Bob Segall/13 Investigates
The nation's largest pharmacies said the problem was a regional one and they'd fix it.
But a nationwide WTHR investigation shows privacy violations at CVS and Walgreens drugstores are still taking place and stretch far beyond the borders of Indiana. The investigation has prompted pharmacies to announce new policies to protect the privacy of millions of customers at drugstores across the United States.
Over the past six months, 13 Investigates inspected pharmacy dumpsters in more than a dozen cities. The nationwide prescription privacy test found in nearly every city checked, pharmacies failed to protect customers' personal health information by discarding it in unsecured outdoor dumpsters.
13 Investigates found legally-protected patient information on prescription labels, patient information sheets, pill bottles, prescription forms and customer refill lists in dumpsters in and around Boston, Chicago, Cleveland, Dallas, Denver, Detroit, Louisville, Miami, New Haven (Conn.), Philadelphia, and Phoenix.
Washington, D.C., was the only exception. We checked 14 drugstore dumpsters around the nation's capitol and found no patient records.
Woonsocket, RI, proved to be one of the worst towns for prescription privacy. 13 Investigates found 460 patient records in CVS dumpsters in Woonsocket, which is home to CVS world headquarters.
"It's not supposed to work like this," said Mitch Betses, CVS Director of Pharmacy Operations. "It's very upsetting and we're going to have to correct these errors... customers have an expectation of privacy and we cannot allow these things to happen."
13 Investigates' prescription privacy test netted 2,394 patient records from 74 drugstore dumpsters nationwide. Most of those dumpsters belong to CVS, Walgreens and RiteAid pharmacies, although several smaller, locally-owned drugstores also failed the test. CVS, Walgreens and RiteAid are the country's three largest pharmacy chains with more than 15,000 drugstores nationwide.
A total of 296 dumpsters were checked during the investigation. Of those:
* 103 dumpsters were inaccessible to the public because they were either locked, accessible only from inside the drugstore or located behind a closed gate (WTHR did not open closed gates to inspect dumpsters even if they were not locked)
* 56 dumpsters were empty at the time of inspection
* 64 dumpsters contained trash bags with no personal information
* 74 dumpsters contained trash bags with personal information.
Of the 138 pharmacy dumpsters where Eyewitness News was able to inspect trash, more than half (54%) contained customer information that pharmacies say should not have been in there.
While about one-third of the dumpsters checked offered little or no public access, most were unlocked and wide open. In several cities, 13 Investigates watched as other people rummaged through unsecured dumpsters.
"I'm looking to make money," said Ted, a homeless man in Cleveland who was looking inside a Walgreens dumpster. Ted told 13 Investigates he checks pharmacy dumpsters because he often finds beer, soda, cigarettes and other items he can sell on the street. He said he sees a lot of prescription labels in the dumpsters, as well.
WTHR began its investigation this summer, following up on the story of a Bloomington grandmother who was robbed at her front door. The Monroe County Sheriff's Department says a thief found the woman's address and prescription information in an unsecured CVS dumpster, then went to her home and posed as a pharmacy employee to successfully steal the woman's prescription for Oxycontin. The drug is a powerful, highly-addictive pain medication.
During the initial investigation, 13 Investigates found hundreds of patient records in drugstore dumpsters around Indianapolis. In July, CVS and Walgreens told WTHR the problem was a result of pharmacy staff failing to adhere to strict policies designed to protect customers' personal information. At that point, both companies issued statements assuring customers the problem would be fixed.
"We apologize," said Marla Barger, a Walgreens regional manager. "We'll address the procedures and ensure they are followed in the future."
Industry watchdogs now say that did not happen, and they believe the pharmacies are violating state and federal law.
"For pharmacies to still be engaged in the activity or to allow it to occur is not only a violation of state laws but it's a disgrace," said Carmen Catizone. He is president of the National Association of Boards of Pharmacy, an organization that helps regulate the nation's roughly 87,000 pharmacies.
Catizone says pharmacy boards in every state have rules to prevent pharmacies from jeopardizing customers' private information. "For this to be happening to this extent means somebody is not doing what they're supposed to be doing. This is a national issue," he added.
Federal law requires doctors, nurses, pharmacists and other healthcare professionals to take reasonable measures to protect patients' personal and healthcare-related information. Failing to do so can result in fines levied against violators, although that rarely happens.
A corporate official at CVS admitted the nation's largest drugstore chain is falling short of federal requirements.
"We are not safeguarding customer privacy as we are required to do," said CVS corporate privacy officer Kristine Egan. "It's sad and intolerable ... and we need to do better. We will do better."
A Walgreens spokesman said his company has not broken the law by placing patients' personal information in unsecured dumpsters. Walgreens corporate communications manager Michael Polzin told 13 Investigates that federal law "doesn't prohibit disposing of information in dumpsters."
The federal government's top legal advisor on heath privacy disagreed.
"Putting protected health information in a dumpster that is accessible to anyone ... is clearly not an example of a reasonable safegaurd," said Susan McAndrew, senior advisor with the U.S. Department of Health and Human Services' Office of Civil Rights. Her advice to pharmacies looking to follow the law: "Don't do that!"
A spokesman for the Office of Civil Rights said the agency has launched its own investigation following WTHR's reports. The investigation will determine whether pharmacies will face any fines for improperly disposing of patient information. The Indiana Attorney General's office has also opened an investigation after the Indiana Board of Pharmacy filed 30 consumer complaints resulting from reports on Eyewitness News.
COMING UP TUESDAY NIGHT ON EYEWITNESS NEWS AT 11:00 -- The nation's largest pharmacies respond to this latest Eyewitness News Investigation with big changes that will affect millions of customers like you. The changes will take place in Indianapolis and at thousands of pharmacies nationwide. Tuesday night on Eyewitness News, you'll see what new steps the pharmacies are taking to protect your prescription privacy.
Prescription Privacy main page
