(UNDATED) - Would you give up your right to privacy of your prescription medical records for $50 or less per year?
WTHI-TV reports in February, CVS Pharmacy added an extra benefit to it's ExtraCare card.
Sign up and you can earn up to $50 per year in store credits on prescriptions you buy. But to get that $50, you sign away some of your rights under the Health Insurance Portability and Accountability Act of 1996, or HIPAA.
HIPAA is a federal law. It essentially says that any medical information that someone has about you can't be given out without your permission.
The CVS waiver says in part, "after I sign this authorization, some of my health information... will become part of my ExtraCare Pharmacy & Health Rewards program record and thus no longer covered by the Federal Privacy Rule."
"Any information that they've gotten about the patient from the prescription, is now no longer protected, so yes they could send it out," says David Orentlicher, an Indiana University law professor.
Orentlicher, who is also a physician, says the waiver is not something he would sign. He says it's vague. On its website, CVS says they have you sign it so they can record prescription earnings for each person.
"That's why there's a federal law. So it's not up to the whims of corporate executives whose primary objective in the end is to increase the profits of their shareholders and that's not always in the patient's health interest," says Orentlicher.
Not all drug store rewards cards require the HIPAA waiver. Orentlicher says that's why reading what you are signing is critical, even for something as simple as a rewards card.
CVS corporate headquarters has not responded for comment.
Have a question or comment about a news story? Send it to firstname.lastname@example.org