CVS Caremark Corporation

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF CVS CAREMARK CORPORATION CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4259; File No. 072 3119 Complaint, June 18, 2009 – Decision, June 18, 2009 This consent order addresses CVS Caremark Corporation’s failure to provide reasonable and appropriate security for sensitive information routinely obtained from consumers and employees. The complaint alleges that CVS failed to: (1) implement policies and procedures to dispose securely of such information, including, but not limited to, policies and procedures to render the information unreadable in the course of disposal; (2) adequately train employees to dispose securely of such information; (3) use reasonable measures to assess compliance with its established policies and procedures for the disposal of such information; or (4) employ a reasonable process for discovering and remedying risks to such information. Additionally, CVS pharmacies discarded materials containing sensitive information in clear readable text in unsecured, publicly-accessible trash dumpsters on numerous occasions. The order prohibits misrepresentations about the security, confidentiality, and integrity of sensitive information and requires CVS to establish and maintain a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of sensitive personal information (whether in paper or electronic format) about consumers, employees, and those seeking to become employees. Participants For the Commission: Loretta Garson and Alain Sheer. For the Respondent: Anthony E. DiResta and Mark S. Melodia, ReedSmith LLP.

COMPLAINT The Federal Trade Commission (“Commission”), having reason to believe that CVS Caremark Corporation (“respondent” or “CVS”) has violated the provisions of the Federal Trade Commission Act, VOLUME 147 Complaint and it appearing to the Commission that this proceeding is in the public interest, alleges:

5. Respondent CVS is a Delaware corporation with its principal office or place of business at One CVS Drive, Woonsocket, Rhode Island, 02895. It conducts business through several wholly-owned subsidiaries and limited liability companies, including, but not limited to, CVS Pharmacy, Inc.

6. The acts and practices of respondent as alleged in this complaint are in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. RESPONDENT’S BUSINESS 7. At all relevant times, respondent has been in the business of selling prescription and non-prescription medicines and supplies, as well as other products. It operates, among other things, approximately 6,300 retail pharmacy stores in the United States (collectively, “CVS pharmacies”) and online and mail order pharmacy businesses. Respondent allows consumers buying products in CVS pharmacies to pay for their purchases with credit, debit and electronic benefit transfer cards (collectively, “payment cards”); insurance cards; personal checks; or cash. 8. In conducting its business, respondent routinely obtains information from or about its customers, including, but not limited to, name; telephone number; address; date of birth; bank account number; payment card account number and expiration date; driver’s license number or other government-issued identification; prescription information, such as medication and dosage, prescribing physician name, address, and telephone number, health insurer name, and insurance account number and policy number; and Social Security number (collectively, “personal information”). Respondent also collects sensitive information from or about its employees, including, but not limited to, Social Security number. CVS CAREMARK CORPORATION 839 Complaint 9. Respondent operates computer networks that connect various components of its business, including CVS pharmacies, parts of the online and mail order pharmacy businesses, corporate headquarters, and distribution centers. Among other things, respondent uses the networks to aggregate, store, and transmit personal information; fill orders for prescription medicines and supplies; and process sales, including to obtain authorization for payment card and insurance card transactions.

RESPONDENT’S REPRESENTATIONS 10. Since at least 2003, respondent has disseminated or caused to be disseminated statements and privacy policies, including, but not necessarily limited to, the following statement regarding the privacy and confidentiality of personal information: CVS/pharmacy wants you to know that nothing is more central to our operations than maintaining the privacy of your health information (“Protected Health Information” or “PHI”). PHI is information about you, including basic information that may identify you and relates to your past, present, or future health or condition and the dispensing of pharmaceutical products to you. We take this responsibility very seriously. (CVS Privacy Policy, attached as Exhibit A.) RESPONDENT’S SECURITY PRACTICES 11. Respondent has engaged in a number of practices that, taken together, failed to provide reasonable and appropriate security for personal information. Among other things, respondent has failed to: (1) implement policies and procedures to dispose securely of such information, including, but not limited to, policies and procedures to render the information unreadable in the course of disposal; (2) adequately train employees to dispose securely of such information; (3) use reasonable measures to assess compliance with its established policies and procedures for the disposal of such VOLUME 147 Complaint information; or (4) employ a reasonable process for discovering and remedying risks to such information.

12. As a result of the failures set forth in Paragraph 7, CVS pharmacies discarded materials containing personal information in clear readable text (such as prescriptions, prescription bottles, pharmacy labels, computer printouts, prescription purchase refunds, credit card receipts, and employee records) in unsecured, publiclyaccessible trash dumpsters on numerous occasions. For example, in July 2006 and continuing into 2007, television stations and other media outlets reported finding personal information in unsecured dumpsters used by CVS pharmacies in at least 15 cities throughout the United States. The personal information found in the dumpsters included information about both CVS’s customers and its employees. When discarded in publicly-accessible dumpsters, such information can be obtained by individuals for purposes of identity theft or the theft of prescription medicines. VIOLATIONS OF THE FTC ACT 9. Through the means described in Paragraph 6, respondent represented, expressly or by implication, that it implemented reasonable and appropriate measures to protect personal information against unauthorized access.

10. In truth and in fact, respondent did not implement reasonable and appropriate measures to protect personal information against unauthorized access. Therefore, the representation set forth in Paragraph 9 was, and is, false or misleading. 11. As set forth in Paragraph 7, respondent failed to employ reasonable and appropriate measures to prevent unauthorized access to personal information. Respondent’s practices caused, or are likely to cause, substantial injury to consumers that is not offset by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers. This practice was, and is, an unfair act or practice.

