Big pharmacies could give your prescription info to cops without a warrant, Congress finds

Prescription records of thousands of Americans were obtained from pharmacy chains by law enforcement agencies without a warrant, according to a congressional inquiry, and lawmakers are pushing for stricter oversight.

The inquiry by Sen. Ron Wyden of Oregon, the Senate Commerce Committee Chairman, and Reps. Pramila Jayapal of Washington and Sara Jacobs of California, said Tuesday three of the nation's eight major pharmacy chains do not require staff members to contact a lawyer before releasing the information to law enforcement. The three chains were CVS Health, Kroger and Rite Aid.

The findings raised concerns from Democrats about how the pharmacies handle patient privacy as the fight over abortion access nationwide continues. Twenty-one states ban abortion or restrict the procedure after the U.S. Supreme Court overturned the federal right to abortion last year.

In a letter to Health and Human Services Secretary Xavier Becerra on Tuesday, the lawmakers said they want the federal government to strengthen rules so pharmacies only release sensitive medical records to law enforcement with a warrant and a customer's knowledge.

"Through briefings with the major pharmacies, we learned that each year law enforcement agencies secretly obtain the prescription records of thousands of Americans without a warrant," the lawmakers wrote. "In many cases, pharmacies are handing over sensitive medical records without review by a legal professional. Although pharmacies are legally permitted to tell their customers about government demands for their data, most don’t."

Prescription privacy practices of other pharmacy chains also examined

Besides CVS Health, Kroger and Rite Aid, the lawmakers also surveyed the practices of Walgreens, Boots Alliance, Cigna, Optum Rx, Walmart Stores Inc. and Amazon Pharmacy. Among them, the lawmakers said Amazon Pharmacy was the only retailer that said it had a policy of notifying customers when law enforcement requested their records.

The inquiry comes after 47 Democratic congressional members wrote to Becerra in July urging to expand regulations under the federal law restricting the release of medical information. Those members of Congress want the law revised to require law enforcement agencies to seek warrants to gain access to someone's medical records and for that person to be notified when their records are legally requested.

All of the pharmacies surveyed in the lawmakers' inquiry said they don't require a warrant signed by a judge before giving pharmacy records to law enforcement, citing they are following privacy and federal health rules.

The lawmakers noted in their letter that pharmacy records were provided in response to a "mere subpoena."

"To justify this low standard of protection, several pharmacies cited language in HHSregulations that allow healthcare providers to disclose such records if it is required by law, pursuant to legal process, or pursuant to an administrative request," the lawmakers wrote.

CVS, Walgreens and Amazon say they 'look forward' to strengthening privacy protections

In a statement provided to USA TODAY on Wednesday, CVS Health CVS spokeswoman Amy Thibault said the company's patient privacy processes are consistent with the federal law restricting the release of medical information.

"We have suggested a warrant or judge-issued subpoena requirement be considered and we look forward to working cooperatively with Congress to strengthen patient privacy protections," Thibault said. "Most investigative requests from regulatory agencies and law enforcement require us by law to keep the request confidential."

"If a request does not have a confidentiality directive, we consider on a case-by-case basis whether it’s appropriate to notify the individual who is the subject of the request," Thibault added.

Walgreens spokesman Fraser Engerman said in an emailed statement the protection and privacy of its customers' personal data is a priority.

"We have a process in place to assess all law enforcement requests for records that is compliant with HIPAA and other applicable laws," Engerman said. "We look forward to working with Congress to strengthen these protections."

Amazon spokeswoman Jasmine Gossett said in an email that Amazon Pharmacy has a policy of notifying customers when law enforcement requests their records.

"We’re committed to protecting our customers’ privacy — not only because it’s required by law, but because it’s the right thing to do. When required by law, we cooperate with law enforcement officials and comply with court orders," Gossett said. "Amazon Pharmacy notifies a customer prior to disclosing health information to law enforcement as long as there is no legal prohibition to doing so. Requests from law enforcement are rare, and represent a very small percentage of the prescriptions we fill for customers."

The other five pharmacy chains in the inquiry did not immediately respond to requests for comment.

"Americans deserve to have their private medical information protected at the pharmacy counter and a full picture of pharmacies' privacy practices, so they can make informed choices about where to get their prescriptions filled," the members of Congress wrote to Becerra. "If the landscape were made clearer, patients will finally be able to hold pharmacies with neglectful practices accountable by taking their business elsewhere."

Where is abortion banned or protected?A year after the fall of Roe v. Wade, abortion access is reshuffled on state lines

Supreme Court and abortion pill accessIn first major abortion case since Roe's demise, Supreme Court to weigh in on mifepristone restrictions