CVS Health faces federal probe over alleged use of patient data in Louisiana lobbying effort

CVS Health is under federal scrutiny following allegations that it improperly used patient data to lobby against a Louisiana bill aimed at curbing the power of pharmacy benefit managers.

House Oversight Committee Chairman James Comer (R-Ky.) and Federal Law Enforcement Subcommittee Chairman Clay Higgins (R-La.) have launched an investigation into whether CVS violated the Health Insurance Portability and Accountability Act (HIPAA) by allegedly using confidential patient information to oppose House Bill 358. The legislation seeks to bar companies from operating simultaneously as both pharmacy benefit managers (PBMs) and retail pharmacies, a change that could significantly affect CVS operations in the state.

Reports first surfaced earlier this year that Louisiana residents, including state employees and their families, had received mass text messages from CVS warning that passage of HB 358 could force pharmacy closures, raise drug prices, and cost pharmacists their jobs. The texts also linked to a draft letter urging lawmakers to reject the measure, citing potential harm to patients who depend on home delivery and specialty pharmacy services. Critics, including Louisiana Attorney General Liz Murrill, accused the company of misleading patients and exploiting sensitive information.

Murrill filed three lawsuits in June against CVS Health, accusing it of unfair, deceptive, and unlawful practices that she said harmed patients, independent pharmacies, and the public. She opened a state investigation after receiving complaints about the lobbying campaign.

CVS has denied wrongdoing, insisting it acted within the law. “We believe we had a responsibility to inform our customers of misguided legislation that sought to shutter their trusted pharmacy, and we acted accordingly,” spokesperson Amy Thibault said in a statement. “Our communication with our customers, patients, and members of our community was consistent with law.”

The congressional probe is focused on whether patient data collected for prescription services was repurposed for political advocacy, which HIPAA does not explicitly allow. Lawmakers stressed in their letter to CVS President and CEO David Joyner that such use would require patient authorization. They requested documentation and records of communications involving patient or customer health information used for advocacy or lobbying in Louisiana and other states dating back to January 2020. CVS has until September 18 to respond.

The inquiry comes as PBMs face mounting scrutiny from regulators and lawmakers over drug pricing practices. The Federal Trade Commission has accused leading PBMs, including CVS Caremark, of driving up costs by negotiating lower prices from drugmakers and then marking up drugs sold at their affiliated pharmacies. Between 2017 and 2022, CVS and other major PBMs reportedly reaped $7.3 billion in revenue above acquisition costs for medications treating conditions such as cancer, heart disease, and HIV.

If HB 358 becomes law, it could reshape the landscape for CVS Health in Louisiana, where it operates 119 pharmacies in addition to its PBM arm, CVS Caremark. The case now places the company at the center of a national debate over PBM power, patient privacy, and the boundaries of corporate political influence.