CVS CAREMARK CORPORATION 841 Complaint THEREFORE, the Federal Trade Commission this eighteenth day of June, 2009, has issued this complaint against respondent. By the Commission.

VOLUME 147 Complaint Exhibit A CVS CAREMARK CORPORATION 843 Decision and Order DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft Complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the Respondent with violation of the Federal Trade Commission Act, 15 U.S.C. § 45 et seq;

The Respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft Complaint, a statement that the signing of said Consent Agreement is for settlement purposes only and does not constitute an admission by Respondent that the law has been violated as alleged in such Complaint, or that the facts as alleged in such Complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it has reason to believe that the Respondent has violated the said Act, and that a Complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such Consent Agreement on the public record for a period of thirty (30) days, and having duly considered the comments filed thereafter by interested persons pursuant to Section 2.34 of its Rules, now in further conformity with the procedure described in Section 2.34 of its Rules, the Commission hereby issues its Complaint, makes the following jurisdictional findings and enters the following Order: 1. Respondent CVS Caremark Corporation is a Delaware corporation with its principal office or place of business at One CVS Drive, Woonsocket, Rhode Island, 02895. VOLUME 147 Decision and Order 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondent, and the proceeding is in the public interest. ORDER DEFINITIONS For purposes of this order, the following definitions shall apply: 1. Unless otherwise specified, “store” shall mean each pharmacy entity or store location that sells prescription medicines, drugs, devices, supplies, or services and/or nonprescription products and services.

2. Unless otherwise specified, “LLC” shall mean a limited liability company: (a) that owns, controls, or operates one or more stores (including, but not limited to, the companies identified in attached Exhibit A), and (b) in which CVS Caremark Corporation is a member, directly or indirectly. 3. Unless otherwise specified, “respondent” shall mean CVS Caremark Corporation, its subsidiaries, divisions, affiliates, and LLCs, and its successors and assigns. 4. “Personal information” shall mean individually identifiable information from or about an individual consumer including, but not limited to: (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name; (d) a telephone number; (e) a Social Security number; (f) a driver’s license number or other governmentissued identification number; (g) prescription information, such as medication and dosage, and prescribing physician name, address, and telephone number, health insurer name, insurance account number, or insurance policy number; (h) a bank account, debit card, or credit card account number; (i) a CVS CAREMARK CORPORATION 845 Decision and Order persistent identifier, such as a customer number held in a “cookie” or processor serial number, that is combined with other available data that identifies an individual consumer; (j) a biometric record; or (k) any information that is combined with any of (a) through (j) above. For the purpose of this provision, a “consumer” shall include an “employee,” and an individual seeking to become an employee, where “employee” shall mean an agent, servant, salesperson, associate, independent contractor, and other person directly or indirectly under the control of respondent. 5. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. I.

IT IS ORDERED that respondent, and its officers, agents, representatives, and employees, directly or through any corporation, subsidiary, limited liability company, division, or other device, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication, the extent to which it maintains and protects the privacy, confidentiality, security, or integrity of personal information collected from or about consumers.

II.

IT IS FURTHER ORDERED that respondent, and its officers, agents, representatives, and employees, directly or through any corporation, subsidiary, limited liability company, division, or other device, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall, no later than the date of service of this order, establish and implement, and thereafter maintain, a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. Such program, the content and VOLUME 147 Decision and Order implementation of which must be fully documented in writing, shall contain administrative, technical, and physical safeguards appropriate to respondent’s size and complexity, the nature and scope of respondent’s activities, and the sensitivity of the personal information collected from or about consumers, including: A. the designation of an employee or employees to coordinate and be accountable for the information security program. B. the identification of material internal and external risks to the security, confidentiality, and integrity of personal information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and assessment of the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment should include consideration of risks in each area of relevant operation, including, but not limited to: (1) employee training and management; (2) information systems, including network and software design, information processing, storage, transmission, and disposal; and (3) prevention, detection, and response to attacks, intrusions, or other systems failures.

C. the design and implementation of reasonable safeguards to control the risks identified through risk assessment, and regular testing or monitoring of the effectiveness of the safeguards’ key controls, systems, and procedures. D. the development and use of reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from respondent, and requiring service providers by contract to implement and maintain appropriate safeguards. E. the evaluation and adjustment of respondent’s information security program in light of the results of the testing and monitoring required by subpart C, any material changes to respondent’s operations or business arrangements, or any CVS CAREMARK CORPORATION 847 Decision and Order other circumstances that respondent knows or has reason to know may have a material impact on the effectiveness of its information security program.

III.

IT IS FURTHER ORDERED that, in connection with their compliance with Part II of this order, respondent, and its officers, agents, representatives, and employees, shall obtain initial and biennial assessments and reports (“Assessments”) from a qualified, objective, independent third-party professional, who uses procedures and standards generally accepted in the profession. The reporting period for the Assessments shall cover: (1) the first year after service of the order for the initial Assessment, and (2) each two (2) year period thereafter for twenty (20) years after service of the order for the biennial Assessments. Each Assessment shall: A. set forth the specific administrative, technical, and physical safeguards that respondent has implemented and maintained during the reporting period;

B. explain how such safeguards are appropriate to respondent’s size and complexity, the nature and scope of respondent’s activities, and the sensitivity of the personal information collected from or about consumers;

C. explain how the safeguards that have been implemented meet or exceed the protections required by the Part II of this order; and D. certify that respondent’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of personal information is protected and has so operated throughout the reporting period.

