The CVS ExtraCare rewards program is expanding for prescription drugs, but signing up means signing away some privacy.
Is $50 a good trade for your federal privacy protections? CVS seems to think so.
The chain began pushing earlier this year for its pharmacists to enroll customers in a prescription-drug rewards program, the Los Angeles Times says. It’s called ExtraCare Pharmacy & Health Rewards, and offers consumers $5 in credit for every 10 prescriptions filled, up to $50 per year.
There’s a catch: “The fine print on CVS’ website says that ‘each person must sign a HIPAA Authorization to join’ and that ‘you must re-sign the HIPAA Authorization once per year to retain active enrollment,'” the Times says. It somehow manages to avoid explaining what HIPAA is.
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is a federal privacy law that lets consumers set restrictions on who can see their health records. It requires insurers, hospitals, doctors, dentists, and pharmacies to safeguard your information. You can learn about the law at the U.S. Department of Health and Human Services website.
The HIPAA authorization that CVS requires immunizes it from penalties of up to $1.5 million per violation of the law, the Times says. It gives CVS the right to share what prescriptions you have with people you haven’t explicitly authorized. The enrollment process explains that health information “may potentially be re-disclosed,” but here’s what a CVS spokesman told the paper: “We do not sell, rent or give personal information to any non-affiliated third parties.”
However, that same spokesman declined to comment on an internal memo showing weekly enrollment goals, or on whether the company adequately explains HIPAA, or on why CVS’ policy differs from those of rivals Rite Aid and Walgreens, which require no HIPAA release forms for their reward programs.
If you use CVS for your prescriptions, did you know about this program? Does the Times report change how you feel about it? Let us know on Facebook.