A drug-trafficking investigation involving a Utah physician has privacy implications that could affect access to prescription drug record databases across the country.
The Drug Enforcement Administration believes a Utah physician may have ties to an international drug cartel, and it wants access to the state's prescription drug monitoring program to continue its investigation. But Utah is one of a few states that requires law enforcement agents to obtain a warrant before they scour prescription drug records in the database, and the DEA is refusing to play ball.
Instead of securing a warrant, the federal agency has sued the state's Department of Commerce and Division of Occupational and Professional Licensing to gain access to the database with an administrative subpoena, maintaining its federal authority trumps the state law.
The Utah federal judge over the case is only the second federal judge to weigh individuals' right to keep their prescription drug records private alongside law enforcement's need to access the information to curb fraud, abuse and crime. In March 2014, a federal judge in Oregon ruled that the DEA couldn't access Oregon's prescription drug monitoring program, or PDMP, without a warrant, as required by the state. The Oregon case is currently pending appeal.
Utah's PDMP had over 47 million records for controlled substances prescriptions by September 2012, according to the American Civil Liberties Union. The ACLU has requested to intervene in the case and claims the DEA's request could lead to real privacy concerns for anyone whose information is in the database.
The ACLU contends that by learning the drug name and dosage for an individual, law enforcement could determine that someone is being treated for a mental health condition, AIDS or is undergoing gender transformation with hormone replacement therapy.
“These are deeply private and sensitive facts that can be embarrassing or stigmatizing if revealed to other people without consent,” the ACLU said in its motion to intervene.
Utah paramedics and firefighters have already dealt with privacy breaches stemming from PDMP access, which led the state Legislature to place greater protections on the information in 2015.
“I think the DEA's position is what it is because they don't want to have to go through the effort of creating an evidentiary basis" to access the database, said Rebecca Skordas of Skordas Caston & Hyde, an attorney who represented one of the paramedics whose privacy was breached by PDMP access.
In the case Skordas worked on, a few employees of Unified Fire Authority in Salt Lake County were charged with prescription drug fraud after a law enforcement officer scoured their prescription drug records on the state PDMP during an investigation into stolen morphine from a fire department vehicle.
Skordas' client hadn't even worked at the stations under investigation, but law enforcement scoured prescription records of all 480 employees of the fire authority and charged a handful for suspected doctor shopping for opiates. Skordas and the ACLU argued that her client's charge was the result of an unlawful search and the database information should be suppressed. Although a Utah judge rejected their request and they appealed that decision, the charges were dropped before an appellate decision on the evidence motion was issued.
According to Skordas, obtaining a warrant shouldn't create a lot of extra work for DEA agents, and it may be necessary to prevent privacy breaches for Utah residents. However, the federal agency seems to be posturing after it lost the Oregon federal case, she said.
“They've made the decision that if they agree in one state, that they have to have a warrant in every state. Their position is going to be you're going to have to make us,” Skordas said. The DEA did not respond to requests for comment.
Some groups have called on states to harness PDMPs in the fight against opioid addiction by creating warnings that flag heavy opioid users or better synthesize the information with electronic health records. Although an early version of Congress' Comprehensive Addiction and Recovery Act included federal grant incentives for state PDMPs with flagging capabilities, the passed version did not include the provision, likely slowing the technology's adoption.
Although most states only require law enforcement to have an active investigation in order to access PDMP records, personal privacy concerns have been cited in state lawsuits over these databases, and Missouri has refused to create a PDMP in part because of the issue, according to Heather Gray, a senior legislative attorney at the National Alliance for Model State Drug Laws.
But protecting PDMP databases may have little effect on privacy, since law enforcement in most states can obtain the same prescription information from pharmacies without a warrant.
“It's just a matter of where the information is held,” Gray said. “It's all technology at this point.”
However, technology can make a difference in how the courts weigh the balance of law enforcement needs and individuals' privacy rights. In 2012, the U.S. Supreme Court ruled that installing a GPS tracking device on a vehicle is an unlawful search under the Fourth Amendment, but police could physically tail a suspect without running afoul of the Constitution.
Similarly, Skordas says unfettered access to the database is different than law enforcement officials going to a physical pharmacy to obtain prescription records or sending an informant to obtain drugs from a physician suspected of overprescribing.
“It's not that hard to do,” Skordas said. “They've been doing it for years.”
