www.washingtonpost.com
Open in
urlscan Pro
23.73.245.87
Public Scan
Submitted URL: https://e.email.forbes.com/c2/869:6578da2716af52ee800c49ff:ot:5fdcf407b52f2e83d75d4e70:1/6418cc0e?jwtH=eyJ0eXAiOiJKV1QiLCJh...
Effective URL: https://www.washingtonpost.com/technology/2023/12/12/pharmacy-records-police-privacy-abortion/
Submission: On December 15 via api from CA — Scanned from CA
Effective URL: https://www.washingtonpost.com/technology/2023/12/12/pharmacy-records-police-privacy-abortion/
Submission: On December 15 via api from CA — Scanned from CA
Form analysis 1 forms found in the DOM
<form class="w-100 left" id="registration-form" data-qa="regwall-registration-form-container">
<div>
<div class="wpds-c-giPdwp wpds-c-giPdwp-iPJLV-css">
<div class="wpds-c-iQOSPq"><span role="label" id="radix-0" class="wpds-c-hdyOns wpds-c-iJWmNK">Enter email address</span><input id="registration-email-id" type="text" aria-invalid="false" name="registration-email"
data-qa="regwall-registration-form-email-input" data-private="true" class="wpds-c-djFMBQ wpds-c-djFMBQ-iPJLV-css" value="" aria-labelledby="radix-0"></div>
</div>
</div>
<div class="dn">
<div class="db mt-xs mb-xs "><span role="label" id="radix-1" class="wpds-c-hdyOns"><span class="db font-xxxs gray-darker pt-xxs pb-xxs gray-dark" style="padding-top: 1px;"><span>By selecting "Start reading," you agree to The Washington Post's
<a target="_blank" style="color:inherit;" class="underline" href="https://www.washingtonpost.com/information/2022/01/01/terms-of-service/">Terms of Service</a> and
<a target="_blank" style="color:inherit;" class="underline" href="https://www.washingtonpost.com/privacy-policy/">Privacy Policy</a>.</span></span></span>
<div class="db gray-dark relative flex pt-xxs pb-xxs items-start gray-darker"><span role="label" id="radix-2" class="wpds-c-hdyOns wpds-c-jDXwHV"><button type="button" role="checkbox" aria-checked="true" data-state="checked" value="on"
id="mcCheckbox" data-testid="mcCheckbox" class="wpds-c-bdrwYf wpds-c-bdrwYf-bnVAXI-size-125 wpds-c-bdrwYf-kFjMjo-cv wpds-c-bdrwYf-ikKWKCv-css" aria-labelledby="radix-2"><span data-state="checked"
class="wpds-c-jMIrVo wpds-c-jMIrVo-bnVAXI-size-125 wpds-c-jMIrVo-kPVFeW-variant-primary wpds-c-jMIrVo-kPVFeW-cv" style="pointer-events: none;"><span class="wpds-c-bUoCwW"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"
fill="currentColor" aria-hidden="true" focusable="false" role="img">
<path d="M5.85 11.56 2.5 8.21l.71-.71 2.64 2.65L12.5 3.5l.71.71-7.36 7.35z"></path>
</svg></span></span></button><input type="checkbox" aria-hidden="true" tabindex="-1" value="on" checked=""
style="transform: translateX(-100%); position: absolute; pointer-events: none; opacity: 0; margin: 0px; width: 0px; height: 0px;"><span class="wpds-c-bFeFXz"><span class="relative db gray-darker" style="padding-top: 2px;"><span
class="relative db font-xxxs" style="padding-top: 1px;"><span>The Washington Post may use my email address to provide me occasional special offers via email and through other platforms. I can opt out at any
time.</span></span></span></span></span></div>
</div>
</div>
<div id="subs-turnstile-hook" class="center dn"></div><button data-qa="regwall-registration-form-cta-button" type="submit"
class="wpds-c-kSOqLF wpds-c-kSOqLF-kXPmWT-variant-cta wpds-c-kSOqLF-eHdizY-density-default wpds-c-kSOqLF-ejCoEP-icon-left wpds-c-kSOqLF-ikFyhzm-css w-100 mt-sm"><span>Start reading</span></button>
</form>Text Content
Accessibility statementSkip to main content Democracy Dies in Darkness SubscribeSign in Close The Washington PostDemocracy Dies in Darkness TechHelp Desk Artificial Intelligence Internet Culture Space Tech Policy TechHelp Desk Artificial Intelligence Internet Culture Space Tech Policy PHARMACIES SHARE MEDICAL DATA WITH POLICE WITHOUT A WARRANT, INQUIRY FINDS THE REVELATION COULD SHAPE THE DEBATE OVER AMERICANS’ HEALTH PRIVACY AS STATES MOVE TO CRIMINALIZE ABORTION AND DRUGS RELATED TO REPRODUCTIVE HEALTH By Drew Harwell December 12, 2023 at 7:00 a.m. EST A CVS store in D.C. in 2020. (Michael Robinson Chavez/The Washington Post) Listen 6 min Share Comment on this storyComment2427 Add to your saved stories Save The nation’s largest pharmacy chains have handed over Americans’ prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy. Tech is not your friend. We are. Sign up for The Tech Friend newsletter.ArrowRight Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store. The policy was revealed in a letter