Is CVS rewards program complying with California law?

By Googooian's reckoning, this language doesn't make clear that customers' information is moving from a part of the company covered by HIPAA to a part of the company lacking HIPAA protections.

Nor does it spell out the "specific uses" of the information, he said.

For example, what does it take to administer the program, and who does the administering?

It's also questionable whether the waiver adequately informs people that their names and contact information may be shared with "outside companies as contractors or agents of CVS/pharmacy to help deliver promotional information and offers," as permitted under the privacy policy of CVS' ExtraCare program.

CVS says customers' medical information is safe.

"We are committed to protecting the privacy of our customers, and we do not share any of their personal information, which remains protected under consumer privacy laws," DeAngelis said.

That didn't carry much weight for Googooian. Without HIPAA, he noted, customers only have CVS' word that the company isn't sharing their information with others.

"The only reason you would ask people to waive their rights is if you want to open the door to giving their drug information away," he said. "Otherwise, there's no reason."

Lynda Gledhill, a spokeswoman for California Atty. Gen. Kamala D. Harris, declined to comment on the issue, saying only that "the attorney general's office is very interested in privacy issues."

David Lazarus' column runs Tuesdays and Fridays. He also can be seen daily on KTLA-TV Channel 5 and followed on Twitter @Davidlaz. Send your tips or feedback to david.lazarus@latimes.com.

Featured Stories

CTnow is using Facebook comments on stories. To comment on ctnow.com articles, sign into Facebook and enter your comment in the field below. Comments will appear in your Facebook News Feed unless you choose otherwise. To report spam or abuse, click the X next to the comment. For guidelines on commenting, click here.

CONSUMER COLUMNISTS

Kevin Hunt - The Electronic Jungle

Kevin Hunt: Belkin's WeMo Crock-Pot, the smart slow cooker - December 1, 2014 - I will not defend a Wi-Fi-connected can opener, doorbell or toaster, but I will defend almost everything about Belkin's Crock-Pot Smart...

Gail MarksJarvis

Check your municipal bond fund for Puerto Rico bond risks - July 2, 2015 - If you are like most investors in municipal bonds, you aren't much of a risk-taker.

David Lazarus

HBO and Showtime streaming services won't pass savings on to viewers - June 12, 2015 - There's only one reason most pay-TV viewers in Southern California aren't watching Dodgers games: They're too expensive.

Korky Vann

Fourth Of July Weekend Sales At Outlets And Shops - July 2, 2015 - Forget the picnics and parades. A three-day weekend means plenty of sales and an extra day to shop.