Each Assessment shall be prepared and completed within sixty (60) days after the end of the reporting period to which the Assessment VOLUME 147 Decision and Order applies by a person qualified as a Certified Information System Security Professional (CISSP) or as a Certified Information Systems Auditor (CISA); a person holding Global Information Assurance Certification (GIAC) from the SysAdmin, Audit, Network, Security (SANS) Institute; or a qualified person or organization approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580. Respondent shall provide the initial Assessment to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580, within ten (10) days after the Assessment has been prepared. All subsequent biennial Assessments shall be retained by respondent until the order is terminated and provided to the Associate Director for Enforcement within ten (10) days of request.

IV.

IT IS FURTHER ORDERED that respondent shall maintain and, upon request, make available to the Federal Trade Commission for inspection and copying:

A. for a period of five (5) years, a print or electronic copy of each document relating to compliance, including, but not limited to, documents, prepared by or on behalf of respondent, that contradict, qualify, or call into question respondent’s compliance with this order; and B. for a period of three (3) years after the date of preparation of each Assessment required under Part III of this order, all materials relied upon to prepare the Assessment, whether prepared by or on behalf of respondent, including, but not limited to, all plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, and any other materials relating to respondent’s compliance with Parts II and III of this order, for the compliance period covered by such Assessment.

CVS CAREMARK CORPORATION 849 Decision and Order V.

IT IS FURTHER ORDERED that respondent CVS Caremark Corporation shall deliver a copy of this order to all its current and future subsidiaries (including LLCs and each store that is owned, controlled, or operated by respondent or an LLC), current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities relating to the subject matter of this order. Respondent shall deliver this order to such current subsidiaries and personnel within sixty (60) days after service of this order, and to such future subsidiaries and personnel within sixty (60) days after the respondent acquires the subsidiary or the person assumes such position or responsibilities.

VI.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least thirty (30) days prior to any change in respondent that may affect compliance obligations arising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor company; the creation or dissolution of a subsidiary (including an LLC), parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in respondent’s name or address. Provided, however, that, with respect to any proposed change in respondent about which respondent learns less than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VII.

VOLUME 147 Decision and Order IT IS FURTHER ORDERED that respondent shall, within ninety (90) days after service of this order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this order. VIII.

This order will terminate on June 18, 2029, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part in this order that terminates in less than twenty (20) years;

B. This order’s application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission.

CVS CAREMARK CORPORATION 851 Decision and Order Exhibit A Privileged and Highty Confidential CVS/pharmacy Rx Store Entities with Store Count |Store Count EntityName by Entity Owner 103rd Avenue CVS, L.L.C. 1|Cvs Pharmacy, Inc. \25th Street CVS, Inc. 1|cvs Pharmaey, Inc. 295 Westport Ave. CVS, Inc. 1|CVS Pharmacy, Inc. 37th Minneapolis CVS, L.L.C. t|evs PI Inc. ‘54th Wester Chicago CVS, L.L.C. t|cvs Pharmacy, Inc. [59th Ashland CVS, LL.C. t|cvs Pharmacy, Inc. 79th Street CVS, L.L.C. 4|CVS Pharmacy, Inc. 187th Avenue CVS, LLC. 4|CVS Pharmacy, inc. lAbington CVS, Inc. }- ove Pramas.

ADI Realty, Inc. in 3] Arbor Drugs, Inc. Admiral Douglas CVS, Inc. 1|Cranston-Reservoir CVS, inc. [Alabama CVS P Luc. | ___443|CVS Pharmacy, inc. | |Alabama Road CVS, Ine. | __1]cvs Pharmacy, inc. Albemarie CVS, Inc. i]CVS Pharmacy, Inc. ‘Alexandria Duke CVS, Inc. ilcvs PI Inc. Allentown CVS. Inc. 1|CVS Pharmacy, [Allentown Village CVS, Inc. [_ilevse oy, ne. lAimshouse CVS, Inc. icvs P . Inc.

|American Drug Stores Delaware, L.L.C. CVS Caremark Corporation [Ames Plaza CVS, inc. CVS P , Inc.

Street CVS, Inc. ‘Cranston-Reservoir Inc. Annapolis Riva CVS, inc. cvs, ine.

6) Anderson House Inc. 1\CVS , inc, ‘Angelini Ave. CVS, Inc. tlevs Pharmacy, Inc. /Aquia Harbor CVS, inc. {CVS Pharmacy, Inc. \Aquidneck Drug CVS, Inc. 1|Cranston-Reservoir CVS, Inc. Arizona CVS Stores, L.L.C.

Adlington 10th Street CVS, Inc.

lArlington CVS. inc. Pi Inc.

CVS, Inc. | Inc.

South Eads CVS, inc. ilcvs Inc.

Aslington-Walter Reed CVS, Inc. ilcvs Ine. CVS-0004310 VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 853 Decision and Order Privileged and Highly Confidential CVS-0004312 VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 855 Decision and Order Priviteged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count Store Count EntityName by Entity Owner Clover CVS, L.L.C. 1|CVS VA Distribution, Inc. Cochran CVS, L.L.C. 1|CVS VA Distribution, Inc. Colct CT CVS, Inc. 1\CVS Pha, INC.

