Now on another part of their website they say:
OK, I understand and don't mind that their rewards program needs to know that I've filled a prescription in order to figure out when I've filled ten so it can give me my five bucks. I don't know why it would need to know any other details beyond that.
But what the heck is that line buried in their about "my health information may potentially be re-disclosed and thus is no longer protected by the federal Privacy Rule?"
What exactly are they saying here? What does "re-disclosed" mean? Who is going to "re-disclose it" and why? Are they saying their pharmacy division doesn't trust their rewards division to comply with HIPAA? Or is this just a complicated way of saying "forget what we said elsewhere on the website, that was a little white lie. In return for $5, we are buying the right to use all your medical information any darn way we please?"
Boldface mine:
Welcome to ExtraCare Pharmacy & Health Rewards™! With this new ExtraCare benefit, you can earn up to $50 in Pharmacy & Health ExtraBucks Rewards™ annually for every member of your household who enrolls in the program. The purpose of this authorization is to allow CVS/pharmacy to record prescription earnings for each person; and because your privacy is of the utmost importance to us, this authorization explains how CVS/pharmacy uses and protects your information.
HIPAA Authorization
I hereby authorize CVS/pharmacy® and its affiliates to share my prescription and other health service records, including my email address, with the ExtraCare® program to enroll me in and administer the ExtraCare Pharmacy and Health RewardsTM program, and to inform me of new programs I may be interested in.
I understand that (1) my treatment, payment for treatment and eligibility for benefits does not depend on my signing this authorization; (2) once I sign this authorization, under law, my health information may potentially be re-disclosed and thus is no longer protected by the federal Privacy Rule; (3) I have the right to cancel this authorization at any time by calling 1-800-ShopCVS or at http://www.cvs.com/rxrewards, but that my cancellation will not apply to any action that CVS has already taken based on this authorization before then; and (4) I am entitled to a copy of this authorization once signed by me.
Unless I cancel it before then, this authorization will expire one (1) year from today.