A congressional investigation found that some of the nation's largest pharmacy firms have given Americans' prescription records to police and government investigators without a warrant, the Washington Post reports. Even though some of the pharmacy chains require lawyers to review law enforcement requests, pharmacies such as CVS Health, Kroger and Rite Aid said they allow pharmacy staff to hand over customers' medical records in the store. The policy was disclosed in a letter to Health and Human Services Director Xavier Becerra by Sen. Ron Wyden (D-OR.) and Reps. Pramila Jayapal (D-WA) and Sara Jacobs (D-CA). The members began investigating the practice after the Supreme Court ended the constitutional right to abortion.
The revelation could shape the debate over Americans’ expectations of privacy as Texas and other states move to criminalize abortion and drugs related to reproductive health. Because pharmacy chains often share records across all locations, a pharmacy in one state can access a person’s medical history from states with more-restrictive laws. Carly Zubrzycki, an associate professor at the University of Connecticut law school, wrote that this could link a person’s out-of-state medical care via a “digital trail” back to their home state. The Health Insurance Portability and Accountability Act (HIPAA), regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. The law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement. In briefings, officials with eight pharmacy giants told congressional investigators that they required only a subpoena, not a warrant, to share the records. Americans can request the companies tell them if they’ve ever disclosed their data under a HIPAA “accounting of disclosure” rule, but very few people do.