Insurance knows about prescriptions not filled through them?

Several weeks ago, I got started on two prescriptions for the prevention of certain STIs through a local city-run clinic, dispensed by Walgreens. I provided Walgreens with a member ID, BIN, PCN, and group number for a program run by my state government's department of public health (provided to me via the city clinic). I intentionally did not provide them my "main" insurance info for privacy reasons, since get it from one of my parents' employers and I did not want to risk my parents seeing that I'm taking these medications, or know that I may be sexually active.

Recently, for the first time, I got a letter from the health insurance company saying, "It's time to review your personalized monthly medication report", listing out the two medications and encouraging me to find an in-network pharmacy. Specifically, it identifies itself as "a list of the prescription medications that you've recently filled (or tried to fill) and has information that can help you make the best choices about your medication(s) and/or pharmacy." One medication was only identified by its last 4 digits, the other was named in full.

As a side note, I'm currently unable to check the insurance company's website for a list of my prescriptions because of some technical error but I'm hoping it'll work tomorrow.

A few questions:

How did my health insurance learn of my prescriptions even though I didn't involve them at any point? Is there some sort of central database? Isn't this potentially a HIPAA issue? Is there anything I could have done to prevent this? submitted by /u/WillyNillyHocusPocus
[comments]

See also  Minimum Participation Rate Requirements for Group Health Insurance