US Pharm. 2014;39(5):44-46.

Consider the following scenario: A physician issues a prescription for a Schedule III controlled substance, and the patient has it filled at a local pharmacy. Following state law, the pharmacy reports the filling of the medication to a state agency that monitors prescribing and dispensing   of controlled substances. Later, a police investigation of the patient and/or the prescriber ensues and the police wish to obtain the data gathered by the monitoring program as evidence of a drug abuse scheme. Is there any expectation of privacy in the data obtained by the state agency? Is this information considered confidential? Or may any police authority request and receive these data without a court-ordered subpoena or search warrant?

Prescription Drug Monitoring Programs

This is the situation and questions addressed in a recent case decided by a federal court.1 Oregon, like a majority of U.S. states, has a mandatory Prescription Drug Monitoring Program (PDMP) that requires pharmacies to electronically report the dispensing of controlled-substance prescriptions to a state agency that monitors this type of activity.2 Approximately 7 million prescription records are reported to the Oregon PDMP annually.1

The name and description of the drug and the quantity dispensed, plus identifying information about the patient and the practitioner who prescribed the drug, are all reported.3 According to the information provided by Oregon, “The primary purpose of the PDMP is to provide practitioners and pharmacists a tool to improve health care, by providing health care providers with a means to identify and address problems related to the side effects of drugs, risks associated with the combined effects of prescription drugs with alcohol or other prescribed drugs, and overdose.”1

Physicians or pharmacists may access patient records in the PDMP only if they “certify that the requested information is for the purpose of evaluating the need for or providing medical or pharmaceutical treatment for a patient to whom the practitioner or pharmacist anticipates providing, is providing or has provided care.”4 Otherwise, the information reported to the state pursuant to the PDMP is considered “protected health information.”5

Besides the physician or pharmacist provision for accessing these data, another exception exists under the enabling statutes. The PDMP may also disclose relevant information “pursuant to a valid court order based on probable cause and issued at the request of a federal, state, or local law enforcement agency engaged in an authorized drug-related investigation involving a person to whom the requested information pertains.”6 Importantly, the PDMP’s public website (www.orpdmp.com) repeatedly references the privacy protections afforded prescription information and informs visitors that law enforcement officials may not obtain information “without a valid court order based on probable cause for an authorized drug-related investigation of an individual.”7

Administrative Subpoenas

A dispute arose when the U.S. Drug Enforcement Administration (DEA) sought to obtain information from the Oregon PDMP pursuant to what are called administrative subpoenas. An administrative subpoena is one that is issued by a federal agency without prior judicial oversight. In other words, the agency issues the subpoena without getting a court order from a judge that would give enforcement power against the person who is served with the subpoena. There is no penalty for refusing to comply with an administrative subpoena unless the issuing agency seeks to have it enforced in a court of law.8

The Controlled Substances Act gives the DEA, through the U.S. Attorney General, broad authority to issue administrative subpoenas to investigate drug crimes. Accordingly, the DEA “may subpoena witnesses, compel the attendance and testimony of witnesses, and require the production of any records (including books, papers, documents, and other tangible things which constitute or contain evidence) which the Attorney General finds relevant or material to an investigation regarding controlled substances.”9

Court Orders

The DEA issued administrative subpoenas to the Oregon PDMP on several occasions. Oregon refused to produce any information requested by the subpoenas on the grounds that doing so would violate the Oregon law stating that the PDMP records are “protected health information” that cannot be disclosed without a valid court order. Specifically, on September 11, 2012, the DEA issued an administrative subpoena to the Oregon PDMP demanding the prescription records for an individual patient, and on September 17, 2012, the DEA issued another administrative subpoena to the Oregon PDMP demanding a summary of all prescription drugs prescribed by two physicians. The PDMP objected to each subpoena on the basis that disclosure of the requested information would violate state law. Oregon then filed a lawsuit in a federal district court asking for a determination on whether administrative subpoenas preempt the state law on privacy of this information.10