(CollegevileCvS,inc. |B CVS Pharmacy, inc. \Columbus CVS, L.L.C. Revco Discount Drug Centers, Inc. Columbus High Street CVS, inc. 1|CVS Pharmacy, Inc. ‘Columbus Polaris CVS, inc. 1|CVS Pha Inc. ‘Compo Center CVS, Inc. i|CVSP Inc.

oncord Crisco CVS, Inc. 1j/CVSP inc.

|Connecticut CVS P LLc. 2|CVS Phe cy. Inc. Page 5 CVS-0004314 VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 857 Decision and Order Privileged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count Entit b Owner CVS Clyde Park, Inc. CVS Pharmacy, ine. CVS Crystal Demy, L.L.C. | ___1|CVS Pharmacy, nc. CVS Danbury Padanaram, Inc. | __1|CVs Pharmacy, Inc. ICVS Dekalb Noristown,inc. |S 1 CVS Pharmacy, Inc. CVS Detrolt 8275, LL.C. 1|CVS MI Distribution, Inc. CVS Dunkirk Marketplace, L.L.C. 1| Jumpers Hole CVS, Inc. cvs Inc. ICVS Pharmacy, Inc.

CVS EGL 111th Kansas City MO, Inc. CVS Pharmacy, Inc. CVS EGL 119th Oklahoma, Inc. [| ___1|CVSPharmacy, Inc. CVS EGL 15th Oklahoma City OK, Inc. |___1/cvs Pharmacy, inc. CVS EGL 16th Basaline AZ, L.L.C.

CVS EGL 23rd Independence MO, Inc.

CVS EGL 23rd Oklaho CVS EGL 25th Gulfport MS, Inc.

CVS EGL 37th St Petersburg FL, L.LC.

CVS EGL 49th Pinellas Park FL, LLC.

CVS EGL 4th Chickasha OK, inc.

CVS EGL 4th Oklahoma City OK, Inc.

CVS EGL 6th Winter Haven FL, L.L.C.

CVS EGL.75th B Z. LLC.

CVS EGL Atlantic Cocoa Beach FL, LLC. ‘CVS EGL Broadway Tempe AZ, L.L.C.

CVS EGL Brookside MO, Inc.

ICVS EGL Commerce Ardmore OK, Inc.

S$ EGL County Line Ridg d MS, Inc.

CVS EGL Cuny Ford Road FL, L.L.C.

VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 859 Decision and Order Privileged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count Store Count |EntityName Owner CVS EGL Main Norman OK, Inc. 1|CVS Pharmacy, Inc. CVS EGL 1|CVS RX Services, Inc.

ICVS EGL Martin Greenville MS, Inc. 1|CVS Inc. ‘CVS EGL Martin Luther King OK, Inc. 1|Cvs Inc. CVS EGL Oklahoma, Inc. ijcvs )_ Inc.

CVS EGL McComb MS, Inc. 1|CVS Pharmacy, Inc. CVS EGL McDowell Mesa AZ, L.L.C. A|CVS Pharmacy, Inc. CVS EGL Mesa AZ, L.L.C. 1jCVs Inc.

CVS EGL Missouri Ave FL, L.L.C. IICVS RX Inc. CVS EGL Moore OK, Inc. A|CVS PI , Inc. CVS EGL Mur Len Olathe KS, Inc. 1jCvs Inc. CVS EGL Nail Avenue KS, Inc. 1jCvs Inc. \CVS EGL Natchez MS, Inc. 4|CVS Pharmacy, Inc. CVS EGL Norman OK, Inc. 1jcvs inc.

CVS EGL North 16th AZ, L.L.C. 1|CVS Pharmacy, Inc. ‘CVS EGL North Belton MO, Inc. 1|CVS Pharmacy, inc. ICVS EGL North Cleveland FL, L.L.C. 1|CVS RX Services, Inc. CVS EGL North Davis MS, Inc. 1\Cvs inc. CVS EGL North Federal FL, L.L.C. 1|CVS RX Services, Inc. CVS EGL North Inc. ijcvs As ‘CVS EGL North Rockwell OK, Inc. 4|CVS Pharmacy, Inc. CVS EGL Oiathe KS. Inc.

CVS EGL Orlando Sanford FL, L.L.C. CVS RX Services, Inc. CVS EGL Orlando Winter Park FL, L.LC. ICVS RX Services, Inc. cvs Inc.

CVS EGL Pascagoula MS, Inc. 1 CVS EGL Peari MS, Inc. ijcvs Inc.

i ICVS EGL Picayune MS, Inc.

CVS EGL Platte City MO, Inc. CVS Pharmacy, Inc. CVS EGL Port Southwest FL, L.L.C. CVS Pha A CVS EGL Prairie Inc. ICVS Pharmacy, Inc. CVS EGL Reno Inc. cvs inc.

ICVS EGL Richland MS, Inc. CVS Pharmacy, Inc._ Ve nanati A VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 861 Decision and Order Privileged and Highty Confidential CVS/pharmacy Rx Store Entities with Store Count Store Count Enti by Ent Owner 4|CVS RS Arizona, LLC.

CVS Gilford, LLC. ilevsP . Ine.

CVS Green Mount, L.L.C. 1/Cvs P Inc.

CVS Hartland 6295, LLC. 1|CVS MI Distribution, inc. CVS Hilliard OH, Inc. 1/cvs P Inc.

