If you care about maintaining privacy over medical records and prescriptions, this was not a good year.
Both the California Supreme Court and the U.S. Ninth Circuit Court of Appeals issued disappointing decisions that declined to recognize a significant privacy interest in prescription records. In California, the state’s high court ruled that the Medical Board of California can rifle through records of prescriptions for controlled substances—used to treat anxiety, depression, pain, and insomnia—without notifying patients, obtaining a court order, or showing any suspicion of wrongdoing. The Ninth Circuit reversed on procedural grounds a good ruling out of Oregon, which found that the Drug Enforcement Administration (DEA) couldn’t access sensitive prescription records without a warrant. Both courts punted to another day the question of whether the Fourth Amendment’s warrant requirement protects prescription records.
This precedent is concerning, especially in an era of digital pills that use stomach acid to generate electronic data about exactly when you take your medication. Prescription records reveal our medical and mental health conditions and histories. They are a subset of our medical and mental health files, and they are just as sensitive as any other medical or mental health records, which are afforded a heightened degree of privacy protection. Prescription records should be, too. Just as with any other medical records, the government should need a warrant supported by probable cause before accessing them.
The courts may be responding to the opioid crisis in declining to address whether law enforcement’s warrantless access of controlled-substance prescription records violates the Constitution, but everyone should be able to expect privacy in their drug prescriptions and law enforcement should be required to get a warrant to access those records. Thanks to technology, getting a warrant is easier than ever. And it’s not too much to ask when we are talking about highly sensitive medical information.
The California Supreme Court Decision
The disappointing California Supreme Court decision, Lewis v. Superior Court, dates back to 2008, when the Medical Board obtained prescription information of hundreds of individuals from California’s CURES database without providing those individuals with any notice and without a court order or any suspicion of wrongdoing. CURES is California’s prescription drug monitoring program. The database contains sensitive information about controlled substances used to treat conditions such as anxiety, panic disorders, chronic and acute pain, depression, attention disorders, and insomnia. The hundreds of individuals whose information was accessed were all patients of Dr. Alwin Carl Lewis, who the board was investigating for recommending an objectionable diet to a patient.
Dr. Lewis objected in court to the board’s actions, arguing that it violated the privacy rights of his patients. Dr. Lewis lost in the lower courts and appealed his case to the California Supreme Court. EFF filed an amicus brief urging the court to require law enforcement agencies to get a warrant supported by probable cause before gaining access to patients’ sensitive CURES records. As we told the court, given the heightened privacy interest in medical records, granting the government unfettered access to prescription drug records violates both the Fourth Amendment and the California constitution’s privacy protections.
In July, after nine years of litigation, the California Supreme Court ruled against Dr. Lewis. The court held that accessing patients’ CURES prescription records without a court order or any suspicion of wrongdoing did not violate their right to privacy under the California Constitution. The court held that the privacy interest in prescription records is “less robust” than the privacy interest associated with other medical records and declined to subject the Board’s actions to heightened scrutiny. The court held that the board only needed to show a competing interest—and not a compelling interest—in order to justify invading the privacy of patients by accessing their prescription records. Applying a general balancing test, the court held that the board’s interest in protecting the public from unlawful use of drugs and from negligent or incompetent physicians, outweighed the privacy interest in controlled substance prescription records, and that the board was therefore justified in its actions.
The court declined to address whether the Fourth Amendment requires law enforcement agencies to obtain a warrant before accessing patients’ CURES prescription records. It held that Dr. Lewis had waived any Fourth Amendment arguments by not raising them early enough in the case.
There’s at least one good part of this disappointing opinion: Justice Goodwin Lui’s concurring opinion. Justice Lui notes that even if privacy interests in prescription records are “less robust” than for other medical records, patients still retain a reasonable expectation of privacy in prescription drug records that reveal their medical conditions—which means that prescription drug records are still protected by the Fourth Amendment.
The Ninth Circuit Decision
The disappointing Ninth Circuit decision involves Oregon’s Prescription Drug Monitoring Program (PDMP), which tracks prescriptions for certain drugs dispensed by Oregon pharmacies. When the Oregon legislature created the PDMP in 2009, it also enacted robust privacy protections, including a requirement that law enforcement agents get a warrant before accessing patients’ PDMP data. The DEA claimed that despite this requirement, a federal statute allowed it to access Oregonians' private prescription records without a warrant. The state of Oregon sued the DEA for trying to circumvent Oregon law. Several patients—who were each taking controlled drugs to treat extreme pain conditions, gender identity disorders, or post-traumatic stress disorders— intervened in the case, along with a doctor and the American Civil Liberties Union, and argued that warrantless access of PDMP data violated the Fourth Amendment.
In 2015, a district court judge in Oregon held that patients have a reasonable expectation of privacy in their prescription drug records and that law enforcement agents must obtain a warrant supported by probable cause in order to search prescription information. The court recognized that prescription records are “intensely private” and stated that “[i]t is difficult to conceive of information that is more private or more deserving of Fourth Amendment protection.”
But in June 2017, the Ninth Circuit reversed that decision. The court held that the “Intervenors”—the patients, the doctor, and the ACLU—had not established standing to raise their Fourth Amendment challenges, and it threw the lower court’s decision out. The court did recognize the “particularly private nature” of prescription records, but it still ruled in favor of the DEA, holding that the federal Controlled Substance Act preempted Oregon’s state law requiring a warrant to access PDMP prescription records.
Fighting False Distinctions
The government wants courts to believe that prescription records are less private than other medical records. This tactic—using false distinctions to erode the scope of established privacy protection—is all too familiar. We see it in the government’s attempts to characterize metadata—such as the subject line of an email, the time the email was sent, a phone number called, or the length and time of the call— as less sensitive than the content of our communications. But if the government knows you spoke with an HIV testing service, then to your doctor, and then to your health insurance company, all in the same hour, they likely know what you discussed. The metadata gives them just as much, if not more, private information than the content. Likewise, if the government knows that you’ve been taking a variety of anti-depression medications over a period of four years and the exact prescription you are currently taking, they will be able to infer not only that you are suffering from depression, but also the type of depression and the symptoms you may have. This is sensitive medical information, and the government should need a warrant supported by probable cause before accessing it.
Both Lewis v. Superior Court and PDMP v. DEA left the door open for future Fourth Amendment challenges to warrantless access of prescription drug records. Those challenges likely aren’t far off. And when the courts are finally ready to decide whether the Fourth Amendment protects prescription records, we’ll be there, urging them to do the right thing.
This article is part of our Year In Review series. Read other articles about the fight for digital rights in 2017.
LIKE WHAT YOU'RE READING? SUPPORT DIGITAL FREEDOM DEFENSE TODAY!