Fourth Amendment Rights

The American Civil Liberties Union (ACLU) intervened to add an additional argument claiming that release of the protected health information contained in the PDMP data pursuant to an administrative subpoena would violate the Fourth Amendment rights of individual’s privacy. It named four “John Does” and a physician, each a resident of Oregon with an asserted privacy interest in the Oregon PDMP.1,11

The Fourth Amendment to the Constitution provides protection against “unreasonable searches and seizures.” The District Court judge hearing this case, citing Supreme Court precedent, noted that searches conducted outside the judicial process, without prior approval by judge or magistrate (i.e., without a court order), are per se unreasonable under the Fourth Amendment.12 He also noted that while the Fourth Amendment does not protect against all searches or seizures, it does guard against searches and seizures of items or places in
which a person has a reasonable expectation of privacy.

The court observed that each of the patient and physician intervenors has a subjective expectation of privacy in their prescription records and that this subjective belief reasonably extends to any person whose records would be subject to the Oregon PDMP. For example, each of the John Doe patients has a medical condition treated by a Schedule II-IV drug and considers that information private. The fifth intervenor is a medical doctor who prescribes controlled-substances medications. The court observed that he also has a subjective expectation of privacy in his prescribing information.1

The judge wrote, “By reviewing doctors’ prescribing information, the DEA inserts itself into a decision that should ordinarily be left to the doctor and his or her patient. Because each of the individual intervenors has a subjective expectation of privacy, the question becomes whether intervenors’ subjective expectations of privacy are expectations that society is prepared to recognize as reasonable.”1

Addressing that question, the judge went on to explain: “Medical records, of which prescription records form a not insignificant part, have long been treated with confidentiality. The Hippocratic Oath has contained provisions requiring physicians to maintain patient confidentiality since the fourth century BCE. The ACLU cites compelling evidence demonstrating that a number of signers of the Declaration of Independence and delegates to the Constitutional Convention were physicians trained at the University of Edinburgh, which required its graduates to sign an oath swearing to preserve patient confidentiality. It is not surprising that privacy protections for medical records have not only been placed in Oregon law, but are also enshrined in certain aspects of federal law.”1,13

The judge continued, “In this matter, the court easily concludes that intervenors’ subjective expectation of privacy in their prescription information is objectively reasonable. Although there is not an absolute right to privacy in prescription information, as patients must expect that physicians, pharmacists, and other medical personnel can and must access their records, it is more than reasonable for patients to believe that law enforcement agencies will not have unfettered access to their records. The prescription information maintained by PDMP is intensely private as it connects a person’s identifying information with the prescription drugs they use.”1

The DEA argued that medical records and prescription records are distinguishable and that prescription records do not have the same expectation of privacy as medical records. The court found the distinction “nearly meaningless.” The judge wrote, “It is difficult to conceive of information that is more private or more deserving of Fourth Amendment protection. That this expectation of privacy in prescription information is protected in ORS 431.966 and advertised on PDMP’s public website, makes that expectation all the more reasonable.”1

Accordingly, the court held that the DEA’s use of administrative subpoenas to obtain information from the Oregon PDMP is not sufficient to overcome the Fourth Amendment’s protection of privacy rights.

Discussion

This case demonstrates that patients indeed have expectations of privacy rights with regard to prescription drug information, especially as that information is reported to and recorded by state agencies acting under a PDMP. Be that as it may, there is scant discussion in the court’s opinion of the significance of the difference between an administrative subpoena and a court order. The DEA can issue an administrative subpoena anytime it is investigating a suspected violation of the Controlled Substances Act. The standard for issuing one of these demands for testimony of the production of documents is very low. Suspicion that the named person on the subpoena is involved in a criminal act is all that is necessary.

