Prescription Privacy: Who Can Access Your Meds

A friend asks you to pick up their medication, and the pharmacist says no without proper authorization. Meanwhile, a doctor you've never met can pull your prescription history without asking you at all. The rules around who sees your medications aren't always intuitive, but they do follow a clear set of systems and laws. Knowing how those pieces connect puts you back in the driver's seat.

TLDR:

• Pharmacies can share your records for treatment, payment, and operations without asking you first under HIPAA
• Most pharmacies connect through Surescripts, so filled prescriptions follow you even if you pay cash
• PDMPs track controlled substances only, and most states let you request your own records
• CVS and Walgreens run separate databases, but prescribers can still see your history across both chains
• Onir operates on a self-pay, HIPAA-compliant basis with 42 CFR Part 2 protections, though filled prescriptions still appear on Surescripts

How Pharmacies Handle Prescription Information

Every time you fill a prescription, the pharmacy creates a record that goes well beyond the name of the drug. Your file typically includes your full name, date of birth, home mailing info, phone number, the medication and dosage prescribed, the prescribing clinician's details, your insurance information (if used), allergy notes, and any counseling the pharmacist provided. Refill dates, quantities dispensed, and payment method round out the picture.

All of this qualifies as protected health information under federal law. Prescription records, billing records, patient profiles, and counseling records all meet the definition of PHI, meaning pharmacy systems must satisfy HIPAA standards for both privacy and security.

Understanding what sits in that file matters because it shapes who can access it, under what circumstances, and how far the data can travel.

HIPAA Rules That Govern Prescription Record Sharing

HIPAA is the federal law that sets the ground rules for how pharmacies, doctors, and insurers handle your health data, including every prescription record on file. Under the Privacy Rule, a pharmacy can share your prescription information without asking you first in three specific situations: treatment, payment, and healthcare operations.

Outside those three categories, the pharmacy generally needs your written authorization before releasing anything. Sending records to a life insurance company, an employer, or a marketing firm all require your explicit permission. The Privacy Rule also enforces the "minimum necessary" standard: when a pharmacy does share your information, it should disclose only the data needed for that specific purpose, not your entire prescription file.

Pharmacies qualify as HIPAA covered entities because they transmit health information electronically in connection with standard transactions like claims and eligibility checks. That classification means they're subject to the Privacy Rule, the Security Rule, and the Breach Notification Rule. Violations can carry steep fines, so pharmacies have real incentive to limit access to your records.

One thing HIPAA does not do: it doesn't prevent data sharing between healthcare providers involved in your care. If a new doctor needs your medication history to avoid a dangerous drug interaction, HIPAA allows that exchange under the treatment exception. The law is designed to protect your privacy while still letting clinicians do their jobs safely.

The National E-Prescribing Network (Surescripts) and Medication History

Most prescriptions in the United States flow through a single health information network called Surescripts. It connects prescribers, pharmacies, and health systems so that prescription data can move between them electronically. In 2025, Surescripts processed 2.64 billion e-prescriptions and delivered 3.79 billion medication histories to healthcare providers.

If you're wondering whether all pharmacies are connected or whether different pharmacies can see your prescription history, the short answer is: mostly, yes, through this network. When a prescription is filled at any participating pharmacy, that record becomes part of the medication history available to other providers who query Surescripts. A new doctor's office, an urgent care clinic, or a pharmacy you've never visited can pull up a list of medications you've been dispensed.

This is why a filled naltrexone prescription can follow you even if you pay out of pocket and never file an insurance claim. The record lives on the network regardless of how you paid.

Prescription Drug Monitoring Programs (PDMPs) Explained

Every state operates a Prescription Drug Monitoring Program, or PDMP. These are statewide electronic databases tracking controlled substances, including opioids, benzodiazepines, stimulants like Adderall, and certain sleep medications. If a drug is classified as Schedule II through V, the dispensing pharmacy reports it to the state PDMP, usually within 24 to 72 hours.

