Suit: CVS Violating HIPAA Privacy
Six independent pharmacies in Texas have filed a lawsuit against CVS Caremark, charging the national pharmacy chain and mail-order pharmacy benefit management firm with racketeering under the federal RICO law, trade secret misappropriation and violations of the HIPAA privacy rule.
Six independent pharmacies in Texas have filed a lawsuit against CVS Caremark, charging the national pharmacy chain and mail-order pharmacy benefit management firm with racketeering under the federal RICO law, trade secret misappropriation and violations of the HIPAA privacy rule.
The suit alleges privacy violations that started only months after the CVS/pharmacy unit of CVS Caremark in early 2009 agreed to pay a $2.25 million fine and institute corrective action plans following a federal government investigation of potential HIPAA violations.
The plaintiffs are members of American Pharmacies, a Corpus Christi, Texas-based pharmacy wholesale buying organization that is financing the lawsuit. The suit alleges that Woonsocket, R.I.-based CVS Caremark is violating a Federal Trade Commission-mandated firewall between its community pharmacy and pharmacy benefit management business units.
Rather, CVS Caremark has built an information technology platform that straddles all its business segments to collect and analyze patient data for marketing and other purposes in violation of the privacy rule, the suit alleges. "CVS Caremark traps patients and non-CVS retail pharmacies in a scheme to deny patient choice of pharmacy and to smother business competition," says Amanda Cohlke Fields, general counsel at American Pharmacies.
CVS Caremark mines patient- and pharmacy-specific data to identify individual patient buying practices, their physicians' prescribing practices and individual pharmacy business volume, according to a statement from American Pharmacies. "CVS Caremark contacts patients via direct mail and phone calls about their prescriptions, urging, and in come cases mandating, plaintiffs patients to use CVS Caremark retail or mail order stores," according to the statement. "The patients' physicians also are targeted to change prescribing practices to include drugs from CVS Caremark-favored drug makers."
According to the lawsuit, CVS Caremark in the second quarter of 2009 launched the "Consumer Engagement Engine," which is enabled by an enterprise data warehouse built since the merger of CVS and Caremark in 2007. This engine is used by the marketing department to mine data and to contact individual patients and physicians to change their prescription habits, the suit alleges. Patient data available includes demographics, drug history, prescribers, health behaviors (such as suboptimal adherence), health plan design and communication preferences.
"CVS Caremark-owned retail pharmacies, mail-order pharmacies and other CVS call centers then use this data to identify and target potential new CVS Pharmacy retail customers that are currently using competing pharmacy services such as Plaintiffs'," the lawsuit alleges. "CVS Caremark then reaches out to Plaintiffs' patients by mail, in person or by phone and markets CVS Caremark products and services directly to them and/or their prescribing physician(s). In fact, the senior 'Consumer Engagement' job positions at CVS Caremark are all within CVS Caremark Corporation's marketing department."
Asked to comment on the lawsuit, a CVS Caremark spokesperson issued the following statement: "We have learned that a new lawsuit has been filed, but we have not yet had a chance to review its contents. CVS Caremark is confident that its business practices and service offerings, which are designed to reduce health care costs and expand consumer choice, are being conducted in compliance with applicable antitrust, privacy and other laws."
Following allegations of improper protection of patient privacy, CVS/pharmacy in early 2009 agreed to pay a $2.25 million fine and enter into a resolution agreement with the HHS Office for Civil Rights and a consent order with the Federal Trade Commission. CVS/pharmacy in early 2009 had more than 6,300 pharmacies.
The investigation followed media reports in 2006 that several pharmacy chains were disposing of protected health information in unsecured dumpsters outside the stores. CVS denied any wrongdoing and said it settled the matter to avoid the time and expense of further legal proceedings (see story and copies of the resolution and consent agreements).
A copy of the American Pharmacies lawsuit against CVS Caremark is available here.
--Joseph Goedert
The suit alleges privacy violations that started only months after the CVS/pharmacy unit of CVS Caremark in early 2009 agreed to pay a $2.25 million fine and institute corrective action plans following a federal government investigation of potential HIPAA violations.
The plaintiffs are members of American Pharmacies, a Corpus Christi, Texas-based pharmacy wholesale buying organization that is financing the lawsuit. The suit alleges that Woonsocket, R.I.-based CVS Caremark is violating a Federal Trade Commission-mandated firewall between its community pharmacy and pharmacy benefit management business units.
Rather, CVS Caremark has built an information technology platform that straddles all its business segments to collect and analyze patient data for marketing and other purposes in violation of the privacy rule, the suit alleges. "CVS Caremark traps patients and non-CVS retail pharmacies in a scheme to deny patient choice of pharmacy and to smother business competition," says Amanda Cohlke Fields, general counsel at American Pharmacies.
CVS Caremark mines patient- and pharmacy-specific data to identify individual patient buying practices, their physicians' prescribing practices and individual pharmacy business volume, according to a statement from American Pharmacies. "CVS Caremark contacts patients via direct mail and phone calls about their prescriptions, urging, and in come cases mandating, plaintiffs patients to use CVS Caremark retail or mail order stores," according to the statement. "The patients' physicians also are targeted to change prescribing practices to include drugs from CVS Caremark-favored drug makers."
According to the lawsuit, CVS Caremark in the second quarter of 2009 launched the "Consumer Engagement Engine," which is enabled by an enterprise data warehouse built since the merger of CVS and Caremark in 2007. This engine is used by the marketing department to mine data and to contact individual patients and physicians to change their prescription habits, the suit alleges. Patient data available includes demographics, drug history, prescribers, health behaviors (such as suboptimal adherence), health plan design and communication preferences.
"CVS Caremark-owned retail pharmacies, mail-order pharmacies and other CVS call centers then use this data to identify and target potential new CVS Pharmacy retail customers that are currently using competing pharmacy services such as Plaintiffs'," the lawsuit alleges. "CVS Caremark then reaches out to Plaintiffs' patients by mail, in person or by phone and markets CVS Caremark products and services directly to them and/or their prescribing physician(s). In fact, the senior 'Consumer Engagement' job positions at CVS Caremark are all within CVS Caremark Corporation's marketing department."
Asked to comment on the lawsuit, a CVS Caremark spokesperson issued the following statement: "We have learned that a new lawsuit has been filed, but we have not yet had a chance to review its contents. CVS Caremark is confident that its business practices and service offerings, which are designed to reduce health care costs and expand consumer choice, are being conducted in compliance with applicable antitrust, privacy and other laws."
Following allegations of improper protection of patient privacy, CVS/pharmacy in early 2009 agreed to pay a $2.25 million fine and enter into a resolution agreement with the HHS Office for Civil Rights and a consent order with the Federal Trade Commission. CVS/pharmacy in early 2009 had more than 6,300 pharmacies.
The investigation followed media reports in 2006 that several pharmacy chains were disposing of protected health information in unsecured dumpsters outside the stores. CVS denied any wrongdoing and said it settled the matter to avoid the time and expense of further legal proceedings (see story and copies of the resolution and consent agreements).
A copy of the American Pharmacies lawsuit against CVS Caremark is available here.
--Joseph Goedert
More for you
Loading data for hdm_tax_topic #better-outcomes...