CVS Caremark Unauthorized Access Breach Report

Opening Summary

CVS Caremark, one of the largest pharmacy benefit managers and integrated healthcare companies in the United States, experienced an unauthorized access incident involving paper records and films in Rhode Island. The breach was reported to the Office for Civil Rights on May 13, 2025, affecting 2,599 individuals. This incident represents a breach of protected health information (PHI) through physical media rather than digital systems, highlighting ongoing vulnerabilities in paper-based healthcare record management despite the healthcare industry's shift toward electronic systems.

Company Response and Investigation

Upon discovery of the unauthorized access to paper records and films, CVS Caremark initiated an investigation to determine the scope and nature of the breach. The company conducted a comprehensive review of affected records and implemented measures to secure remaining physical documents. CVS Caremark notified affected individuals in accordance with HIPAA Breach Notification Rule requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach. The involvement of a business associate in this incident suggests that the breach may have occurred at a third-party location or through a contracted service provider, requiring coordinated notification efforts and shared responsibility for remediation.

Specific Details of the Breach

The breach involved unauthorized access to paper records and films, which are physical forms of health information storage. This breach type typically occurs through scenarios such as theft of physical documents, unauthorized access to unsecured storage areas, loss of records during transport, or improper disposal of sensitive materials. Paper-based breaches remain a significant concern in healthcare despite digitalization efforts, as physical records often lack the access controls and audit trails available in electronic health record systems. The location designation of "Paper/Films" indicates that the compromised information was stored in traditional formats rather than digital databases, which may have limited the organization's ability to detect unauthorized access through standard IT security monitoring. Business associate involvement suggests the breach may have occurred at a vendor facility, such as a records storage company, document imaging service, or third-party pharmacy operation.

Organizational Context

CVS Caremark operates as a major integrated healthcare company providing pharmacy services, pharmacy benefit management, and healthcare services across the United States. The organization operates thousands of retail pharmacy locations and manages prescription benefits for millions of individuals through employer plans, government programs, and individual coverage. CVS Caremark's Rhode Island operations serve the local community through retail pharmacies and administrative offices. The company's scale and complexity create significant data management responsibilities, with millions of patient records maintained across multiple locations and business units. The involvement of business associates in healthcare operations is common, as companies frequently contract with third parties for services such as records storage, document management, transcription, and billing services.

Patient Impact and Notification

The breach affected 2,599 individuals in Rhode Island whose protected health information may have been accessed without authorization. Affected individuals likely included pharmacy customers, insurance plan members, and patients whose records were maintained in the compromised paper files or films. The specific types of information exposed through paper records typically include names, addresses, dates of birth, pharmacy prescription information, insurance details, and potentially medical history information documented in physical files. CVS Caremark provided notification to affected individuals detailing the nature of the breach, the types of information involved, and recommended protective measures. The notification process required coordination with the business associate involved in the breach and compliance with state-specific notification requirements in addition to federal HIPAA regulations.

Industry Context and HIPAA Implications

Unauthorized access breaches involving paper records represent a persistent challenge in healthcare despite the industry's transition to electronic health records. The HIPAA Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect PHI, including physical access controls for areas containing paper records. Paper-based breaches often result from inadequate physical security measures, insufficient employee training on document handling, or lapses in business associate oversight. According to HHS Office for Civil Rights data, breaches affecting fewer than 500 individuals are not publicly reported, making the 2,599 individuals affected in this incident notable enough for public disclosure. Similar incidents involving pharmacy chains and healthcare organizations have highlighted the need for improved inventory management of physical records, secure storage facilities with restricted access, and proper destruction protocols for outdated documents. The involvement of a business associate underscores the importance of Business Associate Agreements (BAAs) that clearly delineate security responsibilities and require subcontractors to maintain equivalent safeguards as the covered entity.