Lawmakers want HHS to revise health privacy law to require warrants.
All of the big pharmacy chains in the US hand over sensitive medical records to law enforcement without a warrant—and some will do so without even running the requests by a legal professional, according to a congressional investigation.
The revelation raises grave medical privacy concerns, particularly in a post-Dobbs era in which many states are working to criminalize reproductive health care. Even if people in states with restrictive laws cross state lines for care, pharmacists in massive chains, such as CVS, can access records across borders.
Lawmakers noted the pharmacies’ policies for releasing medical records in a letter dated Tuesday to the Department of Health and Human Services (HHS) Secretary Xavier Becerra. The letter—signed by Sen. Ron Wyden (D-Ore.), Rep. Pramila Jayapal (D-Wash.), and Rep. Sara Jacobs (D-Calif.)—said their investigation pulled information from briefings with eight big prescription drug suppliers.
How is this not a HIPAA violation?
The HIPAA Privacy Rule exception for law enforcement purposes, 45 CFR § 164.512(f), permits a covered entity (generally, healthcare providers, health plans and their business associates) to disclose PHI to law enforcement officials without patient authorization under certain circumstances.
Those pharmacies also have this exception listed in their Privacy Policy. I don’t like it either, but it is legal.