The standard for obtaining a court order is much higher. The proponent of the order must show that there is reasonable or probable cause to issue an order seeking the search or seizure of information or testimony. Thus, an independent and objective judge or magistrate must determine that there is a reasonable basis to believe a crime is being committed or at least that the target of the court order has information relevant to the commission of a crime.

In reality, it is relatively easy to obtain a court order. Administrative agencies object to having to do so because it is just one more hoop to jump through on the way to obtaining the desired information. Besides, in the process of getting the court order, the opponent may gain some information as to what evidence was presented to get the court order and thus form a basis on which to object to it before an enforcement hearing is held. Obviously, this can level the playing field between the party seeking a court order and the party against whom it is being sought.

Conclusion

The take-away point for the pharmacy profession is that subpoenas are not court orders and patients do have an expectation of privacy in their prescription drug records. Unauthorized disclosure of protected information could subject the pharmacy or pharmacist to liability. Remember that prescription records could easily be held private or confidential in a court of law and should not be released pursuant to a subpoena alone. Subpoenas should never be ignored. If served with one, competent legal advice should be sought before releasing any information. In most cases, a court order should be obtained before prescription data are disclosed. This order will protect pharmacies and pharmacists from any claims that private information was released without sufficient legal authority.

REFERENCES

1. Oregon Prescription Drug Monitoring Program v. U.S. Drug Enforcement Administration, No. 3:12-cv-02023-HA, D Or. 2014 U.S. Dist. LEXIS 17047, February 11, 2014. http://scholar.google.com/scholar_case?case=12265693754911493679&hl=en&as_sdt=6,33. Accessed March 15, 2014.
2. State Prescription Drug Monitoring Programs. DEA Office of Diversion Control. October 2011.www.deadiversion.usdoj.gov/faq/rx_monitor.htm. Accessed March 15, 2014. “According to the National Alliance for Model State Drug Laws (NAMSDL), a PDMP is a statewide electronic database which collects designated data on substances dispensed in the state. The PDMP is housed by a specified statewide regulatory, administrative, or law enforcement agency. The housing agency distributes data from the database to individuals who are authorized under state law to receive the information for purposes of their profession.”
3. ORS § 431.964.
4. ORS § 431.966(2)(a)(A).
5. ORS § 431.966.
6. ORS § 431.966(2)(a)(C).
7. Oregon Prescription Drug Monitoring Program. Frequently asked questions. www.orpdmp.com/faq.html. Accessed March 15, 2014.
8. See, e.g., 21 USC § 876(c).
9. 21 USC § 876(a).
10. ORS § 431.966.
11. “John Doe 1 is a retired CEO and currently takes two Schedule II drugs to treat extreme pain caused by recurring kidney stones. John Doe 2, an attorney, and John Doe 4, a medical student, have both been diagnosed with gender identity disorder and utilize prescription testosterone, a Schedule III drug, for hormone replacement therapy. John Doe 3 is a small business owner and takes alprazolam, a Schedule IV drug, to treat anxiety and post-traumatic stress disorders as well as Vicodin, a Schedule III drug, as a pain reliever. Each of the John Does considers his health information to be private and is distressed that the DEA might obtain his prescription information, and by extension information about his medical conditions, without a warrant.” The physician intervenor is James Roe, MD, “an internist who primarily treats geriatric and hospice patients and as a consequence, prescribes more Schedule II-IV drugs than a typical physician. He has been interviewed and investigated by the DEA in the past, and is concerned that his patients’ prescription records have been accessed or may be accessed without a warrant. He asserts that pressure from the DEA has resulted in changes to his prescribing practices.”
12. Katz v. United States, 389 US 347, 357 (1967). http://scholar.google.com/scholar_case?case=9210492700696416594&q. Accessed March 15, 2014.
13. See, e.g., Health Insurance Portability and Accountability Act, Privacy Rule, 45 CFR § 164.512 (providing protections for “protected health information”).

To comment on this article, contact rdavidson@uspharmacist.com.