42 votes

Some US pharmacies share medical data with police without a warrant, inquiry finds

13 comments

  1. skybrian
    Link
    From the article: ... ...

    From the article:

    Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store.

    The policy was revealed in a letter sent late Monday to Xavier Becerra, the secretary of the Department of Health and Human Services, by Sen. Ron Wyden (D-Ore.) and Reps. Pramila Jayapal (D-Wash.) and Sara Jacobs (D-Calif.).

    The members began investigating the practice after the Supreme Court’s decision last year in Dobbs v. Jackson Women’s Health Organization ended the constitutional right to abortion.

    ...

    The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement.

    In briefings, officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records.

    A subpoena can be issued by a government agency and, unlike a court order or warrant, does not require a judge’s approval. To obtain a warrant, law enforcement must persuade a judge that the information is vital to investigate a crime.

    Officials with CVS, Kroger and Rite Aid said they instruct their pharmacy staff members to process law enforcement requests on the spot, saying the staff members face “extreme pressure to immediately respond,” the lawmakers’ letter said.

    The eight pharmacy giants told congressional investigators that they collectively received tens of thousands of legal demands every year, and that most were in connection with civil lawsuits. It’s unclear how many were related to law enforcement demands, or how many requests were fulfilled.

    Only one of the companies, Amazon, said it notified customers when law enforcement demanded its pharmacy records unless there was a legal prohibition, such as a “gag order,” preventing it from doing so, the lawmakers said.

    ...

    In their letter, the lawmakers called on HHS to strengthen HIPAA’s rules and ensure pharmacies insist on a warrant, which would require law enforcement go to court to enforce such requests.

    The lawmakers noted that the tech industry had adopted a similar change in the early 2010s, when Google, Microsoft and Yahoo began demanding to see warrants before providing data on customers’ emails.

    16 votes
  2. [12]
    Comment removed by site admin
    Link
    1. ICN
      (edited )
      Link Parent
      It started as a way to target groups Nixon didn't like that would've been illegal to target directly, namely hippies and black people. Link It sticks around because it's useful for many groups...

      I don't know what the point of the drug war was since it can't ever be won

      It started as a way to target groups Nixon didn't like that would've been illegal to target directly, namely hippies and black people. Link It sticks around because it's useful for many groups with power. The police are an arm of the state, states are always going to be in favor of giving more power to themselves, and scary drug dealers offer a convenient excuse to expand police, surveillance, and state power in general, in addition to suppressing groups the people in government often dislike. Private prisons are lucrative, and the war on drugs keeps them well supplied with cheap labor. Police like it because it's an easy excuse for targeting people they don't like ("I smelled marijuana, so I can search without a warrant" "They were definitely carrying drugs when I found them"), and it's extremely lucrative; they get funding to fight drugs, sometimes deal it themselves, and it powers a ton of civil asset forfeiture, which takes more money from US people than burglary does. That the war on drugs can never be won is a bonus; it keeps all the mechanisms that benefit from it secure.

      10 votes
    2. [10]
      skybrian
      Link Parent
      Which parts of the US Constitution are you referring to? More generally, I'm doubtful that in the eighteenth century, people thought that doctors and merchants had a duty to keep customer...

      Which parts of the US Constitution are you referring to?

      More generally, I'm doubtful that in the eighteenth century, people thought that doctors and merchants had a duty to keep customer transactions confidential. What evidence is there of that?

      2 votes
      1. [3]
        gpl
        (edited )
        Link Parent
        Actually, medical confidentiality is a very ancient concept stretching back to the Greeks (in various forms, of course, and motivated out of various reasons). Part of the Hippocratic oath is...

        Actually, medical confidentiality is a very ancient concept stretching back to the Greeks (in various forms, of course, and motivated out of various reasons). Part of the Hippocratic oath is essentially a statement that the doctor will not divulge secrets learned in the course of treatment, so as to not undermine the patient's confidence in treatment. The earliest modern medical ethical codes also contained some acknowledgement of confidentiality. As such, laws even as early as the 17th and 18th centuries acknowledge confidentiality, although they contained many exceptions in which a doctor could be compelled to divulge private medical information if the court deemed it necessary. Still, that is the exception that proves the rule. See A History of Medical Confidentiality for a brief but well written review.

        To be clear, I'm not making a claim on whether this is 'constitutional' and I doubt a right to medical privacy would ever be held to stem from the constitution, considering a right to "general" privacy is not even found there. But I thought it was interesting and wanted to share.

