The nation's largest pharmacy chains have handed over Americans' prescription records to police and government investigators without a warrant, a congressional investigation found, raising concerns about threats to medical privacy. Though some of the chains require their lawyers to review law enforcement requests, three of the largest CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide " said they allow pharmacy staff members to hand over customers' medical records in the store. Pharmacies' records hold some of the most intimate details of their customers' personal lives, including years-old medical conditions and the prescriptions they take for mental health and birth control. Because the chains often share records across all locations, a pharmacy in one state can access a person's medical history from states with more-restrictive laws. The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among "covered entities" such as hospitals and doctor's offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement. In briefings, officials with eight American pharmacy giants " Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy " told congressional investigators that they required only a subpoena, not a warrant, to share the records.