--- title: "How to Protect Your Email When Signing Up for a Pharmacy" date: "2026-11-09" author: "Ahsan Luqman" canonical_url: "https://aliasfleet.com/blog/how-to-protect-your-email-when-signing-up-for-an-online-pharmacy" tags: ["Email Privacy", "Pharmacy", "Health Data"] description: "A pharmacy account links an email address to prescriptions and insurance. One alias per pharmacy keeps that mail contained and names the source of any leak." --- # How to Protect Your Email When Signing Up for a Pharmacy A pharmacy account links an email address to prescriptions and insurance. One alias per pharmacy keeps that mail contained and names the source of any leak. An online pharmacy account links an email address to prescription records, refill history and insurance details. The address given at signup receives order updates, refill reminders and marketing mail, and the privacy policy decides if it is shared with advertising networks or third parties. Protection rests on three measures: verification that the pharmacy is licensed and legitimate, a dedicated email alias for each pharmacy, and keeping that alias active for as long as prescriptions are live. ## What a pharmacy account holds A pharmacy account holds the customer's name, address, date of birth and payment details, and the prescription record: which medicines were ordered, in what dose, on what date, and which doctor prescribed them. The account also holds insurance details, because the pharmacy bills the insurer before sending the medicine. The email address given at signup is the address used for order confirmation, delivery updates, refill reminders and password resets, so it sits at the centre of that record. ## Verification of a legitimate online pharmacy Email protection starts before signup, with a check that the pharmacy is legitimate. The [FDA guidance on buying medicines safely](https://www.fda.gov/consumers/consumer-updates/how-buy-medicines-safely-online-pharmacy) lists the signs of a safe online pharmacy: it always requires a doctor's prescription, provides a physical address and telephone number in the United States, has a licensed pharmacist on staff to answer questions, and is licensed with a state board of pharmacy. The FDA states that the pharmacy's licence can be checked in the state board of pharmacy licence database through the BeSafeRx website, and that an online pharmacy not listed there should not be used. The same guidance warns that unsafe online pharmacies may not provide clear written protections of personal and financial information, and may sell that information to other websites. The National Association of Boards of Pharmacy runs a second check through the [NABP Safe Pharmacy site](https://safe.pharmacy/), which offers a Safe Site Search Tool that checks whether a website is verified or listed as not recommended. NABP has found more than 40,000 websites that fail to comply with its patient safety and pharmacy practice standards or with applicable laws. A [Drug Topics article on the NABP initiative](https://www.drugtopics.com/view/protecting-patients-online-and-at-home-how-nabps-safe-pharmacy-initiative-helps-patients-safely-buy-prescriptions-online) states that 95% of the illegal online pharmacies reviewed did not require a valid prescription for prescription-only medicine. ## How an email address moves beyond the pharmacy Whether a pharmacy shares the email address given at signup with other companies depends on the privacy policy that applies to the account, and the policies differ between pharmacies and between the retail side and the health care side of the same company. CVS states the position in its California notice. The notice, last updated on 30 July 2026, says CVS sells or shares identifiers, including name, postal and email address and phone number, for marketing and advertising purposes to third-party advertising networks and social media platforms. Commercial information, such as items purchased or considered, and internet activity are also sold or shared. The [CVS California notice](https://www.cvs.com/retail/help/ca_notice_collection) sets out the categories in a table and offers an opt-out from the sale or sharing of personal information. The [CVS store privacy policy](https://www.cvs.com/help/privacy_policy.jsp) and the [CVS Health privacy policy](https://www.cvshealth.com/privacy-policy.html) state the same terms in longer form. Walgreens states a different position. Its [privacy policy](https://www.walgreens.com/topic/help/generalhelp/privacyandsecurity.jsp?foot=security), last updated on 1 January 2026, states that Walgreens may use third-party advertising networks to serve advertisements, and that the cookies received with those advertisements may be used to collect and build behavioural profiles for targeted advertising. The same policy states that information submitted for a prescription order is subject to HIPAA rather than to the consumer privacy policy. ## The GoodRx enforcement action The Federal Trade Commission's enforcement action against GoodRx documents pharmacy related email sharing. GoodRx is a telehealth and prescription drug discount provider, not a pharmacy, and its users look up drug prices and use coupons to buy medication. The [FTC enforcement action](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising), announced on 1 February 2023, states that GoodRx shared sensitive personal health information, including users' prescription medications and health conditions, with Facebook, Google, Criteo, Branch and Twilio since at least 2017, contrary to its privacy promises. In August 2019, GoodRx uploaded the email addresses, phone numbers and mobile advertising IDs of users who had purchased particular medications, such as those for heart disease and blood pressure, to Facebook to target them with health related advertisements. The order imposed a $1.5 million civil penalty and a permanent ban on sharing user health data for advertising. The [Legal 500 analysis of the settlement](https://www.legal500.com/intelligence/united-states/technology/federal-trade-commission's-goodrx-settlement-not-just-a-%2415-million-penalty) notes that the order also requires GoodRx to obtain affirmative express consent before sharing health information with third parties for other purposes and to direct third parties to delete the data that was shared. A [HIPAA Journal report](https://www.hipaajournal.com/goodrx-25-million-settlement-tracking-technology-lawsuit/) published on 29 October 2026 states that a revised $32 million settlement has received preliminary court approval to resolve class action litigation against GoodRx and Criteo over website tracking tools that disclosed user information to third parties without consent between 2017 and 2020. Class members must object or opt out by 29 December 2026, and the final fairness hearing is scheduled for 11 February 2027. The settlement is preliminary approval only. ## Pharmacy breaches in 2025 and 2026 Pharmacy data also leaves through breaches, and the breaches of 2025 and 2026 show the pharmacy website is often the point of failure. [Ridgeway Pharmacy](https://www.hipaajournal.com/ridgeway-pharmacy-data-breach/), a mail-order and community pharmacy in Victor, Montana, found on 21 August 2026 that personal information had been exposed through its third-party designed website. The exposure affected 258,920 customers, and the data potentially compromised included prescription information, health information and insurance information, with payment card information for a subset. An employee at Freedom Fertility Pharmacy, operated by Lynnfield Drug, Inc., mistakenly emailed customer names, email addresses and diagnosis or condition information to an unauthorised recipient in September 2026. The [Freedom Fertility breach report](https://databreachrights.com/freedom-fertility-pharmacy-data-breach/) states that the notification filed with Massachusetts regulators in October 2026 reports 15 Massachusetts residents affected, with no nationwide total disclosed. The incident was an employee error, not a hack, and shows an address can be exposed by a mistyped address as well as by an intrusion. McKesson, a drug distributor, confirmed an August 2026 cyberattack and stated in a 21 September update that confirmed data theft was limited to certain third-party applications serving a subset of its Oncology and Multispecialty customers. The [McKesson update](https://www.medicaldaily.com/mckesson-data-breach-oncology-multispecialty-patient-notifications-478987) states that the data likely taken included names, email addresses, patient IDs and dates of birth. The extortion group ShinyHunters claimed about 284 million rows of raw patient data, and [Have I Been Pwned](https://haveibeenpwned.com/) counted 6.4 million unique email addresses in data the group published. McKesson has confirmed neither figure. [Boudreaux's Specialty Compounding Pharmacy](https://www.claimdepot.com/data-breach/boudreauxs-specialty-compounding-pharmacy), a locally owned pharmacy in Shreveport, Louisiana, experienced a network disruption on or around 25 January 2025. The breach was disclosed to the US Department of Health and Human Services on 10 April 2025 and affected 6,270 people. The exposed data included prescription information, health insurance information, email addresses and Social Security numbers. ## A separate alias for each pharmacy The email address given at signup decides how much of the customer's mail the pharmacy can connect to one identity. A single address used for every pharmacy, every shop and every service means a leak or a sale at any one of them exposes the same address everywhere else. A dedicated alias for each pharmacy breaks that connection. The alias forwards to the customer's real inbox, so refill reminders and order updates arrive as normal while marketing mail from that pharmacy stays separate. If spam arrives on the pharmacy alias from a company the customer never dealt with, the alias names the source: the address was shared or leaked by that pharmacy. The alias has to stay alive while prescriptions are active, and must never be allowed to expire or be closed while refills, recall notices or insurance messages may still arrive. Refill reminders, recall notices, delivery updates and insurance messages may still arrive on it months after signup, and a missed refill reminder or a missed recall notice is a health problem, not only an inbox problem. The alias therefore stays in place until the prescriptions end and the account is closed properly. A pharmacy alias must never be allowed to expire or be closed while refills, recall notices or insurance messages may still arrive. An alias protects the email address, not the prescription record: if the pharmacy's own systems are breached, the prescription information, insurance details and health information in those systems are exposed whatever address was used at signup. The alias limits the damage to the inbox: it stops the exposed address from being the same address used for banking, work and every other service, and it identifies which pharmacy the address came from. An alias also does not make an unlicensed pharmacy safe: a rogue online pharmacy that sells counterfeit medicine is a safety problem first, and the FDA verification checks come before any decision about which email address to use. Patients also hold rights under HIPAA. The [HHS guidance on rights under HIPAA](https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html) states that pharmacies are covered entities, and that patients have the right to ask for restrictions on how health information is used or disclosed and to decide on permission before it is used or shared for certain purposes such as marketing. The email address used for a retail account may fall under a separate consumer privacy policy, so the HIPAA rights and the policy opt-out have to be used together. ## AliasFleet for pharmacy accounts [AliasFleet](https://aliasfleet.com/) provides email aliases that forward to a verified destination inbox. Each alias is a separate address that can be paused or closed on its own without affecting the others. A dedicated alias can be created for each pharmacy, so refill and marketing mail from that pharmacy arrives on its own address and the customer's real email address is not given to the pharmacy. The free tier includes 10 active aliases, 1 verified destination inbox, 3 managed subdomains and 100 MB of monthly forwarding bandwidth, as listed on the [AliasFleet pricing page](https://aliasfleet.com/pricing). AliasFleet does not hold prescription records and does not verify pharmacies, and the alias still has to stay active while prescriptions are live.