It is not, because HIPAA includes an "official/governmental purposes" exemption. See exemption (5)

https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...

> Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).29

> Judicial and Administrative Proceedings. Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.33

> Law Enforcement Purposes. Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34

> Essential Government Functions. An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.41

The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement.

See, generally, https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe... and the regulations cited therein.

I'm not seeing anything that explicitly calls out Pharmacies.

The police are breaking federal law and the article is wrong. This is not a gray area.

In briefings, officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records.

And in the link you provided:

When might it be permitted for a pharmacy to disclose PHI to law enforcement officers?

Bearing in mind that, once in a designated record set, PHI could be an individual´s name or physical description, a pharmacy (or pharmacy staff) is permitted to – but not required to – disclose PHI to law enforcement officers in the following six circumstances:

as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests

In this case, the leeway in the standard here is what the pharmacy chooses to comply with. They are choosing to comply with subpoenas. This article points out how that standard could be higher (warrants).

I really don't want to keep googling things for you. The police are not judicial officers. Yes, I've read the article.

https://www.law.cornell.edu/cfr/text/45/164.512

And then there's the HHS interpretation of the above for providers, which is... porous:

https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe...

Of particular note are the exemptions in 45 CFR 164.512(k)(2) applicable to powers granted by executive order 12333 (on mass surveillance). When this exemption is used it makes discovering whether, when, how, or why your data was collected or used practically impossible.

Not only was there no way to refuse this but you were automatically enrolled unless you could provide that proof by a certain date.

I got into an argument with the student president about this because I considered it a massive overreach for the school to give my information to the student union who then turns around and gives it to a third party, and that this is just some how a part of completing post secondary education. He was adamant that it was both legal and ethical, and that there was no privacy violation that occurred.

I ended up opting out in time but a few months later I received an email from the insurance company stating that they had been hacked and they weren't quite sure what information had been leaked.

I've never found out what information was transmitted from the student union to the health insurance company, if the company managed to get access to my health records, or if that company has sold those records, or been acquired by a large company that has added those records to their collection, or what the hackers manged to steal.

I guess this is all legal because some student union that gets less than 9% of the student body to vote for them said so?

I could understand about it being legal, maybe even ethical (ethical codes can differ) -- but to argue that there is no privacy violation? That just seems completely delusional.

But PIPEDA definitely applies to this situation, but PIPEDA only came into effect on April 2020 so it would depend upon when you were a student.

The insureco initially would only get your basic demographics (name, gender, age, DOB, phone# & maybe address). The student union doesn't have anything else to give.

In terms of health info, the insureco would only have what you gave them (indirectly via the pharmacy if you presented a prescription for billing to your health plan).

So other than the basic demographics, even if you're forced into the plan, any further info the insureco gets is voluntarily provided by you (but I get that it's a kick in the teeth to pay for insurance, but not use it).

> I ended up opting out in time

were you already with another insurance company provided by someone's employer? Mine keeps changing providers every few years and I can't opt-out other than resign.