House Republicans probe CVS for alleged HIPAA violation

Dive Brief: Two Republican congressmen are investigating CVS over concerns that the company used confidential patient information to lobby against a Louisiana bill that would have forced it to break up its pharmacy business. On Thursday, House Oversight Committee Chair James Comer, R-Ky., and Federal Law Enforcement Subcommittee Chair Clay Higgins, R-La., sent a letter pressing CVS about its June text message campaign to patients, alleging it may have violated the HIPAA privacy law. The letter requests information about CVS’ use of patient data for the purposes of political advocacy in Louisiana and other states over the past five years. A spokesperson for CVS confirmed that the company has received the letter and plans to respond, while defending CVS’ behavior as “consistent with the law.” Dive Insight: The letter stems from reports that on June 11 CVS sent a mass text message to thousands of customers in Louisiana using data that patients shared with the company for prescription drug services. The text threatened that local pharmacies would close and drug prices would rise if Louisiana were to pass H.B. 358, a bill that would prevent companies in the state from operating both pharmacy benefit managers and pharmacies. The text urged recipients to contact their state representatives to oppose the bill, according to local reports. CVS’ behavior appears to breach the HIPAA, the federal law protecting individuals’ personal health information, Comer and Higgins wrote in their letter to CVS CEO David Joyner. “CVS Pharmacy routinely uses its mass text messaging system to notify patients about prescription updates and other individualized patient information,” the letter reads. “Therefore, it appears CVS Health’s use of protected patient information for the purposes of political advocacy may represent a violation of HIPAA.” Louisiana’s attorney general Liz Murrill sent a cease-and-desist letter to CVS the day after the texts went out. CVS denied that its actions represented a violation of HIPAA to the state. Still, Louisiana filed an enforcement action against CVS in state court later that month, alleging that the text message campaign — and CVS’ ownership of both PBM Caremark and pharmacies — broke the state’s trade practices law. CVS operates 119 pharmacies in Louisiana, along with one of the largest PBMs in the nation. That creates an inherent conflict of interest, according to critics of entrenched corporate power in the U.S. pharmaceutical supply chain. It’s a concern shared by antitrust regulators. The Federal Trade Commission has issued two reports highly critical of PBMs, including of their ownership of pharmacies, and is suing Caremark and two other major PBMs for allegedly driving up the cost of insulin in the U.S.