sent late Monday to Xavier Becerra, the secretary of the Department of Health and Human Services, by Sen. Ron Wyden (D-Ore.) and Reps. Pramila Jayapal (D-Wash.) and Sara Jacobs (D-Calif.). Story continues below advertisement The members began investigating the practice after the Supreme Court’s decision last year in Dobbs v. Jackson Women’s Health Organization ended the constitutional right to abortion. Advertisement The revelation could shape the debate over Americans’ expectations of privacy as Texas and other states move to criminalize abortion and drugs related to reproductive health. Pharmacies’ records hold some of the most intimate details of their customers’ personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control. Because the chains often share records across all locations, a pharmacy in one state can access a person’s medical history from states with more-restrictive laws. Carly Zubrzycki, an associate professor at the University of Connecticut law school, wrote last year that this could link a person’s out-of-state medical care via a “digital trail” back to their home state. Now for sale: Data on your mental health The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement. Advertisement Story continues below advertisement In briefings, officials with eight American pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records. A subpoena can be issued by a government agency and, unlike a court order or warrant, does not require a judge’s approval. To obtain a warrant, law enforcement must convince a judge that the information is vital to investigate a crime. Officials with CVS, Kroger and Rite Aid said they instruct their pharmacy staff members to process law enforcement requests on the spot, saying the staff members face “extreme pressure to immediately respond,” the lawmakers’ letter said. Story continues below advertisement The eight pharmacy giants told congressional investigators that they collectively received tens of thousands of legal demands every year, and that most were in connection with civil lawsuits. It’s unclear how many were related to law enforcement demands, or how many requests were fulfilled. Advertisement Only one of the companies, Amazon, said it notified customers when law enforcement demanded its pharmacy records unless there was a legal prohibition, such as a “gag order,” preventing it from doing so, the lawmakers said. Americans can request the companies tell them if they’ve ever disclosed their data under a HIPAA “accounting of disclosure” rule, but very few people do. CVS, which has more than 40,000 pharmacists and 10,000 stores in the United States, said it received a “single-digit number” of such consumer requests last year, the letter states. Story continues below advertisement CVS, the country’s largest pharmacy by prescription revenue, said in a statement that it is compliant with HIPAA and that its pharmacy teams are “trained on how to appropriately respond to lawful requests from regulatory agencies and law enforcement.” Advertisement “We have suggested a warrant or judge-issued subpoena requirement be considered and we look forward to working cooperatively with Congress to strengthen patient privacy protections,” company spokeswoman Amy Thibault said. Share this articleShare Most investigative requests come with a directive requiring the company to keep them confidential, she said; for those that don’t, the company considers “on a case-by-case basis whether it’s appropriate to notify the individual.” The company intends to begin publishing a transparency report that will include information on third-party record requests starting in the first quarter of next year, she said. Story continues below advertisement HHS did not immediately respond to requests for comment. A Walgreens spokesman said the company’s law enforcement process follows HIPAA and other applicable laws. A Walmart spokeswoman said the company takes its “customers’ privacy seriously as well as our obligation to law enforcement.” Advertisement An Amazon spokeswoman said that the company cooperates with law enforcement requests as required and that such requests “represent a very small percentage of the prescriptions we fill for customers.” (Amazon founder Jeff Bezos owns The Washington Post, and interim Post CEO Patty Stonesifer is a member of Amazon’s board.) Rite Aid declined to comment. The other companies did not respond to requests for comment. Story continues below