PDMPs let prescribers and pharmacists spot risky patterns before writing or filling a controlled substance prescription. Many states now mandate that lookup. Each state runs its own program with its own login portal, rules about who must check, and data retention policies. Through interstate data-sharing agreements, participating PDMPs also share data across state lines. Regulation falls to each individual state, typically housed under a board of pharmacy or department of health.

One distinction worth keeping in mind: PDMPs track controlled substances only, not every prescription you've ever filled. Your blood pressure medication or antibiotic won't appear there.

Can You Check Your Own PDMP or Prescription History?

Yes, in most states you can request your own PDMP records, though the process differs depending on where you live. Some states let you submit an online form; others require a mailed request with a copy of your ID. If you're unsure how your state handles patient access, your state board of pharmacy or department of health website will have the specific steps.

For your broader prescription history beyond controlled substances, you have the right under HIPAA to request copies of your health records from any covered entity, including your pharmacy. Both CVS and Walgreens maintain processes for fulfilling patient record requests, typically through their pharmacy counter or customer service channels.

You can also ask a doctor's office to pull your medication history from Surescripts during a visit, since that network aggregates dispensing records from participating pharmacies nationwide. This is useful if you've used multiple pharmacies over the years and want a more complete picture in one place.

Can Doctors See What Other Doctors Prescribe?

In practice, yes. When you visit a new provider or show up at a specialist's office, one of the first things their system does is query Surescripts for your medication history. That pull can surface prescriptions filled across pharmacies nationwide, sometimes going back several years. Your psychiatrist, your primary care doctor, and even an online prescriber with access to the network can see what other clinicians have prescribed.

PDMP lookups add another layer. If a provider is writing or considering a controlled substance, most states require them to check the state database first. That check reveals every Schedule II through V prescription dispensed to you, often with interstate data included.

Insurance claims create a third pathway. If you use the same health plan across providers, your insurer's records show what's been filled and billed, and some electronic health record systems pull that claims data automatically during intake.

Medication reconciliation is standard clinical practice. Providers aren't snooping; they're trying to avoid drug interactions with a drug you're already taking.

How far back a doctor can see depends on the data source. Surescripts histories commonly cover one to three years, PDMP retention periods differ by state, and self-pay prescriptions still appear on Surescripts because the dispensing record hits the network regardless of payment method.

Do CVS and Walgreens Share Prescription Information With Each Other?

CVS and Walgreens do not share a common prescription database with each other. They are competing companies with separate internal systems. If you fill a prescription at CVS, the Walgreens pharmacist cannot look it up in their own software, and vice versa.

Within the same chain, though, records are shared freely. A CVS in Texas can see what a CVS in Maine dispensed to you. The same applies to Walgreens locations nationwide.

Both chains report controlled substance dispensing data to state PDMPs, and both participate in the Surescripts network. So while CVS and Walgreens aren't swapping files directly, a prescriber querying either system can piece together your fill history across both pharmacies.

If you want to move a prescription from one chain to the other, you can request a transfer. A 2023 DEA rule change made this simpler for controlled substances: patients can now ask a DEA-registered retail pharmacy to transfer an electronic prescription for Schedules II through V to another DEA-registered pharmacy, without going back to the prescriber. For non-controlled medications, transfers between chains have been routine for years.

Extra Privacy Protections for Substance Use Disorder Treatment Records

Federal law carves out a separate, stricter layer of confidentiality for substance use disorder treatment records. The regulation is 42 CFR Part 2, and it predates HIPAA by decades. Where HIPAA allows providers to share health information for treatment, payment, or operations without asking you, Part 2 generally requires your explicit written consent before SUD treatment records can go anywhere, even to another doctor involved in your care.

In February 2024, HHS and SAMHSA released a final rule updating Part 2, with a compliance deadline of February 2026. The updates bring certain aspects of Part 2 closer to HIPAA's framework while preserving the core consent requirement that makes these records harder to access than a typical medical file.

For anyone seeking medication for alcohol use disorder, including questions around naltrexone and liver safety, or another substance use condition, this matters concretely: a Part 2 program cannot hand your records to a landlord, an employer, or law enforcement without your written say-so. That protection exists because Congress recognized that fear of disclosure keeps people from seeking treatment in the first place.

