Congressional investigation: Pharmacies give medical data to police

FORT LAUDERDALE, Fla. (NewsNation) — A congressional investigation has revealed that some of the nation’s leading pharmacy chains have handed over Americans’ medical records to law enforcement without a warrant and without customers’ knowledge or consent.

Lawmakers say this could pose a threat to Americans’ rights to medical privacy, and believe the Department of Health and Human Services (HHS) could be key to fixing this problem.

The investigation started back in June. Lawmakers looked into policies from eight pharmacy chains including Walgreens Boots Alliance, Walmart, Rite Aid, Amazon Pharmacy and CVS.

When it came to law enforcement requests, investigators found that pharmacy giants instructed their staff to disclose sensitive documents to the police. However, it was also found that the policies differ on whether or not the pharmacy needs to contact the customer.

CVS Health, the Kroger Company and Rite Aid Corporation fail to require legal review before submitting patient records to law enforcement.

None of the eight companies require a warrant before sharing patient records.

The investigation found that only Amazon Pharmacy alerts patients when it shares records with law enforcement.

Lawmakers sent a letter to HHS, pressing the department to overhaul the HIPAA regulations and make the policies clearer to ensure pharmacies ask for a warrant before handing over any medical records.

Data privacy partner Dominique Shelton Leipzig told NewsNation that without these hard lines, pharmacies are put in an awkward position.

“That puts companies that have customers whose data has been entrusted to them in a very awkward position,” Shelton Leipzig said.

She continued, “Usually, there’s a process for dealing with law enforcement requests. But on the spot, employees might feel intimidated or scared to stick to company policy, resulting in privacy issues that become things that the company needs to address.”

NewsNation reached out to the pharmacies that were named in the letter to HHS.

CVS Pharmacy responded to the request with a statement, saying most of its requests from law enforcement require confidentiality and those that don’t are reviewed on a case-by-case basis. The company went on to say it is committed to safeguarding the personal health information of its patients.

Amazon Pharmacy said it cooperates with law enforcement and complies with court orders. However, the company does notify customers prior to disclosing any health information if there is no legal prohibition to doing so.

NewsNation reached out to the HHS to see what’s being done to ensure the privacy of Americans’ medical records but have not yet received a response.