House Committee on Oversight and Government Reform Chairman James Comer (R-Ky.) and Subcommittee on Federal Law Enforcement Chairman Clay Higgins (R-La.) have launched an investigation into CVS Health’s reported use of confidential patient information to lobby against Louisiana House Bill 358. The lawmakers sent a letter to CVS Health President and CEO David Joyner, requesting documents and communications related to the company’s handling of patient data in Louisiana and other states from January 1, 2020, to the present.
“H.B. 358 would prohibit providers in Louisiana from operating both [Pharmacy Benefit Managers] and individual pharmacies. If the bill were signed into law, CVS Health, and its subsidiaries, would not be permitted to continue simultaneously operating CVS Caremark and its 119 Louisiana CVS Pharmacy locations. This apparent conflict of interest is problematic because CVS Caremark manages prescription drug plans for thousands of Louisianians and also contracts with the [Office of Group Benefits], the insurance provider for Louisiana state employees,” wrote the lawmakers. “This text message campaign raises ethical and potential legal issues if indeed CVS Pharmacy used confidential patient information, obtained through a state contract, to lobby against H.B. 358. The inflammatory and misleading text messages—which included threats of pharmacy location closures, increased prescription costs, and loss of service providers—sought to encourage CVS Pharmacy customers to contact Louisiana lawmakers to oppose the bill. This is concerning because CVS Pharmacy must comply with the Health Insurance Portability and Accountability Act (HIPAA) to access confidential patient information.”
According to Comer and Higgins, personal details such as phone numbers, email addresses, home addresses, or Social Security numbers collected by CVS Health for health care services were used in a mass text message campaign aimed at urging customers to oppose H.B. 358. The committee views this action as part of broader concerns about transparency among Pharmacy Benefit Managers (PBMs), including their business practices that may contribute to higher drug costs.
“The HIPAA Privacy Rule does not include political advocacy or lobbying among the list of ‘uses and disclosures that may be made of patient information without an individual’s authorization.’ CVS Pharmacy routinely uses its mass text messaging system to notify patients about prescription updates and other individualized patient information. Therefore, it appears CVS Health’s use of protected patient information for the purposes of political advocacy may represent a violation of HIPAA. Further, given the wide breadth of CVS Health and its subsidiaries operations across the U.S., CVS Health could easily misuse confidential patient information in the future when similar legislative measures to Louisiana H.B. 358 are considered in other states or Congress,” concluded Comer and Higgins.
James Comer has represented Kentucky’s 1st district in Congress since replacing Ed Whitfield in 2016; he previously served in Kentucky’s House from 2001-2012 https://comer.house.gov/about. Born in Carthage, Tennessee in 1972, Comer currently lives in Tompkinsville https://bioguide.congress.gov/search/bio/C001108 after graduating from Western Kentucky University with a BS degree https://www.wku.edu/news/articles/index.php?view=article&articleid=10085.
The committee continues its efforts regarding PBM accountability amid concerns over privacy protections for Americans’ health data.