advertisement Carmel Shachar, an assistant clinical professor at Harvard Law School who researches health law and policy, said that pharmacies hold a “ton of sensitive data” and that pharmacists are probably not trained to evaluate the merits or validity of a police request — or to turn an officer down. “These need to go to someone who understands privacy law for review,” she said. “It probably feels very nerve-racking to get a subpoena and tell the person who gave it to you, ‘Oh, you’ll have to wait.’” States where abortion is legal, banned or under threat The pharmacy data could be especially concerning for the nearly 1 in 3 women ages 15 to 44 who a Post analysis found live in states where abortion is fully or mostly banned. Advertisement Story continues below advertisement In Texas, Attorney General Ken Paxton (R) has warned pharmacies they could face criminal charges for providing women with “abortion-inducing drugs.” Kate Cox, a Dallas-area mother of two who sought an abortion after learning her fetus had a fatal genetic condition, left the state on Monday after the Texas Supreme Court blocked a lower-court ruling that would have allowed her to get the procedure. Some states, such as Louisiana, Montana and Pennsylvania, offer additional protections for medical data disclosure, though federal law enforcement is not subject to their laws. In their letter, the lawmakers called on HHS to strengthen HIPAA’s rules and ensure pharmacies insist on a warrant, which would require law enforcement go to court to enforce such requests. Story continues below advertisement The lawmakers noted that the tech industry had adopted a similar change in the early 2010s, when Google, Microsoft and Yahoo began demanding to see warrants before providing data on customers’ emails. They also urged the companies to proactively notify customers and to publish regular transparency reports highlighting the volume of law enforcement requests. “Americans deserve to have their private medical information protected at the pharmacy counter,” they wrote. Share 2427 Comments Loading... Subscribe to comment and get the full experience. Choose your plan → Advertisement TOP STORIES Technology Big Tech news and how to take control of your data and devices Analysis|My AI Christmas card is totally fake — but the joy is real Tesla recalls 2 million cars with ‘insufficient’ Autopilot safety controls Meet the woman working to stop the far-right creator money machine Refresh Try a different topic Sign in or create a free account to save your preferences Advertisement Advertisement Company About The Post Newsroom Policies & Standards Diversity & Inclusion Careers Media & Community Relations WP Creative Group Accessibility Statement Sitemap Get The Post Become a Subscriber Gift Subscriptions Mobile & Apps Newsletters & Alerts Washington Post Live Reprints & Permissions Post Store Books & E-Books Print Archives (Subscribers Only) Today’s Paper Public Notices Coupons Contact Us Contact the Newsroom Contact Customer Care Contact the Opinions Team Advertise Licensing & Syndication Request a Correction Send a News Tip Report a Vulnerability Terms of Use Digital Products Terms of Sale Print Products Terms of Sale Terms of Service Privacy Policy Cookie Settings Submissions & Discussion Policy RSS Terms of Service Ad Choices washingtonpost.com © 1996-2023 The Washington Post * washingtonpost.com * © 1996-2023 The Washington Post * About The Post * Contact the Newsroom * Contact Customer Care * Request a Correction * Send a News Tip * Report a Vulnerability * Download the Washington Post App * Policies & Standards * Terms of Service * Privacy Policy * Cookie Settings * Print Products Terms of Sale * Digital Products Terms of Sale * Submissions & Discussion Policy * RSS Terms of Service * Ad Choices * Coupons 5.8.2 Already have an account? Sign in -------------------------------------------------------------------------------- TWO WAYS TO READ THIS ARTICLE: Create an account or sign in Free * Access this article Enter email address By selecting "Start reading," you agree to The Washington Post's Terms of Service and Privacy Policy. The Washington Post may use my email address to provide me occasional special offers via email and through other platforms. I can opt out at any time. Start reading BEST VALUE Subscribe CA50¢every week for the first year billed as CA$2 every 4 weeks * Unlimited access to all articles * Save stories to read later Subscribe