Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

 Key Senate matchups set for November in Maryland, West Virginia

Senators studied AI for a year. Critics call the result ‘pathetic.’

Even remote and hybrid work can burn you out. Here’s how to avoid it.

Look to the cloud to protect the life documents saved on your computer

Can you spot bad financial advice on TikTok? Take our quiz.

5 myths about Social Security as the program faces a funding crisis

How America tried and failed to stay White

After a borderland shootout, a 100-year-old battle for the truth

D.C.’s secret garden

States see legalized sports betting as a tax windfall — but at what cost?

Haiti’s plight is a case study in the ‘responsibility to protect’

No, Apple, people do not want tech to crush everything in its path 

Trump allies call trial a ‘sham.’ Public opinion isn’t cooperating.

Biden and Trump agree to CNN debate in June, ABC faceoff in September

Ask Amy: My mom lied about how much she supported my sister

Carolyn Hax: Aging mom’s increasing anxiety robs child of a valued confidante

Miss Manners: Dinner host hates clearing the table for guests

Biden’s false claim that inflation was 9 percent when he took office

Did Obamacare ‘massively’ increase the cost of health care?

RFK Jr.’s ‘history lesson’ on Russia’s invasion of Ukraine flunks the fact test

U.S. offers aid as Zelensky drops foreign trip due to Russian advance

Slovak Prime Minister Robert Fico shot and gravely injured

A mountainous country loses its last glacier

The new dining reality: Smaller groups and shorter weeks

Commanders will open at Tampa Bay and close against the Cowboys; here’s everything we know

The 26 best new restaurants in the D.C. area

Some cruise prices are about to get a little more clear

When budget flights actually make good budget sense

Tired of overcrowded national parks? Here’s how to go backcountry camping.

Puppy abandoned with heart-rending note is adopted, named Minerva

Man, 91, shocks tiny firehouse with $500K gift: ‘Nobody knew how much I’d saved’

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

Netflix will air NFL’s Christmas games, a major step for streaming service

Sam Feist, longtime CNN executive, will become CEO of C-SPAN

Michael Cohen testimony ties Donald Trump to hush money payment

Angela Alsobrooks Wins Maryland Senate Seat 

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Healthy living, including food, fitness, longevity and mental health

See alerts for Health and Wellness developments

Health & wellness

Tips on living better delivered every Thursday

Well+Being newsletter

Health alerts

Health & Science alerts

Michael Robinson Chavez

The nation’s largest pharmacy chains have handed over Americans’ prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy.

Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store.

The policy was revealed in a <a href="https://www.finance.senate.gov/imo/media/doc/hhs_pharmacy_surveillance_letter_signed.pdf" target=_blank>letter</a> sent late Monday to Xavier Becerra, the secretary of the Department of Health and Human Services, by Sen. Ron Wyden (D-Ore.) and Reps. Pramila Jayapal (D-Wash.) and Sara Jacobs (D-Calif.).

The members began investigating the practice after the Supreme Court’s <a href="https://www.washingtonpost.com/politics/2022/06/24/supreme-court-ruling-abortion-dobbs/" target="_blank">decision</a> last year in <i>Dobbs v. Jackson Women’s Health Organization</i> ended the constitutional right to abortion.

The revelation could shape the debate over Americans’ expectations of privacy as Texas and other states move to criminalize <a href="https://www.washingtonpost.com/abortion/" target="_blank" class="contextual_link">abortion</a> and drugs related to reproductive health.

Pharmacies’ records hold some of the most intimate details of their customers’ personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control.

Because the chains often share records across all locations, a pharmacy in one state can access a person’s medical history from states with more-restrictive laws. Carly Zubrzycki, an associate professor at the University of Connecticut law school, <a href="https://www.yalelawjournal.org/forum/the-abortion-interoperability-trap" target=_blank>wrote</a> last year that this could link a person’s out-of-state medical care via a “digital trail” back to their home state.

The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement.

In briefings, officials with eight American pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records.

A subpoena can be issued by a government agency and, unlike a court order or warrant, does not require a judge’s approval. To obtain a warrant, law enforcement must convince a judge that the information is vital to investigate a crime.

Officials with CVS, Kroger and Rite Aid said they instruct their pharmacy staff members to process law enforcement requests on the spot, saying the staff members face “extreme pressure to immediately respond,” the lawmakers’ letter said.

The eight pharmacy giants told congressional investigators that they collectively received tens of thousands of legal demands every year, and that most were in connection with civil lawsuits. It’s unclear how many were related to law enforcement demands, or how many requests were fulfilled.

Only one of the companies, Amazon, said it notified customers when law enforcement demanded its pharmacy records unless there was a legal prohibition, such as a “<a href="https://www.washingtonpost.com/technology/2021/09/25/tech-subpoena-secrecy-fight/" target=_blank>gag order</a>,” preventing it from doing so, the lawmakers said.

Americans can request the companies tell them if they’ve ever disclosed their data under a HIPAA “accounting of disclosure” rule, but very few people do. CVS, which has more than 40,000 pharmacists and 10,000 stores in the United States, said it received a “single-digit number” of such consumer requests last year, the letter states.

