Pharmacies are sharing private data with police without a warrant, lawmakers say

Americans’ prescription drug records are being shared with law enforcement agencies in some cases without the customer's knowledge and without a judge first signing off on a warrant, according to three U.S. lawmakers.

The finding has Democrats worried that the policies by major retail pharmacy chains -- which are allowed under federal rules -- could help prosecutors in states that have banned or restricted abortion go after residents who help women travel to get abortions.

In a letter to Health and Human Services Secretary Xavier Becerra, the lawmakers said they want the federal government to tighten the rules so pharmacies only release medical records to investigators with a judge's approval.

HHS said it is working on finalizing a rule that would tighten existing privacy rules to protect records related to reproductive health.

"Through briefings with the major pharmacies, we learned that each year law enforcement agencies secretly obtain the prescription records of thousands of Americans without a warrant," they wrote. "In many cases, pharmacies are handing over sensitive medical records without review by a legal professional. Although pharmacies are legally permitted to tell their customers about government demands for their data, most don’t."

The letter, first reported by The Washington Post, followed a lengthy congressional investigation by Democrats into medical privacy following the U.S. Supreme Court decision to overrule Roe vs. Wade. It was signed by Senate Commerce Committee Chairman Ron Wyden, D-Oregon, and Democratic Reps. Pramila Jayapal of Washington and Sara Jacobs of California.

The pharmacies mentioned in the letter say they are following privacy laws and federal health rules, which don’t require a judge-signed warrant. In many cases, law enforcement present subpoenas signed by a government agency but not reviewed by a judge.

CVS Health, which is among the pharmacies named in the letter, said it has suggested a warrant or judge-issued subpoena requirement be considered by regulators. And, the company notes, it relies on a legal team to ensure all requests are compliant with the law.

"Most investigative requests from regulatory agencies and law enforcement require us by law to keep the request confidential," CVS wrote in a statement provided to ABC News. "If a request does not have a confidentiality directive, we consider on a case-by-case basis whether it’s appropriate to notify the individual who is the subject of the request."

According to the letter to Becerra, pharmacies are dealing with tens of thousands of requests a year, mostly tied to civil litigation, not criminal cases.

The issue is likely to take on increased urgency for Democrats as states remain divided on abortion access and some counties pursue laws against what they call "abortion trafficking," or helping a woman travel out of state for an abortion.

Under federal regulation, mifepristone can be prescribed virtually to patients up to 10 weeks of gestation and picked up at a local pharmacy so long as the pharmacy follows certain rules. While the patient must be located in a state where abortion is legal to obtain the drug, pharmacy access has enabled overwhelmed abortion providers in states like California, Colorado and Illinois to serve more patients via virtual clinics.

Meanwhile, anti-abortion rights groups have sued to try to remove mifepristone from the market. The Supreme Court on Wednesday agreed to take up the case, likely ruling on by next summer.

Among the concerns by lawmakers and privacy experts is that big pharmacy chains have access to a person’s medical records across multiple states and could be pulled by prosecutors seeking to clamp down on people who help women travel.

Wyden and the other lawmakers say the Biden administration should require under health privacy law -- the Health Insurance Portability and Accountability Act, or HIPAA -- that a warrant be presented before sensitive information is shared by a pharmacy. They also want pharmacies to alert customers when that happens, unless a judge agrees that would hinder an investigation.

Last spring, HHS proposed changes to the HIPAA privacy rule to specifically protect data related to reproductive health services. Until that rule becomes final, the existing laws though remain in effect.

The Biden administration says it encourages people to come forward if they believe their privacy was violated.