House Oversight Committee Chairman James Comer (R-Ky.) and Subcommittee on Federal Law Enforcement Chairman Clay Higgins (R-La.) have launched an investigation into CVS Health’s reported use of confidential patient information to lobby against Louisiana House Bill 358. The lawmakers sent a letter to CVS Health President and CEO David Joyner, requesting documents and communications related to the company’s handling of patient data in Louisiana and other states from January 1, 2020, to the present.
The lawmakers stated: “H.B. 358 would prohibit providers in Louisiana from operating both [Pharmacy Benefit Managers] and individual pharmacies. If the bill were signed into law, CVS Health, and its subsidiaries, would not be permitted to continue simultaneously operating CVS Caremark and its 119 Louisiana CVS Pharmacy locations. This apparent conflict of interest is problematic because CVS Caremark manages prescription drug plans for thousands of Louisianians and also contracts with the [Office of Group Benefits], the insurance provider for Louisiana state employees,” wrote the lawmakers. “This text message campaign raises ethical and potential legal issues if indeed CVS Pharmacy used confidential patient information, obtained through a state contract, to lobby against H.B. 358. The inflammatory and misleading text messages—which included threats of pharmacy location closures, increased prescription costs, and loss of service providers—sought to encourage CVS Pharmacy customers to contact Louisiana lawmakers to oppose the bill. This is concerning because CVS Pharmacy must comply with the Health Insurance Portability and Accountability Act (HIPAA) to access confidential patient information.”
According to Comer and Higgins, personal information such as phone numbers, email addresses, home addresses, or Social Security numbers provided by patients for health care services was used by CVS Health in a mass text message campaign targeting thousands of customers in Louisiana. The messages aimed to influence legislative opposition to H.B. 358.
The inquiry is part of an ongoing effort by the committee to address concerns about transparency among Pharmacy Benefit Managers (PBMs), including their impact on drug prices and consumer protections.
The lawmakers further stated: “The HIPAA Privacy Rule does not include political advocacy or lobbying among the list of ‘uses and disclosures that may be made of patient information without an individual’s authorization.’ CVS Pharmacy routinely uses its mass text messaging system to notify patients about prescription updates and other individualized patient information. Therefore, it appears CVS Health’s use of protected patient information for the purposes of political advocacy may represent a violation of HIPAA. Further, given the wide breadth of CVS Health and its subsidiaries operations across the U.S., CVS Health could easily misuse confidential patient information in the future when similar legislative measures to Louisiana H.B. 358 are considered in other states or Congress,” concluded the lawmakers.
James Comer has served as U.S. Representative for Kentucky’s 1st district since 2016 after succeeding Ed Whitfield; he previously served in Kentucky’s state legislature from 2001-2012. Born in Carthage, Tennessee in 1972, Comer resides in Tompkinsville and graduated from Western Kentucky University with a BS degree in 1993.
A copy of the letter sent by Comer and Higgins can be found on their official website.