        14 votes
        1. [2]
          skybrian
          (edited )
          Link Parent
          Interesting. Apparently there was an exception: (The article was published in 1989.) I remember seeing a movie about a family that did this in China.

          Interesting. Apparently there was an exception:

          No matter how a physician regarded “professional secrecy”, there was one area in which physicians would exercise their Hippocratic privilege: namely, to conceal from a patient with incurable disease the fatal nature of the illness, but disclose it fully and freely to the family and close friends. This was customary in Britain (but less so in America) until the last two or three decades.

          (The article was published in 1989.)

          I remember seeing a movie about a family that did this in China.

          3 votes
          1. boxer_dogs_dance
            Link Parent
            I have read numerous older books that referenced this practice. I don't remember whether they were all about British society. I do remember reading American accounts, specifically about cancer,...

            I have read numerous older books that referenced this practice. I don't remember whether they were all about British society.

            I do remember reading American accounts, specifically about cancer, where the patient was 'protected' from learning how dangerous their situation was or even that they had cancer at all. It was believed that fear and despair could make the situation worse for the patient.

            Today people are told what they have, but prognosis can be glossed over or softened by doctors

            1 vote
      2. [7]
        Comment removed by site admin
        Link Parent
        1. [6]
          skybrian
          Link Parent
          It’s a fan theory because you’re misreading it. The fourth amendment applies to your own private papers - that is, the government can’t take them from you. It’s not about any third party...

          It’s a fan theory because you’re misreading it.

          The fourth amendment applies to your own private papers - that is, the government can’t take them from you. It’s not about any third party voluntarily cooperating with the government.

          You can tell the police all you like about your neighbor. A merchant you do business with can talk to the cops about you. There are laws about some occupations having a duty to keep some things private (like HIPAA) but apparently they don’t apply in this case.

          But a company can also decide not to “voluntarily” cooperate without a search warrant.

          3 votes
          1. [5]
            Comment deleted by author
            Link Parent
            1. [4]
              skybrian
              (edited )
              Link Parent
              The car analogy fails because the person that a customer record is about isn’t the legal owner of the record. For example, if you send someone a paper letter, it’s now their property, even if it...

              The car analogy fails because the person that a customer record is about isn’t the legal owner of the record.

              For example, if you send someone a paper letter, it’s now their property, even if it contains information about you. You gave it to them. (As first author you do maintain copyright though, so they can’t sell copies.)

              A merchant’s records belong to them, not their customers.

              HIPAA restricts what hospitals and doctors’ offices can do with their records, but they still own the records, not the patients.

              A pharmacy’s computers belong to them. They could refuse to cooperate, in which case the police need a search warrant. If they voluntarily cooperate, well, those records are theirs. (Edit: deleted inaccurate information)

              1 vote
              1. [2]
                boxer_dogs_dance
                Link Parent
                https://www.hipaajournal.com/hipaa-compliance-for-pharmacies/#:~:text=The%20widely%20accepted%20belief%20that,true%20%E2%80%93%20but%20there%20are%20exceptions. This says HIPAA does cover them. I...

                https://www.hipaajournal.com/hipaa-compliance-for-pharmacies/#:~:text=The%20widely%20accepted%20belief%20that,true%20%E2%80%93%20but%20there%20are%20exceptions.

                This says HIPAA does cover them. I am unaware of the relationship between HIPAA and conversations with law enforcement.

                There is also the law about medical privilege, protecting patients from having doctors testify against them.

                3 votes
                1. skybrian
                  Link Parent
                  Thanks for the correction. It seems that’s answered two questions down:

                  Thanks for the correction. It seems that’s answered two questions down:

                  pharmacy (or pharmacy staff) is permitted to – but not required to – disclose PHI to law enforcement officers in the following six circumstances:

              2. [2]
                Comment deleted by author
                Link Parent
                1. skybrian
                  Link Parent
                  Okay, but without evidence, that’s just a fan theory.

                  Okay, but without evidence, that’s just a fan theory.

                  1 vote
          2. [2]
            Comment removed by site admin
            Link Parent
            1. skybrian
              Link Parent
              The fourth amendment is about “searches” and “seizures,” not “asking questions.” The police don’t need a warrant to ask questions. They can ask whoever they want for help. A citizen, believing...

              The fourth amendment is about “searches” and “seizures,” not “asking questions.” The police don’t need a warrant to ask questions. They can ask whoever they want for help. A citizen, believing that it’s socially beneficial for the police to do their jobs, might voluntarily answer them. This isn’t generally considered harassment.