Federal Court Rules Patients Have Reasonable Expectation to Privacy of Prescription Drug Information

A Federal District Court in Oregon has ruled that patients have a Fourth Amendment privacy right in their prescription drug information–even if such information is forwarded to and maintained by a state-run database.  Consequently, government agencies will be required to obtain a warrant to access patients’ prescription drug information in the state of Oregon.

In 2009, Oregon established the Prescription Drug Monitoring Program (“PDMP”). The state-run program was designed to provide practitioners and pharmacists with a tool to better improve health care and combat prescription drug abuse.  Under the program, pharmacies are required to submit to the PDMP the names, addresses, and other personal information of patients receiving prescription drugs classified in Schedules II-IV under the federal Controlled Substances Act.   Oregon law classified information uploaded into the PDMP as “protected health information” subject to disclosure only upon issuance of a court order based on probable cause.  Under the federal Controlled Substances Act, however, the Drug Enforcement Administration (“DEA”) is able to issue administrative subpoenas, which have less oversight than a warrant.  DEA has been using the administrative subpoena process to obtain  information in the PDMP rather than a warrant.  Oregon sued for declarative relief whether the more restrictive Oregon requirement applies and warrants are required, or whether the state’s warrant requirement is pre-empted by the Controlled Substance Act. The American Civil Liberties Union then intervened on behalf of four local patients, who were concerned about the DEA accessing their medical records without a warrant.  In response, DEA contended that there is no privacy interest in the prescription records, that the Supremacy Clause of the US Constitution preempts the state requirement.

The District Court noted that the Fourth Amendment protects people against searches or seizures of items or places where a person has a reasonable expectation of privacy, and prior decisions have held that the Fourth Amendment does not allow use of administrative subpoenas where the respondent maintains a reasonable expectations of privacy in the materials sought by the subpoena.

The Court held that while there is no absolute right to privacy in prescription information (as patients expect such information to be readily accessed by health care professionals), “it is more than reasonable for patients to believe that law enforcement agencies will not have unfettered access to their records.”  The Court recognized the sensitivity of prescription information, noting that the information reported to PDMP can reveal a great deal about a patient and the condition treated by the prescribed drug. For example, ” By obtaining the prescription records for individuals like John Does 2 and 4, a person would know that they have used testosterone in particular quantities and by
extension, that they have gender identity disorder and are treating it through hormone therapy. It is difficult to conceive of information that is more private or more deserving of Fourth Amendment protection.”

The Court also soundly rejected the DEA’s argument that the “third-party doctrine” undermines a patient’s expectation of privacy. The “third-party doctrine” is a theory that a person does not have a reasonable expectation of privacy in information held by a third party.  This referred to a case in which utility records were sought using administrative subpoenas for records from the utility company, and has also been used to access bank and telephone records.  Unlike electricity consumption and bank records, which are voluntarily conveyed to those businesses when the person uses their services, the prescription records submitted to the PDMP “are protected by a heightened privacy interest” and are also not voluntarily conveyed – the prescription information is required by law to be submitted to the PDMP.  The only way to avoid sharing information with the PDMP is to forgo medical treatment or move to a different state. Therefore, the Court ruled that the DEA could not access prescription information pursuant to administrative subpoenas, but would be required to obtain a warrant.

While binding only in Oregon, the decision could have a broader impact, as every state except Missouri and the District of Columbia maintain a prescription drug monitoring program.

For pharmacies, hospitals, and individual practitioners registered with the DEA, this ruling raises the prospect that the DEA may be required to obtain a warrant to gain access to prescriptions records (or other records which would be protected by a heightened privacy interest) directly from DEA registrants.