12870 Federal Register / Vol. 74, No. 56 / Wednesday, March 25, 2009 / Notices 

1 FTC Rule 4.2(d), 16 CFR 4.2(d). The comment 

must be accompanied by an explicit request for 

confidential treatment, including the factual and 

legal basis for the request, and must identify the 

specific portions of the comment to be withheld 

from the public record. The request will be granted 

or denied by the Commission’s General Counsel, 

consistent with applicable law and the public 

interest. See FTC Rule 4.9(c), 16 CFR 4.9(c). 

FEDERAL TRADE COMMISSION 

[File No. 072 3119] 

CVS Caremark Corporation; Analysis 

of Proposed Consent Order to Aid 

Public Comment 

AGENCY: Federal Trade Commission. 

ACTION: Proposed Consent Agreement. 

SUMMARY: The consent agreement in this 

matter settles alleged violations of 

federal law prohibiting unfair or 

deceptive acts or practices or unfair 

methods of competition. The attached 

Analysis to Aid Public Comment 

describes both the allegations in the 

complaint and the terms of the consent 

order—embodied in the consent 

agreement—that would settle these 

allegations. 

DATES: Comments must be received on 

or before March 27, 2009. 

ADDRESSES: Interested parties are 

invited to submit written comments 

electronically or in paper form. 

Comments should refer to‘‘CVS 

Caremark, File No. 072 3119’’ to 

facilitate the organization of comments. 

Please note that your comment— 

including your name and your state— 

will be placed on the public record of 

this proceeding, including on the 

publicly accessible FTC website, at 

(http://www.ftc.gov/os/ 

publiccomments.shtm). 

Because comments will be made 

public, they should not include any 

sensitive personal information, such as 

an individual’s Social Security Number; 

date of birth; driver’s license number or 

other state identification number, or 

foreign country equivalent; passport 

number; financial account number; or 

credit or debit card number. Comments 

also should not include any sensitive 

health information, such as medical 

records or other individually 

identifiable health information. In 

addition, comments should not include 

any ‘‘[t]rade secret or any commercial or 

financial information which is obtained 

from any person and which is privileged 

or confidential. . . .,’’ as provided in 

Section 6(f) of the FTC Act, 15 U.S.C. 

46(f), and Commission Rule 4.10(a)(2), 

16 CFR 4.10(a)(2). Comments containing 

material for which confidential 

treatment is requested must be filed in 

paper form, must be clearly labeled 

‘‘Confidential,’’ and must comply with 

FTC Rule 4.9(c).1

Because paper mail addressed to the 

FTC is subject to delay due to 

heightened security screening, please 

consider submitting your comments in 

electronic form. Comments filed in 

electronic form should be submitted by 

using the following weblink: (https:// 

secure.commentworks.com/ftcCVSCaremark) (and following the 

instructions on the web-based form). To 

ensure that the Commission considers 

an electronic comment, you must file it 

on the web-based form at the weblink: 

(https://secure.commentworks.com/ftcCVSCaremark). If this Notice appears at 

(http://www.regulations.gov/search/ 

index.jsp), you may also file an 

electronic comment through that 

website. The Commission will consider 

all comments that regulations.gov 

forwards to it. You may also visit the 

FTC website at http://www.ftc.gov to 

read the Notice and the news release 

describing it. 

A comment filed in paper form 

should include the ‘‘CVS Caremark, File 

No. 072 3119‘‘ reference both in the text 

and on the envelope, and should be 

mailed or delivered to the following 

address: Federal Trade Commission, 

Office of the Secretary, Room H-135, 

600 Pennsylvania Avenue, NW, 

Washington, DC 20580. The FTC is 

requesting that any comment filed in 

paper form be sent by courier or 

overnight service, if possible, because 

U.S. postal mail in the Washington area 

and at the Commission is subject to 

delay due to heightened security 

precautions. 

The Federal Trade Commission Act 

(‘‘FTC Act’’) and other laws the 

Commission administers permit the 

collection of public comments to 

consider and use in this proceeding as 

appropriate. The Commission will 

consider all timely and responsive 

public comments that it receives, 

whether filed in paper or electronic 

form. Comments received will be 

available to the public on the FTC 

website, to the extent practicable, at 

(http://www.ftc.gov/os/ 

publiccomments.shtm). As a matter of 

discretion, the Commission makes every 

effort to remove home contact 

information for individuals from the 

public comments it receives before 

placing those comments on the FTC 

website. More information, including 

routine uses permitted by the Privacy 

Act, may be found in the FTC’s privacy 

policy, at (http://www.ftc.gov/ftc/ 

privacy.shtm). 