‘CVS Huntersville, Inc. 1|CVS Pharmacy, Inc. ICVS Keene, LLC. 1|CVS Pharmacy, inc. CVS Lake Norwood, inc. | A|CVS Pharmacy, inc. CVS Lansdowne 3142, LLC. 1|CVS IN Distribution, inc. CVS Mack Drug of New York, LLC. 8|CVS Pharmacy, Inc. CVS Macomb & Mlle, inc. ilevs P oy, Inc. ICVS Mammoth Road, LL.C. 1|CVS Pha Inc. CVS Manchester NH, LLC. 5|CVS Pharmacy, Inc. ICVS Meriden East Main, Inc. 1|CVS Pharmacy, Inc. CVS Merrimack Main Street, L.L.C. 1|CVS Pharmacy, Inc. CVS Midlothian, L.L.C. ilovs P cy. inc. S Morse, Inc. 1 P C) CVS Murrells, Inc. tlevs Pharmacy.inc. ‘CVS Nations Ford Chariotte, inc. A|CVS Pharmacy, Inc. CVS New Baltimore, Inc. A|CVS Pharmacy, Inc. [Cvs North Conway, LLL.C. 1|CVS P cy, Inc. ICVS Odenton, LLC 1 Hole CVS, Inc.

ICVS of Concord NH, L.L.C 1|CVS Pharmacy, inc. CVS of DC and VA, Inc. 26|CVS Pharmacy.Inc. CVS of Madison, Conn., Inc. | ___tlevs Pharmacy, inc. ae oe CVS of North Kingstown, Inc. 1|Cranston-Reservoir CVS, Inc. CVS of Penns Ine. 7|CVS of DC and VA, Inc. Page 11 eve_annayon VOLUME 147 Decision and Order CVS CAREMARK CORPORATION Decision and Order Privileged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count Store Count Ei Owner Desert Inn CVS, L.L.C. 1\CVS j_ Inc.

Detroit Greenfield CVS, inc. 1]/CVS Inc. Dexter Plaza CVS, Inc. 1|CVS Pharmacy, Inc. District of Columbia CVS Lc. 2|CVS Inc. Division LLC. ijcvs Inc.

Downers Grove CVS, L.L.C. 4|CVS , Inc. Downi CVS, Inc. 1|CVS Pharmacy, Inc.

Drexel Hill CVS, Inc. 1jcvs Inc.

Duke Street CVS, Inc. AjCvs, Inc.

‘Duluth CVS, Inc. A\Cvs Inc.

Duncan SC CVS, Inc. 1|CVvS Inc.

Dundee CVS, L.L.C. ijcvs inc.

Dunlap Phoenix CVS, L.L.C. icvs Inc.

Farms Inc. ijcvs Inc.

Eagan MN CVS, L_L.C. 1|CVS Pharmacy, Inc. Eagle Valley CVS, Inc. 1|cvs Pharmacy, Inc. East Avenue CVS, Inc. 1|Cranston-Reservoir CVS, Inc. East Bradford Plaza CVS, Inc. 1|CVS Pharmacy, Inc._ East Greenwich CVS, Inc. 1|Cranston-Reservolr CVS, Inc. East Hartford CVS, Inc. 1|CVS Pharmacy, Inc. East Hartford-Main Street CVS, Inc. ijcvs AL East Haven Main Street CVS, Inc. icvs AL East Main Bridgeport CVS, inc. 1\cvs Inc. East Providence CVS, Inc. 1|Cranston-Reservolr CVS, inc. East Putnam Avenue CVS, inc. 14|CVS Pharmacy, Inc. East Side CVS, Inc. 1|Cranston-Reservoir CVS, Inc. Easton Ave. CVS, Inc. 1}CVS Pharmacy, Inc. Easton CVS, Ine. ijcvs Inc.

Easton Nazareth CVS, Inc. ijcvs Inc.

Easton Washington Street CVS, Inc. ilcvs Ine. CVS, Inc. 1cvs Inc.

Eleventh Street Inc. 1/CVS Phar Inc.

CVS, LLC. i1|CVS Inc.

Elliot Tempe CVS, L.L.C. 1|CVS Pharmacy, Inc. Elwood Lc. CVS IN Distribution, Inc.

Elmhurst CVS, L.L.C. icvs Inc.

Emmaus Avenue CVS, Inc. 1 Pharmacy, Inc. Page 13 mre nanat7? VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 865 Decision and Order Privileged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count Store Count EntityName by En Owner Frederick CVS, Inc. 1|CVS Pharmacy, Inc. Gahanna OH Inc. 1|CVS Inc.

Garden City CVS, Inc. 1|Cranston-Reservolr CVS, inc. Garfield Beach CVS, L.L.C. 374/CVS Inc. G OH CVS, LLC. 1]Reveo Discount Centers, Inc. \G cvs LLC. 24/CVS Pharmacy, Inc.

German Dobson CVS, L.L.C. 14|CVS Pharmacy, Inc. Germantown Avenue CVS, Inc. 1|CVS Pharmacy, Inc. MD CVS, L.L.C. 1|Bud's Price Inc.

Inc. 1 Pharmacy, Inc.

Glast Inc. 1|CVS Pharmacy, inc.

Glebe Road Inc. 1|CVS of DC and VA, Inc. Glen Allen Inc. 1\Cvs Inc.

