CVS Faces Scrutiny Over Text Message Campaign & Potential HIPAA Violations
CVS Health is under fire from congressional leaders and facing legal challenges regarding a recent text message campaign aimed at influencing legislation in Louisiana. The controversy centers on whether the pharmacy giant violated patient privacy laws by using personal health information for political advocacy. Here’s a breakdown of the situation, its implications, and the broader context of pharmacy benefit manager (PBM) reform.
congressional Inquiry & Allegations of HIPAA Breach
On September 4,2025,Representatives james Comer and Katie Higgins sent a letter to CVS CEO david joyner. they are pressing CVS for details about its June text message campaign. The core allegation? The campaign may have violated the Health Insurance Portability and Accountability Act (HIPAA).
The letter specifically requests information regarding CVS’s use of patient data for political purposes in Louisiana and other states over the past five years. CVS has acknowledged receiving the letter and intends to respond, maintaining its actions were legally compliant.
What happened: The Louisiana Text Message Campaign
On June 11th, CVS sent mass texts to Louisiana customers. These texts leveraged data patients provided for prescription services. The message warned of potential pharmacy closures and increased drug prices if House Bill 358 (H.B. 358) passed.
H.B. 358 aims to prevent companies from simultaneously operating as both pharmacy benefit managers and pharmacies within the state. The texts urged recipients to contact their state representatives and oppose the bill.
Why This Matters: The HIPAA Concern
Comer and Higgins argue that CVS’s actions potentially breach HIPAA, the federal law protecting sensitive patient health information. CVS routinely uses its text messaging system for prescription updates and personalized patient interaction.Therefore, utilizing this same system for political advocacy raises serious privacy concerns.
As the letter to Joyner states, “it appears CVS Health’s use of protected patient information for the purposes of political advocacy may represent a violation of HIPAA.”
Legal Battles & State Action
Louisiana Attorney General Liz Murrill instantly responded with a cease-and-desist letter. CVS disputed the HIPAA violation claim. However, Louisiana filed an enforcement action in state court, alleging the text campaign - and CVS’s dual role as PBM (through Caremark) and pharmacy – violated state trade practices laws.
the Conflict of Interest & Broader PBM Landscape
CVS operates 119 pharmacies in Louisiana and is one of the nation’s largest PBMs. This creates an inherent conflict of interest, according to critics. The company essentially controls both the cost of drugs (as a PBM) and the dispensing of those drugs (as a pharmacy).
This situation isn’t unique to CVS. It’s fueling increased scrutiny of PBMs by antitrust regulators. The Federal Trade Commission (FTC) has released two critical reports on PBM practices, including the potential anti-competitive effects of PBM ownership of pharmacies. The FTC is actively pursuing legal action against Caremark and other major PBMs, alleging they’ve inflated insulin costs.
The Push for PBM Reform: States Leading the Way
While Congress has shown interest in PBM reform, legislative action has stalled.States are taking the lead,attempting to address these issues at the local level.
Louisiana: Fighting CVS in court over the text message campaign and the inherent conflict of interest.
Arkansas: Passed a law preventing PBMs from owning or operating pharmacies. However, implementation is currently paused due to a court order.
Other States: Exploring similar legislation to increase transparency and address potential conflicts of interest within the pharmaceutical supply chain.
What This Means for You
As a patient,you should be aware of how your personal health information is being used. The CVS situation highlights the importance of data privacy and the potential for misuse.
You can:
Review privacy policies: Understand how your pharmacy and insurance providers handle your data.
Contact your representatives: voice your concerns about PBM practices and advocate for stronger regulations.
Stay informed: Follow developments in PBM reform and data privacy legislation.
Looking Ahead
The CVS case is a significant development in the ongoing debate surrounding PBMs and healthcare costs. The outcome of the legal challenges and the continued push for state and federal reform will likely shape the future