House Committee on Oversight and Government Reform Chairman James Comer (R-Ky.) and Subcommittee on Federal Law Enforcement Chairman Clay Higgins (R-La.) have launched an investigation into CVS Health’s reported use of confidential patient information to lobby members of the Louisiana State Legislature regarding House Bill 358 (H.B. 358). The lawmakers sent a letter to CVS Health President and CEO David Joyner, requesting documents and communications about the company’s use of patient data in Louisiana and other states from January 1, 2020, to the present.
“H.B. 358 would prohibit providers in Louisiana from operating both [Pharmacy Benefit Managers] and individual pharmacies. If the bill were signed into law, CVS Health, and its subsidiaries, would not be permitted to continue simultaneously operating CVS Caremark and its 119 Louisiana CVS Pharmacy locations. This apparent conflict of interest is problematic because CVS Caremark manages prescription drug plans for thousands of Louisianians and also contracts with the [Office of Group Benefits], the insurance provider for Louisiana state employees,” wrote the lawmakers. “This text message campaign raises ethical and potential legal issues if indeed CVS Pharmacy used confidential patient information, obtained through a state contract, to lobby against H.B. 358. The inflammatory and misleading text messages—which included threats of pharmacy location closures, increased prescription costs, and loss of service providers—sought to encourage CVS Pharmacy customers to contact Louisiana lawmakers to oppose the bill. This is concerning because CVS Pharmacy must comply with the Health Insurance Portability and Accountability Act (HIPAA) to access confidential patient information.”
According to reports cited by Comer and Higgins, personal details such as phone numbers, email addresses, home addresses, or Social Security numbers provided by patients for health care services were used by CVS Health in a mass text message campaign aimed at influencing legislative action on H.B. 358. The committee’s inquiry is part of broader efforts to examine transparency among Pharmacy Benefit Managers (PBMs), address concerns about anticompetitive practices, and investigate factors contributing to rising drug costs.
“The HIPAA Privacy Rule does not include political advocacy or lobbying among the list of ‘uses and disclosures that may be made of patient information without an individual’s authorization.’ CVS Pharmacy routinely uses its mass text messaging system to notify patients about prescription updates and other individualized patient information. Therefore, it appears CVS Health’s use of protected patient information for the purposes of political advocacy may represent a violation of HIPAA. Further, given the wide breadth of CVS Health and its subsidiaries operations across the U.S., CVS Health could easily misuse confidential patient information in the future when similar legislative measures to Louisiana H.B. 358 are considered in other states or Congress,” concluded Comer and Higgins.
James Comer has represented Kentucky's 1st district in Congress since replacing Ed Whitfield in 2016; he previously served in Kentucky's House of Representatives from 2001 until 2012. Born in Carthage, Tennessee in 1972, Comer currently resides in Tompkinsville. He graduated from Western Kentucky University with a Bachelor of Science degree in 1993.
