CVS Health’s Health100 unit earns CARIN consumer data privacy and security accreditation

CVS Health said its Health100 unit has earned an industry accreditation focused on consumer data privacy and security. The announcement, posted July 29, 2026, said the Health100(TM) business, which operates as a CVS Health subsidiary, received the CARIN Code of Conduct for Consumer-Facing… accreditation.

While CVS did not provide detailed terms of the accreditation in the posted announcement, the company framed the certification as recognition of how Health100 handles consumer-facing information and the security controls around it. The statement also identified the location of the company newsroom update as Woonsocket, Rhode Island.

Health100 is presented in the release as a CVS Health subsidiary operating in the consumer-health data and services space. In that context, an accreditation centered on privacy and security indicates an effort by the pharmacy and health benefits company to align its consumer data practices with an externally assessed industry code.

CARIN, in general terms, is described in the announcement only through the accreditation label CVS referenced: the CARIN Code of Conduct for Consumer-Facing… The company did not disclose which specific requirements Health100 met beyond the privacy and security orientation of the code, nor did it specify the scope of covered data, geographies, or the audit process in the publicly available text.

Healthcare companies have increasingly faced scrutiny over how they collect, use, store, and share consumer health information, particularly when data moves across platforms used by patients, caregivers, and other parties. CVS’s decision to highlight a privacy-and-security accreditation suggests the company views independent or industry-linked benchmarks as an important part of its consumer trust strategy.

For CVS, the move also fits into a broader theme within managed care and pharmacy delivery, where large consumer-facing systems increasingly rely on technology for care navigation, digital engagement, and data-driven services. In those models, privacy and security controls are not only compliance matters, they also influence whether partners and consumers are willing to share information.

CVS did not provide a timeline for renewal, the accreditation’s duration, or whether additional Health100 services were added to the covered scope. The company also did not include any performance metrics, remediation steps, or findings from the accreditation process. As a result, the impact of the accreditation on Health100 operations, costs, or customer adoption cannot be determined from the announcement alone.

What to watch next is whether CVS Health updates investors or customers with additional specifics, such as the accreditation’s effective period, scope of covered products, and any operational changes made to meet the code. Any follow-on disclosures would help clarify how far the accreditation reaches across Health100’s consumer touchpoints and how it will be maintained over time.