FOR FURTHER INFORMATION CONTACT: 

Alain Sheer or Loretta Garrison, Bureau 

of Consumer Protection, 600 

Pennsylvania Avenue, NW, Washington, 

D.C. 20580, (202) 326-2252. 

SUPPLEMENTARY INFORMATION: Pursuant 

to section 6(f) of the Federal Trade 

Commission Act, 38 Stat. 721, 15 U.S.C. 

46(f), and § 2.34 the Commission Rules 

of Practice, 16 CFR 2.34, notice is 

hereby given that the above-captioned 

consent agreement containing a consent 

order to cease and desist, having been 

filed with and accepted, subject to final 

approval, by the Commission, has been 

placed on the public record for a period 

of thirty (30) days. The following 

Analysis to Aid Public Comment 

describes the terms of the consent 

agreement, and the allegations in the 

complaint. An electronic copy of the 

full text of the consent agreement 

package can be obtained from the FTC 

Home Page (for February 18, 2009), on 

the World Wide Web, at (http:// 

www.ftc.gov/os/2009/02/index.htm). A 

paper copy can be obtained from the 

FTC Public Reference Room, Room 130- 

H, 600 Pennsylvania Avenue, NW, 

Washington, D.C. 20580, either in 

person or by calling (202) 326-2222. 

Public comments are invited, and may 

be filed with the Commission in either 

paper or electronic form. All comments 

should be filed as prescribed in the 

ADDRESSES section above, and must be 

received on or before the date specified 

in the DATES section. 

Analysis of Agreement Containing 

Consent Order to Aid Public Comment 

The Federal Trade Commission has 

accepted, subject to final approval, a 

consent agreement from CVS Caremark 

Corporation (‘‘CVS’’). 

The proposed consent order has been 

placed on the public record for thirty 

(30) days for receipt of comments by 

interested persons. Comments received 

during this period will become part of 

the public record. After thirty (30) days, 

the Commission will again review the 

agreement and the comments received, 

and will decide whether it should 

withdraw from the agreement and take 

appropriate action or make final the 

agreement’s proposed order. 

The Commission’s proposed 

complaint alleges that CVS is in the 

business of selling prescription and 

non-prescription medicines and 

supplies, as well as other products. It 

operates, among other things, 

approximately 6,300 retail pharmacy 

stores in the United States (collectively, 

‘‘CVS pharmacies’’) and online and mail 

order pharmacy businesses. The 

company allows consumers buying 

products in CVS pharmacies to pay for 


PWALKER on PROD1PC71 with NOTICES
Federal Register / Vol. 74, No. 56 / Wednesday, March 25, 2009 / Notices 12871 

their purchases with credit, debit and 

electronic benefit transfer cards; 

insurance cards; personal checks; or 

cash. 

The complaint alleges that in 

conducting its business, CVS routinely 

obtains information from or about its 

customers, including, but not limited to, 

name; telephone number; address; date 

of birth; bank account number; payment 

card account number and expiration 

date; driver’s license number or other 

government-issued identification; 

prescription information, such as 

medication and dosage, prescribing 

physician name, address, and telephone 

number, health insurer name, and 

insurance account number and policy 

number; and Social Security number. 

The company also collects and 

maintains employment information 

from its employees, which includes, 

among other things, Social Security 

numbers. 

The complaint further alleges that 

CVS engaged in a number of practices 

that, taken together, failed to provide 

reasonable and appropriate security for 

sensitive information from consumers 

and employees. In particular, CVS failed 

to: (1) implement policies and 

procedures to dispose securely of such 

information, including, but not limited 

to, policies and procedures to render the 

information unreadable in the course of 

disposal; (2) adequately train employees 

to dispose securely of such information; 

(3) use reasonable measures to assess 

compliance with its established policies 

and procedures for the disposal of such 

information; or (4) employ a reasonable 

process for discovering and remedying 

risks to such information. 

The complaint alleges that as a result 

of these failures, CVS pharmacies 

discarded materials containing sensitive 

information in clear readable text (such 

as prescriptions, prescription bottles, 

pharmacy labels, computer printouts, 

prescription purchase refunds, credit 

card receipts, and employee records) in 

unsecured, publicly-accessible trash 

dumpsters on numerous occasions. For 

example, in July 2006 and continuing 

into 2007, television stations and other 

media outlets reported finding such 

information about customers and 

employees in unsecured dumpsters 

used by CVS pharmacies in at least 15 

cities throughout the United States. 

