Man in Queens receiving private patient information from CVS

QUEENS, N.Y. (WABC) -- An Eyewitness News exclusive as private patient information, intended for a doctor, mistakenly faxed by a nationwide pharmacy chain to a man in Queens.

It's a breach that raises questions about the safety of your information when you get prescriptions filled.

This breach involves CVS which has thousands of pharmacies around the country. We were contacted by a food distributor from Queens who suddenly started getting faxes on his email from various CVS pharmacies in California.

There was a lot of private information on those faxes. And what's worse, he says those faxes kept coming, even after he flagged the company.

"As you can see here, there's an inbound fax from an 800 number ... that's actually CVS' fax number," said Mike Pupo.

Pupo said the faxes started coming to his office computer in Queens in late April. "I had a FAX from CVS pharmacy for a request for a controlled substance," adds Pupo.

He has an internet service that sends all faxes to his Microsoft outlook.

"This has the prescription's information, this has the patient's information, and it has their date of birth, it has their phone number, it has their personal home address; it also has the doctor's information as well as the doctor's DEA number."

The prescriptions were all from the same doctor, but from different CVS pharmacies in Northern California.

"I believe I have 15-16 prescriptions altogether...It's a huge violation of privacy. I have a lot of information that I shouldn't have," he says.

SARAH: "It could be a bigger issue than just you getting this."

Pupo: "Absolutely. If this was given to the wrong hands, God forbid, they could really have a field day with all of this information."

In a statement, CVS responded, saying it has worked to correct the problem. "CVS/pharmacy's commitment to protect the privacy of our patients' health information is central to our role as a health care provider. We apologize for the faxes that were inadvertently sent to an incorrect number. Upon learning of this matter on May 23, we immediately took steps to prevent it from occurring again. We have apologized to Mr. Pupo and thanked him for bringing this matter to our attention," the statement said.

Pupo believes it happened because the doctors fax number is similar to his but wonders why CVS doesn't have better safeguards on faxing prescription information.

"You kind of wonder, if it's happening to you. If it's happening to other people. Oh absolutely, that's a huge concern of mine. When I go to my doctor and he fills out a prescription, I don't want it to go to some random person."

He says he called the CVS pharmacies individually and the headquarters in Rhode Island.

Sarah Wallace was able to reach one of the patients by phone in California who's personal information was faxed to Pupo.

SARAH: "And you had not heard about this until we contacted you?"

VICTIM: "That's correct."

SARAH: "How much of a shock was it when you got the phone call."

VICTIM: "It was a bit of a shock. They should have done something. They should have called me to tell me they were screwing up."

Pupo fully blames CVS. "I look at it as a really huge mistake on CVS' pharmacy's part...If I was a criminal and identity theft professional, I would probably be making a lot of money right now."