Millions of Americans flowing through retail pharmacies to receive vaccines from Covid have no choice but to hand over their personal information to these companies, raising red flags for privacy watchers who are pushing for supervision of how pharmacies can use data bonuses. to increase your profits.
© Joe Raedle / Getty Images
A nurse administers a vaccine at the CVS pharmacy.
Pharmacy chains like CVS Health, Walgreens, Rite Aid and others are playing an increasingly important role in the national inoculation effort, as vaccines become more widely available in the coming weeks. While supplying vaccines alone is not a huge cash gain for retailers, they have been able to collect data on new customers that can be valuable.
Many pharmacies require people to provide at least phone numbers or email addresses when making an appointment. Some others – including Walgreens, Sam’s Club and parent company Walmart and Health Mart Pharmacy – require people to create user accounts online before they can search their websites for still-limited vaccine appointments.
Online store scheduling portals generally do not spell out how companies will use the information customers are providing. Privacy watchdog groups and some members of Congress have expressed concern about whether drugstore chains will use this data for marketing, such as the sale of ibuprofen or other products to deal with the side effects of injections. And they warn that less tech savvy patients looking for appointments may inadvertently join pharmacy loyalty programs that could bombard them with unexpected marketing messages and emails.
“We don’t want people to want to be vaccinated – and, frankly, to protect themselves and their loved ones – in no way taken advantage of,” said Andrew Crawford, a lawyer at the Center for Democracy and Technology.
Some prominent consumer rights organizations, including the Electronic Privacy Information Center, sent a letter on Friday urging a group of attorneys general in the Democratic state to investigate how major pharmacy retailers are using vaccine enrollment data from Covid. They are also putting pressure on these retailers to keep this information separate from marketing or business databases and just collect the minimum amount of information needed for vaccine markings.
The Biden government has bet heavily on retail pharmacies, this week announcing plans to more than double the number of pharmacies that supply vaccines to Covid to 40,000 through a federal program. Federal data shows that the sites are popular with Americans, who are increasingly used to getting annual flu shots at their local pharmacies. The White House did not answer questions about the use of data from Covid vaccine appointments by pharmacies.
Pharmacies say the data they are collecting is important for getting people to vaccinations efficiently and that they are following health privacy rules. And some privacy lawyers point out that pharmacies have ample latitude to collect and use customer data, as long as they are not exploiting confidential health information.
But consumer advocates say there must be stronger limitations on how pharmacies use Covid vaccination data, given the urgency of the health crisis and how difficult it is to find an alternative vaccination site in many cases.
Federal law governing the use of patient health information, HIPAA, prevents pharmacies from sharing customer health data for marketing purposes. But they can use the information to send coupons and promote health services they already offer, such as check-ups or flu shots. There are fewer limitations on what they can do with the data once it eliminates them from identifying details, such as names and contact information, including the potential for making business decisions, legal experts said.
“I don’t want to dismiss people’s concerns about privacy, but that seems like an integral part of what pharmacies do on a daily basis,” like reminders about flu shots and other services, said Trish Wagner, privacy lawyer at Epstein Becker Green.
“As long as the scope is in the confines of the [HIPAA] privacy rule, they can do that, ”she added.
Still, Doriann Cain, a partner at the law firm Faegre Drinker Biddle & Reath, said that things like mandatory online registrations to schedule or search for appointments go beyond what pharmacies normally require for other services like flu shots, when people can often just show up.
“The sheer amount of information they get is probably very valuable to them,” said Cain.
Pharmacies cannot charge patients for vaccines – the government is covering these costs. However, they can charge insurers and the government for the costs of administering the vaccines.
The biggest business game for companies seems to be the opportunity to align loyal customers. During a conference call in February, CVS director Jon Roberts described the company’s “vaccine opportunity” to convert newcomers into long-term customers, starting with the 15 minutes that patients must wait in the store after receiving a Covid injection. During that observation period, he said, store employees could try to sell patients on the company’s MinuteClinics for regular health appointments and CarePass, its paid pharmacy affiliation service.
“We have the email, the text message and the ability to communicate with them on a regular basis,” said Roberts.
CVS spokesman Michael DeAngelis said the company is now using customer data for Covid vaccinations only for appointment confirmations and reminders, but he said using this information for marketing is “an option for the future”. CVS does not ask vaccine candidates to create an online profile until they are ready to schedule an appointment – a phone number is mandatory, but email is optional.
“What I can say in general about our patient programs is that they are accepted, so everything we do is with the consent of our customers,” added DeAngelis.
A Federal Trade Commission spokesman, who did not say whether the consumer protection agency is examining how retail pharmacies are using Covid vaccine data, said companies could be investigated if they mislead customers about how their information are being used.
“If companies tell consumers that they are collecting data for just one purpose, they will not be able to use that data for another purpose,” said the spokesman.
Some lawmakers recently introduced bills that aim to curb the use of data collected by companies to respond to the pandemic, warning that efforts to fight the virus have been hampered by people’s fear of how their personal information could be used. One such measure, the Public Health Emergency Privacy Act, would limit how retailers use vaccine scheduling data.
“The data should be used as intended, with public health agencies and technology companies deploying new digital tools to combat the spread of COVID-19,” said project co-sponsor, Rep. Suzan DelBene (D-Wash .).
The federal government started sending Covid vaccines directly to retail pharmacies in early February, but discussions of the deal began under the Trump administration last fall. Twenty-one national chains and independent pharmacy chains are participating in the federal program, and states have also directed some of the doses they receive from the federal government to pharmacies. CVS and Walgreens are also managing vaccination programs for employees and long-term residents through an agreement signed with the Trump administration.
Concerns about how pharmacies can use customer data did not arise in early discussions with the federal government, said Mitchel Rothholz, chief of staff for the American Pharmacists Association, the industry’s largest commercial group. At the time, he said, the main concern was whether pharmacies would use the data to prioritize their existing customers for vaccine vacancies, rather than following guidelines set by states, he said.
In some cases, vaccine candidates may feel encouraged to apply for customer accounts at pharmacies. Rite Aid, for example, does not require people to make an account to schedule an appointment, but the company notifies registered customers by phone if their health records suggest they are eligible for vaccines when unused doses are available, said one POLITICAL spokesperson.
Privacy experts said some retail pharmacies have been better than others at separating vaccine markings from marketing efforts. The Albertsons supermarket chain, when securing a vaccine slot, allows people to choose to receive Covid-related marketing information about vaccines or general marketing disclosure, rather than registering it automatically.
Of networks that require people to create user accounts before looking for an appointment, Walgreens and Health Mart have people enter their phone numbers and emails. Walmart and Sam’s Club did not answer several questions about what data they collect and how it is used.
Keep reading