As federal health regulators try to ensure HIPAA’s guarantees to access and security of protected health information, a federal court is mulling the limits of government access to PHI by the likes of the Drug Enforcement Administration.
The state of Oregon and now the American Civil Liberties Union are suing to stop the DEA from accessing the state’s Prescription Drug Monitoring Program database without judicial authorization — a practice that violates patient privacy and is unconstitutional and illegal under state law, Oregon and ACLU attorneys argue.
Created by the legislature in 2009 and launched in 2011, Oregon’s database program is aimed at curbing prescription drug abuse by requiring pharmacies to report certain patient and provider information when dispensing drugs federally classified as schedule II and IV substances, such as opiates prescribed for acute pain or stimulants for Attention Deficit Hyperactivity Disorder.
Oregon’s law grants police and other law enforcement access to the database for investigations, but only with a probable cause warrant from a judge. Oregon and ACLU attorneys argue that the DEA has been circumventing that civil liberty protection by requesting records using administrative subpoenas, without judicial authorization or probable cause.
The DEA counters that it can access prescription drug databases lawfully without a court-issued warrant because the database is maintained by a third party, and because administrative subpoenas alone are permitted under federal law as justification for accessing records under the Controlled Substances Act.
Oregon first brought the lawsuit against the DEA late last year in U.S. District Court in Portland, claiming the the federal agency, a division of the Justice Department, was circumventing state law by relying on administrative subpoenas, and the ACLU signed onto the suit as an intervenor in January, representing four Oregon patients and one physician with records in the database.
“Our clients object to the DEA’s warrantless access to the PDMP because their prescription records reveal deeply private information about their health and medical history,” wrote ACLU staff attorney Nathan Freed Wessler on the organization’s blog. Two of them are transgender men taking testosterone, one of the drugs that has to be reported in the database, and one suffering from anxiety and posttraumatic stress disorder takes medication also reported in the database.
Wessler and ACLU attorneys are also representing an internist (remaining anonymous like the other plaintiffs) primarily serving geriatric and hospice patients who said he’s been unfairly investigated by the FBI and DEA.
In a deposition, the doctor, who also practices in Washington State, said the FBI and DEA officials had arranged a meeting with him, and presented patient names, asking for their diagnosis, treatment and contact information.
When he refused to disclose the patient information, the doctor said the DEA agent on the phone “threatened
me by stating that he could get an administrative order that day to revoke my state medical licenses and my DEA controlled substance registration certificate.”
The doctor, listed in the lawsuit under the alias of Dr. James Roe, said he supports drug diversion programs, but that invasive surveillance has left some providers worried about being accused of errant prescribing — and the reputational, administrative and legal costs that could follow.
“I do not think it is an exaggeration to say that overzealous law enforcement investigations of physicians have created a climate of fear around prescribing narcotic painkillers in cases where they are, by any objective standard, medically necessary,” the doctor said in his deposition.
According to the court documents, the DEA has accessed at least one set of confidential prescription records from Oregon’s database under an administrative subpoena, and in the future plans to issue about two subpoenas each month to the database program, overseen by the Oregon Health Authority.
The DEA argues that prescription records in the database can be accessed with only the administrative subpoena because federal courts have generally ruled that law enforcement agencies do not need a warrant for certain kinds of business records, like a citizen’s electricity consumption records held by a power company or a room registration held by a hotel. According to that argument, the “third party doctrine,” citizens in effect waive their right to privacy of information that’s turned over to another party, like a hotel or utility.
How the court views the DEA’s and the ACLU's and Oregon’s arguments could affect prescription drug monitoring nationally, if the DEA’s warrantless subpoenas are deemed unconstitutional, or it could have a more muted impact, if the DEA’s practices are deemed to run afoul only of Oregon’s stipulations for a warrant.