CVS to pay $2.25m in data case

Regulators cited lack of controls

Regulators say CVS improperly discarded pill bottles, medication instruction sheets, computer order forms, payroll information, job applications, and credit card and insurance information. (J.B. Reed/ Bloomberg News/ File 2007)

NEW YORK - CVS Caremark Corp. will pay $2.25 million to end government investigations into reports that its pharmacy workers didn't properly dispose of pill bottle labels and other items containing personal information about patients.

Employees at CVS pharmacies left the labels and other items in open trash bins outside stores, according to the Federal Trade Commission and the Department of Health and Human Services. The company did not have adequate policies for disposing of that information, and did not train employees to dispose of the information properly, the agencies say.

The items improperly discarded included pill bottles, medication instruction sheets, computer order forms, payroll information, job applications, and credit card and insurance information. Those labels and forms contained personal information including Social Security numbers and credit card and insurance information, and in some cases, driver's license numbers and account numbers. Names of doctors were also included.

The payment of $2.25 million ends an investigation into violations of the Health Insurance Portability and Accountability Act, or HIPAA. Woonsocket, R.I.-based CVS resolved the FTC investigation by agreeing to comply with privacy rules and submitting to independent monitoring for 20 years.

HHS will monitor CVS for the next three years to make sure patient information is protected, and employees are properly trained, with sanctions in place for workers who do not follow the disposal rules.

CVS said it is not aware of any consumers being harmed and has not acknowledged any wrongdoing but settled the investigation "to avoid the time and expense of further legal proceedings."

At the end of the third quarter, CVS operated 6,347 US drugstores, making it second-largest, after Walgreen Co.

The FTC said the investigation was spurred on by media reports in 2006. CVS said it responded to those reports at the time by requiring stores to shred any trash that contained confidential information and improving its disposal policies and training programs.

The company said the investigation does not affect its Caremark pharmacy benefit management business, as the companies were not combined at the time.

CVS shares slipped 31 cents, or 1.1 percent, to close at $26.99.