Summary/Abstract

How private are your medical records? You'd think they'd be pretty damn private, considering Congress specifically passed a law regulating the disclosure of these sensitive records. Some states feel the same way, extending even greater privacy protections to things like prescription records. Not only are medical entities prevented from passing on sensitive info without patients' consent, local law enforcement agencies aren't allowed to obtain third-party records like prescription data without a warrant.

Content

Seems pretty locked down, but as Leslie Francis and John Francis point out at the Oxford University Press blog, federal law enforcement agencies have undone both Congressional protections and state protections.

Utah’s requirement for a warrant conflicts with the federal Controlled Substances Act (CSA), which permits the DEA to issue administrative subpoenas for information relating to individuals suspected of violations of the CSA. According to a US Department of Justice report, administrative subpoenas may be issued by the agency without judicial oversight and without the showing of probable cause that would be required for a warrant.

When states provide more protections to residents than the federal government's willingness to grant, it's often the state laws that lose, especially when controlled substances are involved. Such is the case here, at least so far. The DEA demanded the release of patient info/prescription records without a warrant, something forbidden by Utah law. The state objected to the DEA's records demand. The DEA responded by flexing its considerable federal muscle.

The DEA countered with the Supremacy Clause: valid federal laws are superior to conflicting state laws.

The court ended up agreeing with the DEA: patient info and prescription records aren't afforded additional privacy protections, no matter what HIPAA/state laws have to say about the matter. The court's rationale was that prescription medicine is part of a "closely regulated" industry, which lowers the bar for government access. This lumps pharmacies and hospitals in with pawn shops, gun dealers, and adult filmmakers.

The Francis' point out this reading of close regulation and the DEA's Supremacy assertions is incredibly broad. It proposes nearly no limits to what the government can grab without a warrant. While the court discussed the possibility this should be limited to prescriptions containing controlled substances, it drew no precedential conclusions that may have shortened the government's reach.

And, indeed, there are no court decisions that grant reasonable privacy expectations to records most members of the public feel should be accessed only by them and their healthcare providers. The blog points to the last Supreme Court ruling related to patient privacy -- one that's nearly 40 years old at this point. All the Whalen v. Roe decision did was indicate the Court believed New York state's statutory privacy protections were enough and that there was no need to drag the Fourth Amendment into this. As we can see from the DEA's actions and assertions, statutory privacy protections mean nothing, not if the federal government can step in and override protections put in place by state and local governments.