Debate Surrounding CVS Lawsuit and Medical Privacy Heats Up

The lawsuit filed by a man with AIDS over the transfer of his pharmacy records has "broken legal ground" and prompted discussions on the extent to which pharmacy records are kept private, the Wall Street Journal reports. The suit, filed against CVS Corp. in a New York state court, contends that the pharmacy chain "illegally obtained" the man's prescription records when it bought a smaller drug store and then, without his consent, entered his medical information into its "huge database." The suit challenges the "common but little-known" practice of "file buying," in which drug store chains purchase prescription files from pharmacies they acquire and then add them to their own databanks. Last year, CVS purchased files from 300 independent pharmacies it acquired. Although file buying is considered an "industry-wide practice," CVS is the only company to be sued over it, according to Richard Lubarsky, an attorney representing the plaintiff. CVS also faces lawsuits in Rhode Island and Massachusetts, where the company has been sued for allowing customer records to be used in drug company-backed direct-mailing campaigns advertising "new or alternative remedies." Only New Jersey and Virginia have laws that require pharmacies to notify customers before selling their information.

Drug store chains consider patient prescription files "coveted assets," because they afford companies "instant access" to potential customers and market share, the Journal reports. However, CVS officials say that file buying can benefit consumers, too, because it allows an "orderly transfer of prescription files" when pharmacies are bought out or taken over. Pharmacy officials add that drug stores also use customer prescription records to send refill reminders to consumers. CVS says that it usually puts a notice on the doors of pharmacies that have been acquired saying that the files have been transferred and directing customers to the nearest CVS store. However, privacy advocates feel these notices are "inadequate and after the fact." Privacy groups also believe that the pharmacy industry's opposition to the new privacy regulations issued by the Clinton administration and put on hold by the Bush administration, "ignores legitimate patient interests." But the industry maintains that blocking access to patient information could hamper efforts to dispense medicine. Phil Schneider, a spokesperson for the National Association of Chain Drug Stores, said, "The regulations could seriously impede the ability of pharmacies to efficiently and timely dispense medicines" (Geyelin, Wall Street Journal, 4/11).