CVS, the country’s largest pharmacy by prescription revenue, said in a statement that it is compliant with HIPAA and that its pharmacy teams are “trained on how to appropriately respond to lawful requests from regulatory agencies and law enforcement.”

“We have suggested a warrant or judge-issued subpoena requirement be considered and we look forward to working cooperatively with Congress to strengthen patient privacy protections,” company spokeswoman Amy Thibault said.

Most investigative requests come with a directive requiring the company to keep them confidential, she said; for those that don’t, the company considers “on a case-by-case basis whether it’s appropriate to notify the individual.” The company intends to begin publishing a transparency report that will include information on third-party record requests starting in the first quarter of next year, she said.

HHS did not immediately respond to requests for comment.

A Walgreens spokesman said the company’s law enforcement process follows HIPAA and other applicable laws. A Walmart spokeswoman said the company takes its “customers’ privacy seriously as well as our obligation to law enforcement.”

An Amazon spokeswoman said that the company cooperates with law enforcement requests as required and that such requests “represent a very small percentage of the prescriptions we fill for customers.” (Amazon founder Jeff Bezos owns The Washington Post, and interim Post CEO Patty Stonesifer is a member of Amazon’s board.)

Rite Aid declined to comment. The other companies did not respond to requests for comment.

Carmel Shachar, an assistant clinical professor at Harvard Law School who researches health law and policy, said that pharmacies hold a “ton of sensitive data” and that pharmacists are probably not trained to evaluate the merits or validity of a police request — or to turn an officer down.

“These need to go to someone who understands privacy law for review,” she said. “It probably feels very nerve-racking to get a subpoena and tell the person who gave it to you, ‘Oh, you’ll have to wait.’”

States where abortion is legal, banned or under threat

The pharmacy data could be especially concerning for the nearly 1 in 3 women ages 15 to 44 who a Post <a href="https://www.washingtonpost.com/politics/2022/06/24/abortion-state-laws-criminalization-roe/" target=_blank>analysis</a> found live in states where abortion is fully or mostly banned.

In Texas, Attorney General Ken Paxton (R) has <a href="https://www.texasattorneygeneral.gov/news/releases/paxton-sends-letters-pharmacies-regarding-fdas-illegal-efforts-encourage-companies-mail-abortion" target="_blank">warned</a> pharmacies they could face criminal charges for providing women with “abortion-inducing drugs.” Kate Cox, a Dallas-area mother of two who sought an abortion after learning her fetus had a fatal genetic condition, <a href="https://www.washingtonpost.com/politics/2023/12/11/kate-cox-texas-abortion/?utm_source=alert&amp;utm_medium=email&amp;utm_campaign=wp_news_alert_revere&amp;location=alert" target="_blank">left the state</a> on Monday after the Texas Supreme Court blocked a lower-court ruling that would have allowed her to get the procedure.

Some states, such as Louisiana, Montana and Pennsylvania, offer additional protections for medical data disclosure, though federal law enforcement is not subject to their laws.

In their letter, the lawmakers called on HHS to strengthen HIPAA’s rules and ensure pharmacies insist on a warrant, which would require law enforcement go to court to enforce such requests.

The lawmakers noted that the tech industry had adopted a similar change in the early 2010s, when Google, Microsoft and Yahoo <a href="https://www.wired.com/2013/01/yahoo-demands-warrants/" target=_blank>began demanding</a> to see warrants before providing data on customers’ emails.

They also urged the companies to proactively notify customers and to publish regular transparency reports highlighting the volume of law enforcement requests.

“Americans deserve to have their private medical information protected at the pharmacy counter,” they wrote.

Finalist for the Livingston Award in 2022. Member of the "Pegasus Project" team that won a George Polk Award in 2021. 

University of Florida

Drew Harwell is a reporter for The Washington Post covering technology. He was a member of an international reporting team that won a George Polk Award in 2021.

Drew Harwell

washpost

Police obtain pharmacy records without a warrant at CVS, Walgreen, Rite-Aid

the-washington-post

The Washington Post

Help Desk

Artificial Intelligence

Internet Culture

Space

Tech Policy

Balance of Power Pair

U.S. House Aggregate

U.S. Senate Aggregate

Tech

prism://prism.query/two-sites,/technology,/politics/powerpost/the-technology-202?limit=20

prism://prism.query/site,/health&limit=20

Health

The Washington Post health section provides coverage and analysis of health, healthcare, nutrition and fitness news.

Well+Being

Well+Being from The Washington Post covers healthy living, including nutrition, fitness, mental health, relationships, chronic illness and disability.

prism://prism.query/site,/politics/courts-law&limit=20

Courts & Law

Latest news and coverage of the U.S. Supreme Court

prism://prism.query/site-articles-only,/politics&limit=20

Cut through the 2024 election noise. Get The Campaign Moment newsletter.

Politics

Post Politics from The Washington Post is the source for political news headlines, in-depth politics coverage and political opinion, plus breaking news on the biden administration and White House, Congress, the Supreme Court, elections and more.