Glen Bumie MD CVS, L.L.C. 1|CVS of Maryland, Inc. Avenue CVS, Inc. 1|CVS Pharmacy, Inc. Godshall Franconia CVS, Inc. i1|Cvs Inc. Goodwin Park CVS, Inc. 1|CVS Pharmacy, Inc. CVS, L.LC. 1|/CVS RX Inc.

Goshen Vill Inc. ijcvs line.

Graham Charlotte CVS, Inc. 1|CVS Pharmacy, Inc. CVS, Inc. 1 Inc.

Grand Schaefer inc. 1\Cvs j_ Inc.

Grand St. Paul CVS, LLC. 13|Cvs Inc.

Granite Street CVS, Inc. 1|Cranston-Reservoir Inc. Gratiot Inc. ijcvs Inc.

Inc. 1|CVS of DC and VA, Inc.

Greenbelt CVS, Inc. 1 / Inc.

Greenbelt-C CVS, Inc. 1|CVS Pharmacy, Inc. ‘Greensboro GA CVS, Inc. ijcvs Inc.

CVS, Inc. 1|Cranston-Reservoir CVS, Inc. Greenwich 99 CVS, Inc. 1|CVS PI Inc.

Grove City CVS, Inc. 4|CVS Pharmacy, Inc. Guilford CVS, Inc. 1|Cvs Inc.

Gwinnett Inc. 1jCvs Inc.

Hamden Plaza Inc. ijcvs Inc.

‘Hamilton CVS, L.L.C. 1|Revco Discount Centers, Inc. Hamlin CVS, Inc. A|CVS Pharmacy. Inc. Page 15 eve nanan VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 867 Decision and Order Privileged and Highly Confidential Jefferson CVS, Inc Jenkintown CVS, Inc.

jJennersvilie Inc.

Johnston Centre CVS, Inc. 1|Cranston-Reservoir CVS, Inc. Jollet CVS, LLC. [evs Pharmacy. Inc. | = Jonesboro CVS, Inc. CVS P cy, Inc, K Street CVS, ine. |__levsof DC and VA Inc. | Kankakee IL CVS, L.L.C. icvs P inc.

Kansas CVS Pharmacy, L.L.C. 19|CVS Pharmacy, Inc. Page 17 CVSnnna ya VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 869 Decision and Order Privileged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count le ‘Store Count EntityName by Entity Owner Loehmann's Piaza CVS, Inc. 1|CVS Pharmacy, Inc. Lombard CVS, L.L.C. 1|CVS Pharmacy, Inc. Lombard-Light Streets CVS, Inc. 1|CVS Pharmacy, Inc. Lone Oak KY CVS, inc. 1|CVS Pharmacy. Inc. [Long Hill Road CVS, Inc. 1|CVS Pharmacy, Inc. ong Shoals Road CVS, Inc. A|CVS Pharmacy, inc. Louisiana CVS Pharmacy, L.L.C. 86) CVS Pharmacy, Inc. Lower Makefield CVS P j, inc.

IMSteetGvs,in. CVS of DC and VA Inc.

MacArthur Boulevard CVS, Inc. 1|CVS Phe Inc. Madison Chicago CVS, L.L.C. 1|CVS Pharmacy, Inc. Main A polis CVS, L.L.C. 1|CVS of d, Inc. Main Devon Bartlett CVS, L.L.C. 1|CVS Pharmacy, Inc. Main Montgomery CVS, L.L.C. 41|CVS VA Distribution, Inc. CVS PI Inc.

[Manchester North Main CVS, Inc. A|CVS Pharmacy, Inc, Mansfield Shopping Center CVS, Inc. 1]CVS Pharmacy, Inc. Manton Avenue CVS, Inc. 1|Cranston-Reservoir CVS, Inc. Glen CVS, Inc. |_____alevs Pharmacy, inc. ‘Mason CVS, Inc.

Massachusetts Avenue CVS, L.L.C. CVS of DC and VA, Inc. Massachusetts CVS P ,. CVS PI Inc.

CVS-0004328 VOLUME 147 Decision and Order CVS CAREMARK CORPORATION Decision and Order Privileged and Highty Confidential CVS/pharmacy Rx Store Entities with Store Count ‘Store Count EntityName Ei Owner New Britain CVS, Inc. ijcvs inc.

New Britain Township CVS, Inc. icvs Phi Inc. New Haven Crown CVS, Inc. A|CVS Phi . Inc. New Hope MN CVS, L_L.C. 1|CVS Phi Inc. New Ji Avenue CVS, L.L.C. 1|CVS of DC and VA, Inc. New Jersey CVS Pharmacy, L.L.C. 224\Cvs . Inc. New Lenox CVS, L.LC. 4|CVS 1, Inc.

New London Ocean Avenue CVS, Inc. 1\Cvs Inc. New London Turn, Inc. ijcvs ), Inc.

Newark East Main CVS, Inc. 1|CVS Pharmacy, Inc. Cedar CVS, Inc. 1}CVS Pharmacy, Inc.

Newnan Inc. 1 Phi Inc.

CVS, Inc. 1|Cranston-Reservoir CVS, Inc. Newtown CVS, Inc. 1|Cvs }. Inc.

Niles Inc. 1|CVS PI Au Niles CVS, L.L.C. 1|evs, Inc.

Norristown CVS, Inc. ijcvs 1. Inc, North Carolina, 1|CVS Pharmacy, Inc.