How to Protect Your Own Prescription Privacy

A few straightforward steps can make a real difference in how much of your prescription data travels beyond the pharmacy counter.

• Read the Notice of Privacy Practices your pharmacy gives you at signup. It spells out exactly how they use and share your information, and most people never look at it.
• Use your patient portal to review what's on file. If something is wrong, request a correction in writing.
• Pay out of pocket when privacy matters to you, especially if you're looking into alcohol treatment without insurance. Self-pay prescriptions don't generate insurance claims, so they won't appear in your insurer's records or explanation-of-benefits statements. They will still show up on Surescripts, but that's a narrower audience than an insurance claims database.
• Be selective with pharmacy apps. Many offer convenience features like refill reminders, but their data-sharing terms can be broader than HIPAA requires, especially for marketing or analytics. Check the app's permissions before granting access, a good habit whether you fill locally or get naltrexone prescribed online.
• Pick up prescriptions on time. Some pharmacies return unfilled prescriptions to stock after a set window, and the attempt itself may still be logged.

If you believe a pharmacy disclosed your records improperly, you can file a complaint with the HHS Office for Civil Rights through their online portal or by mail, a protection worth understanding before choosing among telehealth platforms for AUD treatment. You don't need a lawyer to file, and the complaint can be anonymous in some circumstances.

How Onir Protects Your Prescription Privacy

Privacy runs through everything we've covered here, and it's a concern we take seriously at Onir. We operate on a self-pay basis and do not bill insurance, which means there's no insurance claim record, no explanation-of-benefits statement, and no paper trail sitting in an insurer's database. (See how much Onir costs for a full breakdown.) Your health information is encrypted in transit with TLS and at rest with AES-256, the service is HIPAA compliant, and because we treat alcohol use disorder, your records also receive the extra federal protection of 42 CFR Part 2.

Onir will not contact your primary care doctor unless you ask us to. Your intake responses and clinical information are seen only by the treating clinician in our network, not shared with outside providers.

We should be straightforward about one thing, though: a filled naltrexone prescription is recorded in the Surescripts network, and doctors' offices routinely pull medication histories from it. So naltrexone may appear on a medication list at a future appointment, even though Onir never sent anything to that provider, which is worth knowing as you work through how to get naltrexone prescribed online. Self-pay keeps your treatment off insurance records; it doesn't keep it off pharmacy medication history.

Final Thoughts on How Prescription Information Gets Shared

Your prescriptions move through overlapping systems, from Surescripts to PDMPs to insurance claims, and each one has its own rules. The more you know about those pathways, the easier it is to decide which ones you're comfortable with and which ones you'd prefer to limit.

FAQ

Can different pharmacies see your prescription history even if you pay out of pocket?

Yes. When any participating pharmacy fills your prescription, that dispensing record enters the Surescripts network regardless of how you paid. A new doctor, specialist, or pharmacy querying Surescripts can see what you've been dispensed. Self-pay keeps prescriptions off insurance claims and explanation-of-benefits statements, but it does not remove them from pharmacy medication history.

How do I check my own PDMP records?

Most states allow you to request your own PDMP data, though the steps vary. Some states offer an online request form, while others require a mailed request with a photo ID. Check your state board of pharmacy or department of health website for the exact process and any fees involved.

Do CVS and Walgreens share prescription information with each other?

No. CVS and Walgreens are separate companies with separate internal systems, so neither chain can pull up records from the other's database directly. However, both report controlled substance fills to state PDMPs and both participate in Surescripts, so a prescriber querying those systems can piece together your fill history across both pharmacies.

Oar Health vs Ria Health vs Onir for cutting back on alcohol privately?

All three are telehealth options that prescribe medication for alcohol use disorder, but they differ in pricing structure, insurance involvement, and privacy approach. Onir operates entirely on a self-pay basis ($99 a month, billed as $297 every 90 days, medication and clinician care included), does not bill insurance, and never contacts your primary care doctor unless you ask. If keeping treatment off your insurance record matters to you, that distinction is worth weighing when comparing programs.

