I think you misunderstand HIPAA. As long as they have a business associate agreement with the pharmacies and serve some vaguely care-adjacent purpose, the pharmacy can share your data with them without your knowledge or consent.

I can't tell if you're being cynical or serious, but if the latter I can't see how this is correct.

From "Pharmacy privacy Requirements here [1], I don't think "business associate agreement [with] some vaguely care-adjacent purpose" meets the standards for information-sharing. Rather the information must be being shared as part of specific treatment for a patient (discussing actual care) or payment.

[1] https://www.uspharmacist.com/article/hipaa-privacy-security-...

GP comment is being deadly serious and not at all cynical or sarcastic.

HIPAA is a fig leaf. Cardboard covers on clipboards to inconvenience the nurses and receptionists, but a unencumbered infobahn for anyone who touches the money to drive straight through.

For decades, every visit, test, procedure, and medication you've ever had paid for by a health insurer in the US got dumped straight into MIB, where any insurer could look at it. HIPAA functionally changed this not a whit.

> HIPAA has a rule that permits disclosure of PHI for health care operations, treatment, and payment.

I think this is what the GP was referring to. It's not just for care but for payment and operations too. A few operational examples, in the case of pharmacies, they must make sure that a patient doesn't fill the same prescription twice. Health insurance companies receive clinical data from health care providers for the purposes of HEDIS reporting.

Don't forget, the second P in HIPPA is portability.

Sounds like they have hooks into the back end systems to query multiple insurance companies and pharmacies on the fly. - "Milliman instantly gathers information from multiple data sources"

Likely deep within the terms and conditions you agreed to with your private health insurance company, you did indeed give permission.