In a letter released by Congress, the legislative branch urges revised HIPAA regulations to protect medical records.
What happened
When the Supreme Court overturned Roe v. Wade, it led to concerns regarding pharmacy medical records. Records are often shared between states, and with abortion bans, law enforcement could seek pharmacy records to determine if someone received reproductive care in a different state. Following the Supreme Court ruling, Congress began investigating the sharing of records.
What’s new
The letter, addressed to the Secretary of the Department of Health & Human Services (HHS), documented Congress’ findings and what they hoped the HHS would do. The writers contacted seven large pharmacy chains, including CVS Health, Walgreens Boots Alliance, Cigna, Optum Rx, Walmart Stores, the Kroger Company, Rite Aid Corporation, and Amazon Pharmacy.
Through policy briefings, it became clear that privacy practices vary greatly. The investigators discovered that 5 of the aforementioned companies, including Amazon, Cigna, Optum Rx, Walmart, and Walgreens, required law enforcement demands be reviewed by a legal professional before handing over medical documents.
In contrast, CVS Health, The Kroger Company, and Rite Aid Corporation, said that staff are instructed to process requests in-store. Although employees do not have legal training, these companies said they can process the requests and contact the legal team if necessary.
Amazon is the only company that notifies customers if law enforcement has demanded their records.
Going deeper
According to the letter, no surveyed pharmacies require a warrant to share pharmacy records with law enforcement unless state laws require it.
The pharmacies defer to HHS on this issue, saying that HIPAA regulations require records to be disclosed if it is “required by law, pursuant to legal process, or pursuant to an administrative request.”
Congress is urging the HHS to strengthen HIPAA regulations to prevent pharmacy records from being shared as freely as they are currently. Congress would like pharmacies to insist on a warrant before providing records.
CVS Health currently publishes annual transparency reports on law enforcement demands, but with congressional urging, Walgreens and Kroger also agreed to publish annual reports.
What was said
The letter discussed a significant discrepancy in how many Americans view their privacy protections and what laws state. Congress urges that HIPAA regulations be strengthened to align more closely with “Americans’ reasonable expectations of privacy and Constitutional principles.”
“These findings underscore that not only are there real differences in how pharmacies approach patient privacy at the pharmacy counter, but these differences are not visible to the American people,” said the authors, adding, “Americans deserve to have their private medical information protected at the pharmacy counter and a full picture of pharmacies’ privacy practices, so they can make informed choices about where to get their prescriptions filled.
The bottom line
How the HHS responds could impact future proposed rulemaking and, thus, impact how pharmacies operate. In the meantime, the probe may help pharmacies reconsider their existing policies and how they affect patients.
Related: HIPAA Compliant Email: The Definitive Guide
Abby Grifno
