Rhode Island-based CVS Caremark, which operates the nation's largest retail pharmacy chain, was accused of failing to protect its customers from identity theft at a store in Liberty, about 45 miles northeast of Houston.
Records allegedly dumped by employees behind the store included credit and debit card numbers and prescription forms that contained customers' names, addresses, dates of birth and types of medications, Abbott has said.
CVS's revamped information security program must have administrative, technical and physical safeguards designed to protect the personal information of customers. It also must create a training program to inform new hires of its enhanced security procedures and conduct unannounced compliance checks at some stores, among other measures.
The $315,000 will be used by the state to investigate and prosecute other identity theft cases, Abbott said. He noted the state's investigation revealed no confirmed cases of personal information being misused.
In a statement, CVS said it was pleased to reach the settlement agreement.
"Nothing is more central to our health care operations than maintaining the privacy of health information," the statement said. "We have firm policies in place at all 6,200 of our stores designed to protect patient privacy in our pharmacies, including procedures to ensure that all waste material containing personal identifying information is securely disposed."
The company said the files were dumped during the Liberty store's relocation to a new site. The files were contained to a "single, secured bag," it said.
"However, the improper disposal of this information was a violation of our record retention and privacy policies, and CVS took appropriate disciplinary action," the statement said. When the suit was filed last year, CVS said the store manager had been fired.
Earlier this month, CVS Caremark agreed to pay almost $37 million to nearly two dozen states and the federal government to settle claims it billed Medicaid programs for a more expensive formulation of an antacid.
The settlement in the case -- the first of its kind for a retail pharmacy company -- came after a lengthy investigation that began in 2001, when a suburban Chicago pharmacist alerted authorities.
On Monday, the company said it expects full-year revenue of more than $85 billion.
It shares rose 10 cents to close at $41.25 on Wednesday.