North Carolina CVS Lic. 18|CVS Inc.

North Grace Lombard Lc. 1|CVS Pharmacy, Inc. North Haven Inc. ijcvs Inc.

North Las CVS, L.L.C. AICVS Pharmacy, Inc. |North Olmstead OH CVS, Inc. ijcvs Inc. Northwest K Street CVS, Inc. 1|CVS PI Inc. ‘Northwest M Street CVS, L.L.C. 1|CVS of DC and VA, Inc. Norwalk Broad Street CVS, inc. 1|CVS Pharmacy, Inc. Norwich Main Street Inc. 1|CVS Pharmacy, Inc. Notre Dame Inc. 4}CVS Pharmacy, inc.

|Oak Lane CVS, Inc. 1\Cvs Inc.

Oak NC CVS, Inc. 4|CVS Phi, Inc.

Oakwood CVS, Inc. 1\cvs Inc.

Ocean City MD CVS, L.L.C. 1]CVS of Maryland, inc. Ohio CVS Stores, L.L.C. 6 Inc.

Oklahoma CVS Lc. 2|CVS Pharmacy, Inc. |\Oid Buncombe Road CVS, Inc. ijcvs Inc. Old Greenwich CVS, Inc. 1jCvs, Inc.

Page 21 VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 873 Decision and Order Privileged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count Store Count ~ | [EntityName. by Entity Qvener Pittston CVS, Inc. 1|CVS Pharmacy, inc. Plainfield CVS, Inc. 1|CVS P cy, Inc. Plainfield IL CVS, LLC. | __ilcvse Ine, [Plymouth MN CVS, L.L.C. [CVS Pharmacy, inc. | Port Huron CVS, Ine. Jcvs Pharmacy, inc. | Porters Pass CVS, inc. lcvs Pharmacy. inc. Portsmouth CVS, Inc. Cranston-Reservoir CVS, Inc. Page 23 CVS-0004332 VOLUME 147 Decision and Order CVS CAREMARK CORPORATION Decision and Order Privileged and Highly Confidential JEntityName__ SEC CVS, Inc.

‘Sedalia NC CVS, Inc.

Sedwick Ourham CVS, L.L.C.

Senip CVS, L.L.C.

Severn CVS, Inc.

S our CVS, Inc.

Shallowford Road CVS, Inc.

Shamokin CVS, Inc.

‘Sharon Hill CVS, Inc.

:

‘Sheffield Avenue CVS, L.L.C.

by Township S, Inc.

Shelbyvile Main CVS, Inc.

Page 25 evennnar VOLUME 147 Decision and Order CVS CAREMARK C ORPORATION Decision and Order Privileged and Highly Confidential CVS/pharmacy Rx Store Entities with Store Count Store Count EntityName by Enti! Owner Thomas Phoenix CVS, L.L.C. 1|CVS RX Services, Inc. [Thombury CVS, Inc. 1|CVS Pharmacy. Inc. Thomdale PA CVS, inc. 1|Cvs Ph Inc.

[Tiverton CVS, tnc. |______1|Cranston-Resorvoir CVS, inc. Tolland CVS, inc. 1|CVS Pharmacy. inc. | Toombs Avenue CVS, LLC. 1|CVS IN Distribution, Inc. Torresdale CVS, Inc. tlevs P , Ine.

Torrington Main Street CVS, Inc. | __aievse inc. Towanda CVS, Inc. 1|CVS Pharmacy, Inc. Tower CVS, Inc. 1|CVS Pharmacy, Inc.

Towne Lake CVS, Inc. tlcvs Pharmacy, inc. | ippe CVS, Inc. 1|CVS Pharmacy, Inc.

Tucker CVS, Inc. 1|CVs Pharmacy, Inc. Tucson AZ CVS, LLC. | __4|CVs Pharmacy, Inc. ty Third Fairmount CVS, Inc. | sevs Pharmacy, inc. [Tyrone CVS, Inc. | ilevsP Union Boulevard CVS, Inc. 1 Union CVS, Inc. 1 ersity Mesa CVS, LLC. 1 University St. Paul CVS, L.L.C. 1 i Wheaton CVS, ine. 1 ——— paper Hembree CVS, Inc.

lUpper Uwchlan CVS, inc.

Verde NV CVS, L.L.C.

Vernon CVS, Inc.

Village Plaza CVS, Inc.

Vine & Taft CVS, Inc.

gs Jublioe CVS, Inc.

ginia CVS Pharmacy, L.L.C.

W. Ponce DeLeon CVS, Ine.

Wadsworth CVS, Inc.

CVS Pharmacy, Inc.

———— Waldorf MD CVS, L.L.C. CVS of d, Inc. Walnut Hill Ptaza CVS, Inc. 1|Cranston-Reservoir CVS, inc. {Walnut Street CVS, inc. tlcvs Pharmacy, Inc. Page 27 VOLUME 147 Decision and Order CVS CAREMARK CORPORATION 879 Decision and Order Privileged and Highly Confidential White Bear Lake CVS, LLC. CVSP Inc.

ite Cross Stores, Inc. No. 14 56|Reveo Discount Drug Centers, Inc. |White Lake CVS, Inc. 1|CVS Pharmacy, Inc. |Whitp S, Inc. AjCVS P Inc.

|Witiamsburg CVS,inc. | SACS Pharmacy,inc. | Willimantic Main Street CVS, Inc. 88 Inc. Wilmer Roed CVS, LLC. CVS IND Inc.

