The CVS pharmacy chain has been trying to enroll customers in its ExtraCare Pharmacy & Health Rewards program since early this year.
CVS pharmacists and pharmacy technicians are urged to tell customers they can earn up to $50 in store credits by enrolling in the program.
However, customers who enroll in the program are giving up their federal privacy rights regarding their medical information and allowing CVS to possibly share their information with third parties.
To make matters worse, CVS charges $133 more than Costco for a generic drug, reported CNN earlier this year. The price hike is even worse when CVS is compared to online pharmacies such as Planet Drugs Direct.
"It's very troubling," Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse, told the Los Angeles Times.
"Your medical information is very sensitive. Pharmaceutical companies obviously would want to know what you're taking and get you to buy more expensive medicines."
CVS's offer of $50 in store credit is a way to entice customers to give up their privacy rights, which are protected by HIPAA, the federal Health Insurance Portability and Accountability Act of 1996.
How does CVS get around HIPAA?
When people sign up for the ExtraCare Pharmacy & Health Rewards program on the CVS website, it states: "Each person must sign a HIPAA Authorization to join."
"The HIPAA Authorization allows CVS/pharmacy to record the prescription earnings of each person who joins the ExtraCare Pharmacy & Health Rewards program."
It's the final step of the "HIPAA Authorization" which surrenders one's legal rights to CVS: "My health information may potentially be re-disclosed and thus is no longer protected by the federal Privacy Rule."
CVS defended their ExtraCare Pharmacy & Health Rewards program and seemed to contradict their own website.
Mike DeAngelis, a CVS spokesman, told the Los Angeles Times that the ExtraCare Pharmacy & Health Rewards program "gives members more ways to earn rewards for actions they take to stay healthy, such as filling prescriptions and getting a flu shot."
"We have extensive procedures, stringent policies and state-of-the-art technology in place to protect our customers' personal and health information. We do not sell, rent or give personal information to any non-affiliated third parties."
DeAngelis claims that by signing the HIPAA release "customers are authorizing ExtraCare only to count the number of prescriptions they are filling as an individual."
But remember the CVS website says far more than that: "My health information may potentially be re-disclosed and thus is no longer protected by the federal Privacy Rule."
Walgreens and Rite-Aid also reward their customers based on the number of prescriptions filled, but do not ask customers to give up their HIPAA rights.