Health Information Compliance Alert

Pharmacy giant CVS Corp. will have to defend itself against a class-action lawsuit that may help determine how far pharmacists and pharmacies must go to protect the confidentiality of their customers' medical records.

The Appelate Division of the Supreme Court of New York April 4 unanimously affirmed a trial court's March 2001 decision in Anonymous v. CVS Corp. that certified a class of New Yorkers who are suing the national pharmacy chain over its practice of buying patient information from independent pharmacies that go out of business.

The suit which charges CVS with deceptive business practices and breach of fiduciary duty in violation of customers' rights to confidentiality stems from CVS' 1999 purchase of Trio Drugs' customer prescription records and medical profiles.

The lead plaintiff in the case, a New York man diagnosed with AIDS and HIV, says he originally chose Trio a local, independent pharmacy as his pharmacy because he expected it would keep his medical information private. However, when Trio went out of business, CVS allegedly bought the small pharmacy's prescription records including the plaintiff's as part of its "independent file buy program."

After the purchase, information from the prescription files and profiles was allegedly integrated with CVS' nationally networked computer database. As a result, the anonymous plaintiff contends that his confidential information is now accessible to thousands of CVS store employees and the health care plans and managed care providers that CVS services.

The suit also charges that as a condition of the file buy program CVS required the independent pharmacies to not give advance notice to customers that it was selling their medical profiles and prescription information, or that the store was closing.

In trying to defeat the class certification, CVS argued that the class should not be certified because the court would have to make "individualized inquiries" to determine which plaintiffs had not received proper notice about the transfer of their records.

The appellate panel, however, found that argument "difficult to understand" since CVS had already admitted that "the lack of prior notice to the customers was a standard feature of the program." As such, the court ruled, those customers that did receive notice, contrary to the general practice, "can be easily ascertained [and] excluded from the class."

The class includes "all persons whose medical and/or prescription information was purchased or acquired without their knowledge or consent by CVS Corp from an independent pharmacy in New York during the six-year period" between Oct. 20, 1993 and Oct. 20, 1999.

According to court documents, CVS aquired customer files from 350 independent pharmacies in 1998 alone.