Last Tuesday, the Connecticut Senate unanimously passed a bill (Senate Bill 208) that requires pharmacies to notify consumers, in plain language, about their medical privacy if they waive their rights under the federal Health Insurance Portability and Accountability Act. The measure, which still need to go to the House, also mandates that pharmacies disclose which third parties will have access to the consumers’ medical information.
Both CVS and Target Pharmacy require participants in their rewards programs to sign HIPAA authorization forms, although neither company defines what “HIPAA authorization” is on their websites.
Senate Bill 208 does not prohibit these types of rewards programs, Doyle said. “But it’s making the consumer aware [that] if they opt in and become a participant, what they can be giving up,” he said. In some cases, pharmacies can provide medical records to third parties, who would use them for marketing, he added