recently to publishing annual transparency reports about the demands from law enforcement, and CVS said it will issue its first report on the matter after the first of the year.