DEA is investigating two pharmacies in Colorado. It doesn’t want those pharmacies to know it is investigating them. But it needs information relating to these pharmacies and the prescriptions they are dispensing to assist with its investigation. So DEA is doing what it does on a regular basis in many states. It is issuing subpoenas for the Colorado Prescription Drug Monitoring Program (“PDMP”) data relevant to these registrants. And Colorado is objecting.
Not to everything. Colorado agrees to turn over all PDMP data except “patient-identifying information,” which includes names, addresses, and birthdates. Without laundry-listing, this information is important to DEA’s investigations for several reasons, including whether the same patient is getting an unusual amount of prescriptions filled or whether the patient lives an unusual distance from the pharmacy or whether patients known for selling controlled substances are regular customers.
So DEA filed suit this week in the District of Colorado for the enforcement of these subpoenas. Colorado’s claim is concern for patient privacy. In a vacuum, of course, this is a noble concern. But there seem to be some problems with this claim. Putting aside the legal concerns for a moment, you would think Colorado would be sensitive to the environment surrounding the opioids issue in the country right now. DEA and other state agencies are attempting to get after the bad actors that are profiting from this epidemic. It seems a strange time and place for Colorado to plant this particular flag.
But there are legal concerns as well. And maybe hypocrisy concerns. As DEA points out in its petition, Colorado has complied with such subpoenas before and as part of one of these very same investigations. “In fact, earlier this year, as part of the investigation of one of the subject pharmacies, the Pharmacy Board complied without objection to a prior subpoena for two years of pharmacy data, including all patient-identifying information.”
According to DEA’s petition (and, to be fair, Colorado has yet to respond, so this is all we have to go on at the moment), the Pharmacy Board is making two claims: 1. the patient-identifying information is not relevant enough to the investigations and 2. Fourth Amendment privacy concerns prevent them from turning this information over to the DEA. Given the numerous reasons patient-identifying information is helpful in this type of investigation (a few of which are listed above), I would not hang my hat on the first reason. As for the Fourth Amendment, the DEA convincingly argues that its subpoenas fall squarely within the standards laid out by the Supreme Court in Whalen v. Roe. And, of course, the state (Colorado) already has this data. As the petition argues in footnote 12, under United States v. Jacobsen, “[o]nce the state lawfully obtained access to that information, the Fourth Amendment does not prevent further disclosure of that information to the federal government, because the Fourth Amendment does not prevent governmental review of evidence already disclosed to the government.”
DEA also points out that the state statute governing PDMP data permits the disclosure of this data to law enforcement officials, so there is no state statutory basis for the privacy argument.
As mentioned above, we do not have Colorado’s response in hand. But they will have to pull something unexpected out of their legal bag of tricks to win this one. And they may want to consider how essential it is, as this crisis is confronted, that agencies work together to combat the wrongdoers, so that the innocent do not end up in the crosshairs. As of now, for the DEA, this looks like a slam dunk.