Last week, Walmart made headlines with a claim that new weight loss drugs might be making people buy less food. Walmart US CEO John Furner told Bloomberg that people taking Wegovy, Ozempic, and similar drugs showed a “slight change” in their purchasing habits: “just less units, slightly less calories.” How does Walmart know this? Because, Bloomberg indicates, it can compare people’s prescription history against their food shopping patterns. It’s the kind of data mining that’s likely possible for any big retail-and-pharmacy operation — and one that raises questions about how private health records should be.

We don’t know the details of Walmart’s research. The company didn’t respond to a request for more information from The Verge, and Bloomberg offers a brief two-sentence recap:

The Bentonville, Arkansas-based retailer is studying changes in sales patterns using anonymized data on shopper populations. It can look at the purchasing changes among people taking the drug and can also compare those habits to similar people who aren’t taking the shots.

Walmart is strategically well-positioned to do this. It operates both a pharmacy program and a network of around 5,200 stores across the US, including about 3,500 one-stop-shopping supercenters, so it’s got a lot of people filling prescriptions the same place they buy food. Many shoppers likely wouldn’t be surprised to learn that Walmart is tracking general retail purchases to forecast future customer demand, and Bloomberg suggests Walmart and others could use this data to prepare for a future where people buy less food.

But someone’s prescriptions are more legally and ethically sensitive than their average grocery run. Pharmacy records can bluntly reveal health conditions many people would rather keep private — not just whether they’re trying to lose weight, but whether they’ve obtained abortion pills or are dealing with stigmatized mental health conditions. And while the US leaves huge gaps in consumer privacy protections, pharmacy records are protected by the Health Insurance Portability and Accountability Act (HIPAA), which limits how they can be disclosed without patient consent. That raises a question Bloomberg doesn’t mention: should companies like Walmart be able to funnel them into other parts of their business operations? And if so, what should the limits be?

“The buying and selling of prescription data is a complex issue balancing patient privacy, commercial interests, and regulatory oversight,” says Tara Sklar, faculty director of the Health Law & Policy Program at the University of Arizona’s law school. At a federal level, Sklar says, HIPAA restricts how companies can release health data that’s tied to an individual.

The catch here, however, is “individual.” Companies — including major chains like CVS and Rite Aid — have faced fines for doing things like throwing out pill bottles with visible patient names and prescriptions. But per Bloomberg, Walmart promises its data is anonymized, or stripped of identifying details that could be tied back to specific patients.

Unfortunately, the idea that huge, complex datasets can be meaningfully “anonymous” is largely a polite fiction. (Absent more detail from Walmart, it’s also not clear what kind of patient consent might have been given for the Ozempic research.) “Even anonymized prescription details can reveal a lot about individuals,” says Sklar. “Details like medication, dosage, timing, prescriber, pharmacy, etc. can be very unique to an individual, which makes it easier to re-identify someone.” The more widely this information is released, the greater the odds that it could be used in ways it’s not intended, and that people could see private details of their lives exposed.

Walmart is far from the only company that’s in a position to do this kind of analysis. Amazon, for instance, launched its own pharmacy service in late 2020 as part of a larger push into health care and has moved steadily into grocery sales. Its access to medical data has raised concerns among privacy advocates. Privacy isn’t the only issue on the table either: a recent antitrust lawsuit accuses Amazon of leveraging its data trove to cement a retail monopoly. We don’t know if Amazon is using health records for the kind of research Walmart described — the company didn’t respond to questions from The Verge about the matter. But pharmacy records could add yet another powerful source of data to its operation.

Sklar notes that HIPAA isn’t the only rule in play around medical records. The Federal Trade Commission also publishes a set of guidelines dubbed the Fair Information Practice Principles (FIPPs) that emphasize making sure a company’s use of health data is consistent with patients’ expectations. And recently, the FTC has cracked down on some allegedly flagrant breaches of trust — like the case of GoodRx, which allegedly let Google, Facebook, and other web companies target ads using personal health information. GoodRx agreed to an unusually harsh ban on sharing health details with third parties as part of a settlement. “Patients do not expect pharmacies to share or sell records of their medication, anonymized or not,” says Sklar.

But in an economy filled with highly consolidated companies that prize unfettered access to data, it’s unclear when customers can expect that their pharmacy records will be used for purposes besides their own health care — and what options they have if they don’t want that data spread around.

And on top of all that, this research doesn’t really tell us if Ozempic is making people buy less food. GLP-1 drugs like Ozempic and Wegovy, which are formally approved for diabetes but widely used for weight loss, do appear to have skyrocketed in popularity. But Walmart’s Furner told Bloomberg it’s “too early to draw any definitive conclusions” on their impact for the company — and when publicly available details on the research are so skimpy, that goes doubly true for anyone outside it.