Wilmore Washington CVS, L.L.C. 1|CVS IN Distribution, inc. ison Boulevard CVS, Inc. 1|CVS of DC and VA, Inc. Wilton CT CVS, Inc. icvs P cy, line.

Page 29 CVS-0004338 VOLUME 147 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission has accepted, subject to final approval, a consent agreement from CVS Caremark Corporation (“CVS”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. The Commission’s proposed complaint alleges that CVS is in the business of selling prescription and non-prescription medicines and supplies, as well as other products. It operates, among other things, approximately 6,300 retail pharmacy stores in the United States (collectively, “CVS pharmacies”) and online and mail order pharmacy businesses. The company allows consumers buying products in CVS pharmacies to pay for their purchases with credit, debit and electronic benefit transfer cards; insurance cards; personal checks; or cash.

The complaint alleges that in conducting its business, CVS routinely obtains information from or about its customers, including, but not limited to, name; telephone number; address; date of birth; bank account number; payment card account number and expiration date; driver’s license number or other governmentissued identification; prescription information, such as medication and dosage, prescribing physician name, address, and telephone number, health insurer name, and insurance account number and policy number; and Social Security number. The company also collects and maintains employment information from its employees, which includes, among other things, Social Security numbers.

CVS CAREMARK CORPORATION 881 Analysis to Aid Public Comment The complaint further alleges that CVS engaged in a number of practices that, taken together, failed to provide reasonable and appropriate security for sensitive information from consumers and employees. In particular, CVS failed to: (1) implement policies and procedures to dispose securely of such information, including, but not limited to, policies and procedures to render the information unreadable in the course of disposal; (2) adequately train employees to dispose securely of such information; (3) use reasonable measures to assess compliance with its established policies and procedures for the disposal of such information; or (4) employ a reasonable process for discovering and remedying risks to such information.

The complaint alleges that as a result of these failures, CVS pharmacies discarded materials containing sensitive information in clear readable text (such as prescriptions, prescription bottles, pharmacy labels, computer printouts, prescription purchase refunds, credit card receipts, and employee records) in unsecured, publicly-accessible trash dumpsters on numerous occasions. For example, in July 2006 and continuing into 2007, television stations and other media outlets reported finding such information about customers and employees in unsecured dumpsters used by CVS pharmacies in at least 15 cities throughout the United States. When discarded in publicly-accessible dumpsters, such information can be obtained by individuals for purposes of identity theft or the theft of prescription medicines.

The proposed order applies to sensitive information about consumers and employees obtained by CVS. It contains provisions designed to prevent CVS from engaging in the future in practices similar to those alleged in the complaint. Part I of the proposed order prohibits misrepresentations about the security, confidentiality, and integrity of sensitive information. Part II of the order requires CVS to establish and maintain a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of such information (whether in paper or electronic format) about VOLUME 147 Analysis to Aid Public Comment consumers, employees, and those seeking to become employees. The order covers health and other sensitive information obtained by all CVS entities, including, but not limited to, retail pharmacies and the pharmacy benefit management business. The security program must contain administrative, technical, and physical safeguards appropriate to CVS’s size and complexity, the nature and scope of its activities, and the sensitivity of the information collected from or about consumers and employees. Specifically, the order requires CVS to:

• Designate an employee or employees to coordinate and be accountable for the information security program. • Identify material internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks.

• Design and implement reasonable safeguards to control the risks identified through risk assessment, and regularly test or monitor the effectiveness of the safeguards’ key controls, systems, and procedures.

• Develop and use reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from CVS, and require service providers by contract to implement and maintain appropriate safeguards.

• Evaluate and adjust its information security programs in light of the results of testing and monitoring, any material changes to operations or business arrangements, or any other circumstances that it knows or has reason to know may have material impact on its information security program.

CVS CAREMARK CORPORATION 883 Analysis to Aid Public Comment Part III of the proposed order requires CVS to obtain within one year, and on a biennial basis thereafter for a period of twenty (20) years, an assessment and report from a qualified, objective, independent third-party professional, certifying, among other things, that: (1) it has in place a security program that provides protections that meet or exceed the protections required by Part II of the proposed order; and (2) its security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of sensitive consumer and employee information has been protected. Parts IV through VIII of the proposed order are reporting and compliance provisions. Part IV requires CVS to retain documents relating to its compliance with the order. For most records, the order requires that the documents be retained for a five-year period. For the third-party assessments and supporting documents, CVS must retain the documents for a period of three years after the date that each assessment is prepared. Part V requires dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part VI ensures notification to the FTC of changes in corporate status. Part VII mandates that CVS submit a compliance report to the FTC within 90 days, and periodically thereafter as requested. Part VIII is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

The Commission conducted its investigation jointly with the Office for Civil Rights in the Department of Health and Human Services (“OCR-HHS”). Working together, the Commission and OCR-HHS each entered into separate but coordinated agreements with CVS to resolve all the issues of both agencies. This is the Commission’s twenty-fourth case to challenge the failure by a company to implement reasonable information security practices, and the first case: (1) involving a health provider, (2) proceeding jointly with OCR-HHS, and (3) challenging the security of employee data.

VOLUME 147 Analysis to Aid Public Comment The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed order or to modify its terms in anyway.

INTERLOCUTORY, MODIFYING, VACATING, AND MISCELLANEOUS ORDERS ____________________________