Federal lawmakers are probing whether CVS Health misused patient data to oppose state legislation that threatened its business operations in Louisiana.
What happened
CVS Health is under investigation following allegations that it used patient data for lobbying efforts against Louisiana House Bill 358 (HB 358). The bill tries to prohibit entities from operating as both a pharmacy benefit manager (PBM) and a pharmacy, a structure that directly affects CVS, which operates both CVS Caremark (a PBM) and over 100 retail pharmacies in the state.
Reports allege that CVS sent text messages to Louisiana state employees and their families warning that the legislation could lead to pharmacy closures and increased drug costs. The messages included a link to a pre-written letter opposing the bill and were sent using systems typically used for patient communication.
Going deeper
PBMs, such as CVS Caremark, act as intermediaries between drug manufacturers and pharmacies. They manage formularies, negotiate drug prices, and often operate affiliated pharmacies. Critics argue this arrangement enables PBMs to inflate prices. According to a recent FTC report, PBMs, including CVS Caremark, collectively generated $7.3 billion in excess revenue between 2017 and 2022 by increasing the price of critical medications such as those for cancer, heart disease, and HIV.
States are increasingly enacting laws to limit PBM power. CVS Health and Cigna have previously challenged similar laws in Arkansas, and CVS has now been accused of using deceptive practices to influence legislation in Louisiana. In response, Louisiana Attorney General Liz Murrill filed three lawsuits in June 2025, citing harm to patients, independent pharmacies, and the public.
CVS denies wrongdoing, claiming its communications were lawful and intended to inform customers about legislative risks.
What was said
A spokesperson for CVS Health stated, “We believe we had a responsibility to inform our customers of misguided legislation that sought to shutter their trusted pharmacy, and we acted accordingly.” CVS maintains that its communication was legally compliant.
However, lawmakers James Comer (R-KY) and Clay Higgins (R-LA) argue that using protected patient data to send political messages may have breached the HIPAA Privacy Rule. In their letter to CVS President and CEO David Joyner, they stressed that HIPAA does not permit the use of personal health information for political purposes without patient authorization. They have requested internal documentation and communications from CVS related to such uses from January 2020 to the present, with a response due by September 18.
FAQs
What is House Bill 358, and why does it matter to CVS Health?
HB 358 seeks to ban companies from operating as both pharmacy benefit managers and pharmacies. CVS operates in both roles and could face significant operational and financial consequences if the bill passes.
What does the HIPAA Privacy Rule say about political communication?
HIPAA restricts the use of patient data for purposes outside of treatment, payment, and healthcare operations. Political advocacy is not considered a permitted use without explicit patient authorization.
Can companies legally text patients about political issues?
Only if the content falls within permitted uses under HIPAA or if patients have explicitly consented. Using mass texting tools for political messaging can breach privacy laws if not carefully managed.
How might this investigation affect CVS Health nationally?
If CVS is found to have violated HIPAA, it could face federal penalties and tighter oversight. It may also influence how other healthcare organizations approach communication policies across states.
What are PBMs, and why are they under scrutiny?
Pharmacy benefit managers negotiate drug prices and manage pharmacy networks. Critics argue they inflate drug costs for consumers while profiting from rebates and affiliated pharmacy operations, prompting increasing legislative and regulatory action.
Farah Amod
