CVS, Texas Settle Over Record Dumping

Houston CVS Caremark Corp. will overhaul its information security system and pay the state of Texas $315,000 to settle a lawsuit that accused the drugstore operator of dumping credit-card numbers, medical information and other material from more than 1,000 customers into a garbage container.

Texas Attorney General Greg Abbott, who sued CVS last April, announced the agreement Wednesday.

CVS Caremark was accused of failing to protect its customers from identity theft at a store in Liberty, about 45 miles northeast of Houston.

Records allegedly dumped by employees behind the store included credit- and debit-card numbers and prescription forms that contained customers' names, addresses, dates of birth and types of medications, Abbott said.

CVS's revamped information-security program must have administrative, technical and physical safeguards designed to protect the personal information of customers. It also must create a training program to inform new hires of its enhanced security procedures and conduct unannounced compliance checks at some stores, among other measures.

In a statement, CVS said it was pleased to reach the settlement agreement.

"Nothing is more central to our health-care operations than maintaining the privacy of health information," the statement said. "We have firm policies in place at all 6,200 of our stores designed to protect patient privacy in our pharmacies, including procedures to ensure that all waste material containing personal-identifying information is securely disposed."

The company said the files were dumped during the Liberty store's relocation to a new site. The files were contained to a "single, secured bag."

"However, the improper disposal of this information was a violation of our record retention and privacy policies, and CVS took appropriate disciplinary action," the statement said. When the suit was filed last year, CVS said the store manager had been fired.

Earlier this month, CVS Caremark agreed to pay almost $37 million to nearly two dozen states and the federal government to settle claims it billed Medicaid programs for a more expensive formulation of an antacid.

The settlement in the case—the first of its kind for a retail pharmacy company—came after a lengthy investigation that began in 2001, when a suburban Chicago pharmacist alerted authorities.