When discarded in publicly-accessible 

dumpsters, such information can be 

obtained by individuals for purposes of 

identity theft or the theft of prescription 

medicines. 

The proposed order applies to 

sensitive information about consumers 

and employees obtained by CVS. It 

contains provisions designed to prevent 

CVS from engaging in the future in 

practices similar to those alleged in the 

complaint. 

Part I of the proposed order prohibits 

misrepresentations about the security, 

confidentiality, and integrity of 

sensitive information. Part II of the 

order requires CVS to establish and 

maintain a comprehensive information 

security program that is reasonably 

designed to protect the security, 

confidentiality, and integrity of such 

information (whether in paper or 

electronic format) about consumers, 

employees, and those seeking to become 

employees. The order covers health and 

other sensitive information obtained by 

all CVS entities, including, but not 

limited to, retail pharmacies and the 

pharmacy benefit management business. 

The security program must contain 

administrative, technical, and physical 

safeguards appropriate to CVS’s size and 

complexity, the nature and scope of its 

activities, and the sensitivity of the 

information collected from or about 

consumers and employees. Specifically, 

the order requires CVS to: 

∑ Designate an employee or 

employees to coordinate and be 

accountable for the information security 

program. 

∑ Identify material internal and 

external risks to the security, 

confidentiality, and integrity of 

customer information that could result 

in the unauthorized disclosure, misuse, 

loss, alteration, destruction, or other 

compromise of such information, and 

assess the sufficiency of any safeguards 

in place to control these risks. 

∑ Design and implement reasonable 

safeguards to control the risks identified 

through risk assessment, and regularly 

test or monitor the effectiveness of the 

safeguards’ key controls, systems, and 

procedures. 

∑ Develop and use reasonable steps to 

select and retain service providers 

capable of appropriately safeguarding 

personal information they receive from 

CVS, and require service providers by 

contract to implement and maintain 

appropriate safeguards. 

∑ Evaluate and adjust its information 

security programs in light of the results 

of testing and monitoring, any material 

changes to operations or business 

arrangements, or any other 

circumstances that it knows or has 

reason to know may have material 

impact on its information security 

program. 

Part III of the proposed order requires 

CVS to obtain within one year, and on 

a biennial basis thereafter for a period 

of twenty (20) years, an assessment and 

report from a qualified, objective, 

independent third-party professional, 

certifying, among other things, that: (1) 

it has in place a security program that 

provides protections that meet or exceed 

the protections required by Part II of the 

proposed order; and (2) its security 

program is operating with sufficient 

effectiveness to provide reasonable 

assurance that the security, 

confidentiality, and integrity of 

sensitive consumer and employee 

information has been protected. 

Parts IV through VIII of the proposed 

order are reporting and compliance 

provisions. Part IV requires CVS to 

retain documents relating to its 

compliance with the order. For most 

records, the order requires that the 

documents be retained for a five-year 

period. For the third-party assessments 

and supporting documents, CVS must 

retain the documents for a period of 

three years after the date that each 

assessment is prepared. Part V requires 

dissemination of the order now and in 

the future to persons with 

responsibilities relating to the subject 

matter of the order. Part VI ensures 

notification to the FTC of changes in 

corporate status. Part VII mandates that 

CVS submit a compliance report to the 

FTC within 90 days, and periodically 

thereafter as requested. Part VIII is a 

provision ‘‘sunsetting’’ the order after 

twenty (20) years, with certain 

exceptions. 

The Commission conducted its 

investigation jointly with the Office for 

Civil Rights in the Department of Health 

and Human Services (‘‘OCR-HHS’’). 

Working together, the Commission and 

OCR-HHS each entered into separate but 

coordinated agreements with CVS to 

resolve all the issues of both agencies. 

This is the Commission’s twentyfourth case to challenge the failure by a 

company to implement reasonable 

information security practices, and the 

first case: (1) involving a health 

provider, (2) proceeding jointly with 

OCR-HHS, and (3) challenging the 

security of employee data. 

The purpose of this analysis is to 

facilitate public comment on the 

proposed order. It is not intended to 

constitute an official interpretation of 

the proposed order or to modify its 

terms in any way. 

By direction of the Commission. 

Donald S. Clark, 

Secretary. 

[FR Doc. E9–6484 Filed 3–24–09: 8:45 am] 

[BILLING CODE 6750–01–S] 


PWALKER on PROD1PC71 with NOTICES