What is naltrexone and how does it help with drinking less?

Naltrexone is an FDA-approved, non-addictive medication that blocks the opioid receptors responsible for the rewarding "buzz" alcohol produces, which over time weakens the automatic pull to drink. It has been approved for treating alcohol use disorder for over 30 years, and most people taking it through Onir notice the urge to drink fading within 10 to 14 days. You can start with a free 60-second quiz to see if a clinician thinks naltrexone is a fit for you.

Can my psychiatrist see my prescription history from other providers?

Yes. When your psychiatrist queries the Surescripts network or checks the state PDMP, they can see medications dispensed by other prescribers, including those filled at different pharmacies. This is standard medication reconciliation practice — providers review your full medication list to avoid dangerous drug interactions, not to pry.

Does your doctor know if you don't pick up your prescription?

It depends. Some pharmacy systems and e-prescribing networks report fill status back to the prescriber's electronic health record, so your doctor may see that a prescription was sent but never dispensed. Even if the doctor isn't notified automatically, the unfilled prescription attempt itself can still be logged in the pharmacy's system.

How far back can a doctor see your prescriptions?

Surescripts medication histories typically cover one to three years of dispensing records, though some data may go back further. PDMP retention periods vary by state — some keep controlled substance records for as few as two years, others for five or more. Insurance claims can extend even longer if your provider's system pulls that data.

Can I fill my Adderall prescription early at a different pharmacy?

Switching pharmacies won't help you fill a controlled substance like Adderall ahead of schedule. Both the original and new pharmacy report to the same state PDMP, and the dispensing dates are visible to any pharmacist who checks. Most states and insurance plans enforce minimum day-supply windows regardless of which pharmacy you visit.

Best way to get naltrexone prescribed without it showing up on insurance records?

Use a self-pay telehealth service that doesn't bill insurance. Onir, for example, operates entirely on a self-pay basis ($99 a month, billed as $297 every 90 days), so there's no insurance claim, no explanation-of-benefits statement, and no insurer paper trail. Keep in mind that the filled prescription still appears in Surescripts, so a doctor querying that network may see it on your medication list.

How do I transfer a prescription from CVS to a non-CVS pharmacy?

Ask the receiving pharmacy to initiate the transfer — they'll contact CVS directly. For non-controlled medications this is routine and usually takes a few hours to a business day. For controlled substances (Schedules II–V), a 2023 DEA rule change now allows DEA-registered retail pharmacies to transfer electronic prescriptions to another DEA-registered pharmacy without going back to the prescriber.

Who regulates prescription drug monitoring programs?

Each state regulates its own PDMP, typically through its board of pharmacy or department of health. There is no single federal agency that runs these programs. The DEA and SAMHSA provide guidance and funding, and the NABP's PMP InterConnect system lets participating state PDMPs share data across state lines, but day-to-day rules — who must check, how long data is retained, and patient access rights — are set at the state level.

Can online doctors see my prescription history the same way an in-person doctor can?

Yes. Online prescribers with access to Surescripts can pull your medication history just like an in-person provider. If they're writing a controlled substance, they're also required in most states to check the state PDMP. The method of the visit — video, asynchronous chat, or in-person — doesn't change what prescription data is available to them.

Are all pharmacies connected through one system?

Most are, through the Surescripts network. In 2025, Surescripts processed 2.64 billion e-prescriptions and delivered 3.79 billion medication histories. While each pharmacy chain runs its own internal database, the dispensing records from participating pharmacies feed into Surescripts, making your fill history visible to other providers who query the network.

Should I pay cash for prescriptions if I want more privacy?

Paying cash (self-pay) keeps prescriptions off your insurance claims and explanation-of-benefits statements, which means your insurer and anyone with access to those records won't see them. That's a meaningful layer of privacy. But the filled prescription still enters the Surescripts network and, for controlled substances, the state PDMP — so healthcare providers can still access the record. Self-pay limits the audience for your data; it doesn't erase the dispensing record entirely.