FTC OKs Final CVS Caremark Order;Refers Pharmacists' Concerns

The U.S. Federal Trade Commission has unanimously approved a final consent order relating to CVS Caremark Corp.'s (CVS) settlement of charges that the company illegally dumped sensitive customer information in trash containers outside some of its drug stores, the agency said Tuesday.

The FTC also has referred to its Bureau of Competition a national independent pharmacists group's separate concerns that CVS Caremark's pharmacy-benefits management, or PBM, operation has improperly shared patient information with the company's retail side to steer customers to CVS stores, to the detriment of competitors and customers.

CVS Caremark agreed earlier this year to pay $2.25 million to settle U.S. Department of Health and Human Services allegations related to the dumping of customers' private information, while denying that it had engaged in wrongful conduct. The FTC has said the company failed to take appropriate security measures to protect customers' and employees' sensitive financial and medical information.

Under the FTC order, which received final approval last week, the company must implement and maintain a comprehensive information-security program and obtain audits from an independent professional to ensure the program meets required standards.

Several parties, including the National Community Pharmacists Association, contacted the FTC during the agency's public-comment period on the consent order.

The independent pharmacists group's concerns go beyond the dumping of private customer information; the group wants the FTC to reopen the 2007 merger of CVS and Caremark, claiming that the company has engaged in anticompetitive behavior, such as using private patient information to steer Caremark benefit-plan members to CVS stores. Representatives of the group met with the FTC's chairman last month, saying afterward they were encouraged by the meeting.

CVS Caremark, which operates 6,900 drug stores and is one of the nation's largest pharmacy-benefits managers, has denied wrongdoing and called the independent pharmacists' suggestions of data misuse unsubstantiated and unfounded.

In a letter last week to the NCPA, the trade commission explained that the public interest would best be served by accepting the CVS Caremark consent order, which covers many of the issues the group raised.

Regarding the NCPA's concerns that information sharing between the Caremark PBM and the CVS pharmacies has harmed consumers and competing pharmacies, the FTC said: "Because this part of your comment mainly concerns the impact of these practices on competing pharmacies, the comment has been referred to the Bureau of Competition for assessment."

The violations of law alleged in the FTC's complaint against the company aren't based on information-sharing or anticompetitive practices, the agency said. The consent order does, however, prohibit misrepresentations about the privacy and security of sensitive information, and therefore would bar misrepresentations about CVS Caremark's information-sharing practices, the FTC added.

The FTC retains the ability to bring a new action against the company if circumstances warrant it, the agency told the pharmacists group.

The FTC isn't at liberty to say whether it does plan to reopen the completed CVS Caremark merger, as the NCPA has requested, as such information is nonpublic, an agency spokesman said.

The NCPA had no immediate comment Tuesday.

-By Dinah Wisenberg Brin, Dow Jones Newswires

215-656-8285; [e-mail]