In this case it's likely mostly paranoia - but level 3 card data I assume by now is every single major retailer in the US. This would include CVS and Walgreens

In this case it's likely mostly paranoia - but level 3 card data I assume by now is every single major retailer in the US. This would include CVS and Walgreens, as well as Target, Walmart, etc. In that case an insurer could trivially get this data simply by a common data subscription available on the market. Not sure if HIPPA would cover retail (OTC) sales at all, I'd guess not? In any case, I consider pretty much any credit card transaction I do with a major company as 100% public information down to the SKU and qty purchased. More likely here though is that this is a controlled substance treated like Pseudoephedrine is. There your ID must be scanned, and it is enrolled in a national database. This is a federal statute and I would be stunned if insurance didn't mine this information.