CVS Busted Again for Sloppy Patient Records Security

CVS was ordered to fork over $2.25 million in a court settlement last month after an Indianapolis TV station went dumpster-diving and surfaced with pharmacy customers’ personal data.

WTHR-TV went on the prowl at Walgreen’s and Rite-Aid, too, and at both Walgreen’s and CVS dumpsters in 11 of 12 cities (Boston, Chicago, Cleveland, Dallas, Denver, Detroit, Louisville, Miami, New Haven (CT), Philadelphia, and Phoenix) it hit a mother lode of patients’ unshredded Social Security numbers, credit card numbers, names, addresses and prescription information, indicating a pattern of haphazard records disposal that put patients at risk for medical identity theft.

Such careless management of confidential medical records is in direct violation of the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules. Interestingly, CVS prominently cites its commitment to the HIPAA law under the Patient Privacy tab on its website.

“The WTHR investigation was initially prompted by news of a grandmother in Bloomington, Indiana, who was robbed at her front door by a thief who found her address in a CVS dumpster,” The Clark Howard Show reported.

Unfortunately, this isn’t the first time CVS has been nabbed for dumping patient records.  The Texas attorney general reached a settlement with CVS exactly one year ago.

Under that agreement, CVS said it would overhaul its information security program with administrative, technical and physical safeguards designed to protect the personal information of CVS customers. CVS also had to pay $315,000 to the state of Texas.

Why, then, are we hearing again about CVS dumping patient medical records?

If you’d like to share your thoughts with CVS, you can contact their director of public relations, Mike DeAngelis, at MJDeangelis@cvs.com.

Tags: cvs, cvs medical records security, medical records security

This entry is filed under Identity Theft News. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.