Comer and Higgins Investigate CVS Health’s Use of Confidential Patient Information to Lobby Louisiana State Legislature

WASHINGTON—House Committee on Oversight and Government Reform Chairman James Comer (R-Ky.) and Subcommittee on Federal Law Enforcement Chairman Clay Higgins (R-La.) are investigating recent reports that CVS Health used confidential patient information to lobby and influence members of the Louisiana State Legislature related to House Bill 358 (H.B. 358). In a letter to CVS Health President and CEO David Joyner, Chairman Comer and Subcommittee Chairman Higgins request documents and communications concerning CVS Health’s use of confidential patient information in Louisiana and all other states covering the time period of January 1, 2020 to the present.

“H.B. 358 would prohibit providers in Louisiana from operating both [Pharmacy Benefit Managers] and individual pharmacies. If the bill were signed into law, CVS Health, and its subsidiaries, would not be permitted to continue simultaneously operating CVS Caremark and its 119 Louisiana CVS Pharmacy locations. This apparent conflict of interest is problematic because CVS Caremark manages prescription drug plans for thousands of Louisianians and also contracts with the [Office of Group Benefits], the insurance provider for Louisiana state employees,” wrote the lawmakers. “This text message campaign raises ethical and potential legal issues if indeed CVS Pharmacy used confidential patient information, obtained through a state contract, to lobby against H.B. 358. The inflammatory and misleading text messages—which included threats of pharmacy location closures, increased prescription costs, and loss of service providers—sought to encourage CVS Pharmacy customers to contact Louisiana lawmakers to oppose the bill. This is concerning because CVS Pharmacy must comply with the Health Insurance Portability and Accountability Act (HIPAA) to access confidential patient information.” 

Personal information provided by patients for the purpose of receiving health care and prescription drug coverage services, including their phone numbers, email addresses, home addresses, or Social Security numbers, were used by CVS Health to send a “mass text message” to thousands of Louisiana CVS customers to influence Louisiana legislators against voting for H.B. 358. This letter is part of the Committee’s ongoing effort to hold Pharmacy Benefit Managers (PBMs) accountable for their lack of transparency toward American consumers, engagement in anticompetitive behavior, and inflation of drug costs. Americans deserve to have their personal information protected by health care services without having to worry about it being used for unlawful political tactics. 

“The HIPAA Privacy Rule does not include political advocacy or lobbying among the list of ‘uses and disclosures that may be made of patient information without an individual’s authorization.’ CVS Pharmacy routinely uses its mass text messaging system to notify patients about prescription updates and other individualized patient information. Therefore, it appears CVS Health’s use of protected patient information for the purposes of political advocacy may represent a violation of HIPAA. Further, given the wide breadth of CVS Health and its subsidiaries operations across the U.S., CVS Health could easily misuse confidential patient information in the future when similar legislative measures to Louisiana H.B. 358 are considered in other states or Congress,” concluded the lawmakers.

Read the letter to CVS Health here.