The stores’ online appointment portals usually do not explicitly state how the companies will use the information provided by the customers. Privacy watchdog groups and some members of Congress have raised concerns about whether pharmacy chains will use this data for marketing purposes, such as selling ibuprofen or other products to deal with the aftermath of the exposure. And they warn that less tech-savvy patients looking for appointments can inadvertently join pharmacy loyalty programs that could bombard them with unexpected marketing emails and texts.
“We don’t want people in their desire to get vaccinated – and frankly, to protect themselves and their loved ones – from being exploited in any way,” said Andrew Crawford, an attorney at the Center for Democracy and Technology.
Some prominent consumer rights organizations, including the Electronic Privacy Information Center, sent a letter on Friday asking a group of Democratic attorneys general to investigate how large pharmacy retailers are using data from vaccine filings for Covid. They also put pressure on these retailers to separate this information from marketing or business databases and only collect the minimum amount of information necessary for vaccine appointments.
Biden’s government has put a lot of faith in retail pharmacies and this week announced plans to double the number of pharmacy locations offering Covid vaccinations as part of a federal program to 40,000. Federal data shows the sites are popular with Americans who have become increasingly used to getting annual flu shots at their local pharmacies. The White House did not answer questions about pharmacies’ use of data from Covid vaccine appointments.
The pharmacies say the data they collect is important in getting people to vaccinate efficiently and that they comply with data protection regulations. Some privacy advocates point out that pharmacies have a lot of leeway to collect and use customer data as long as they don’t break down sensitive health information.
However, consumer advocates believe that pharmacies’ use of Covid vaccination data should be more restricted given the urgency of the health crisis and the difficulty of finding an alternative vaccination site in many cases.
The federal law regulating the use of patient health information (HIPAA) prevents pharmacies from disclosing customer health information for marketing purposes. However, you can use the information to send vouchers and to promote health services that are already on offer, such as preventive medical checkups or flu vaccinations. There are fewer restrictions on what they can do with the data once they clean it up with identifying details like names and contact information, including potentially to make business decisions, legal experts said.
“I don’t want to dismiss people’s privacy concerns, but it just seems to be an integral part of what pharmacies do every day,” said Trish Wagner, a privacy attorney with Epstein Becker Green.
“As long as the range is within the limits of the [HIPAA] Privacy rule, they can do this outreach, ”she added.
However, Doriann Cain, partner at Faegre Drinker Biddle & Reath law firm, said things like mandatory online sign-ups to book or find appointments are beyond what pharmacies usually need for other services like flu shots, when people can often just drop in.
“The sheer amount of information they receive is likely to be quite valuable to them,” said Cain.
Pharmacies cannot charge patients for vaccinations – the government pays for these costs. However, you can bill insurers and the government for the cost of giving vaccines.
The bigger business game for the companies seems to be the ability to acquire repeat customers. During a call for earnings in February, CVS CEO Jon Roberts described the company’s “opportunity with the vaccines” to convert newcomers into long-term customers, starting with the 15 minutes patients are expected to wait in the store after receiving a Covid shot. During this observation period, store employees could attempt to sell patients on the company’s MinuteClinics for regular health care visits and CarePass, the paid pharmacy membership service.
“We have their email, we have their text, and we have the ability to communicate with them regularly,” said Roberts.
CVS spokesman Michael DeAngelis said the company is now using customer data for Covid vaccinations only for appointment confirmations and reminders, but he said using that information for marketing was “an option for the future.” CVS does not ask vaccine seekers to create an online profile until they are ready to schedule an appointment. A phone number is required, but email is optional.
“What I can say about our patient programs in general is that they sign up. Everything we do is done with the consent of our customers,” added DeAngelis.
A Federal Trade Commission spokesman, who didn’t say the consumer protection agency is looking into how retail pharmacies use data from Covid vaccination, said companies could be investigated if they mislead customers about how their information is being used.
“If companies tell consumers that they are only collecting data for one purpose, they cannot use that data for any other purpose,” the spokesman said.
Some lawmakers recently introduced bills aimed at curbing corporate use of data collected for the pandemic response. They warn that efforts to fight the virus have been hampered by people’s fears about how their personal information might be used. One of these measures, the Public Health Emergency Privacy Act, would restrict the use of vaccination schedule data by retailers.
“Data should be used as intended, with public health officials and technology companies deploying new digital tools to combat the spread of COVID-19,” said Rep. Suzan DelBene (D-Wash.), Co-sponsor of the bill.
The federal government began shipping Covid vaccines direct to retail pharmacies in early February, but discussions about the deal began last fall under the Trump administration. Twenty-one national chains and independent pharmacy networks are participating in the federal program, and the states have also forwarded some of the doses they receive from the federal government to pharmacies. CVS and Walgreens also manage vaccination programs for nurses and residents under an agreement with the Trump administration.
Concerns about pharmacies’ use of customer data did not arise in early talks with the federal government, said Mitchel Rothholz, chief of staff for the American Pharmacists Association, the largest trading group in the industry. At the time, he said the main concern was whether pharmacies would use the data to prioritize their existing customers for vaccine slots rather than following guidelines set by states, he said.
In some cases, vaccine seekers may feel encouraged to sign up for customer accounts in pharmacies. Rite Aid, for example, doesn’t require people to create an account to book an appointment, but the company will phone registered customers if their health records indicate they are eligible for vaccines when unused doses are available, one said POLITICO spokesman.
Privacy professionals said some retail pharmacies were better than others at separating vaccine appointments from marketing efforts. The Albertsons grocery chain enables users to choose to receive Covid-related marketing information about vaccines or general marketing activities at the time of securing a vaccination spot instead of automatically registering it.
Of the chains that require users to create user accounts before looking for an appointment, Walgreens and Health Mart let users enter their phone numbers as well as their emails. Walmart and Sam’s Club didn’t answer several questions about what data they collect and how it’s used.