New Hampshire, ACLU Fighting Back Against DEA's Warrantless Access To Sensitive Medical Records

from the you-can-have-your-rights-or-our-failed-drug-war,-citizens dept

The DEA regulates controlled substances, including medications containing controlled substances. The DEA has taken this to mean any number of medical privacy laws don't apply to it. If the DEA was forced to respect the law, well, it might just mean some drug dispensation wouldn't be quite as closely regulated as the agency wants it to be.

Since drugs have a war on them, the DEA has been given a long leash to investigate drug use/abuse. The DEA has argued in court that federal law overrules state-level privacy provisions. It has also done less legal things, like impersonate medical board investigators to gain access to denied records and ignored warrant requirements instituted by state legislatures.

This last tactic worked -- up to a point -- in Oregon. It resulted in the state suing the DEA for ignoring state warrant requirements when pulling records from Oregon's Prescription Drug Monitoring Program. The same thing is happening in New Hampshire. The fed DOJ got stiff-armed by the state DOJ when seeking warrantless access to medical records.

New Hampshire received a warrantless search demand from the federal Drug Enforcement Administration (DEA) for two years of a patient’s PDMP records last year. The N.H. Department of Justice correctly and courageously refused to comply, because doing so would violate the state law requiring a warrant and infringe on privacy rights. After the DEA sued in court, they stood firm, arguing that the subpoena was improper under federal law and the Fourth Amendment to the U.S. Constitution.

The ACLU has stepped in to argue in favor of requiring the DEA to use warrants. Its amicus brief [PDF] argues the records contained in the PDMP are not third-party records requiring nothing more than a subpoena. And even if the court does determine they are third-party records, the Supreme Court's decision in the Carpenter case has changed the contours of third-party record access.

The prescription records at issue in this case reveal intimate, private, and potentially stigmatizing details about patients’ health, including details of those patients’ underlying medical conditions. For that reason, as with other medical records, people have a reasonable expectation of privacy in them. As the Supreme Court explained in Carpenter v. United States, when law enforcement seeks records from a third party in which the subject of the investigation has a reasonable expectation of privacy, use of an administrative subpoena is unreasonable under the Fourth Amendment, and a warrant is required instead. Such is the case here.

While the records may be held by a third party, there's nothing voluntary about the records' creation. These records are created by healthcare professionals to comply with a state mandate. Patients do not volunteer to hand over this sensitive information. The only way to opt out is to never see a doctor.

The records expose at least as much personal information as the location records protected by Carpenter. The Supreme Court didn't believe going through life without a cellphone was a realistic option for citizens. I'm sure the Supreme Court would similarly conclude going through life without ever consulting a physician to be even more unlikely.

The DEA's position isn't based on an investigative need. Unless you're just fishing around, warrant requirements won't slow down the DEA much during investigations. It's just that the DEA is used to doing things its way, which is often the easiest way that involves the least amount of oversight possible.

Unfortunately for New Hampshire residents, trying to make the DEA respect state-level warrant requirements hasn't worked out yet. Oregon's lawsuit against the DEA ended with a defeat in the Ninth Circuit Appeals Court, which held that federal subpoena requirements trumped state-level demand for warrants. Sooner or later, this issue is going to end up in the Supreme Court, but for now, the DEA can still rely on subpoenas to hoover up sensitive patient records.

Filed Under: 4th amendment, dea, medical records, new hampshire, warrants

Thanks To The DEA And Drug War, Your Prescription Records Have Zero Expectation Of Privacy

from the BUT-HER-OXY dept

How private are your medical records? You'd think they'd be pretty damn private, considering Congress specifically passed a law regulating the disclosure of these sensitive records. Some states feel the same way, extending even greater privacy protections to things like prescription records. Not only are medical entities prevented from passing on sensitive info without patients' consent, local law enforcement agencies aren't allowed to obtain third-party records like prescription data without a warrant.

Seems pretty locked down, but as Leslie Francis and John Francis point out at the Oxford University Press blog, federal law enforcement agencies have undone both Congressional protections and state protections.

Utah’s requirement for a warrant conflicts with the federal Controlled Substances Act (CSA), which permits the DEA to issue administrative subpoenas for information relating to individuals suspected of violations of the CSA. According to a US Department of Justice report, administrative subpoenas may be issued by the agency without judicial oversight and without the showing of probable cause that would be required for a warrant.

When states provide more protections to residents than the federal government's willing to grant, it's often the state laws that lose, especially when controlled substances are involved. Such is the case here, at least so far. The DEA demanded the release of patient info/prescription records without a warrant, something forbidden by Utah law. The state objected to the DEA's records demand. The DEA responded by flexing its considerable federal muscle.

The DEA countered with the Supremacy Clause: valid federal laws are superior to conflicting state laws.

The court ended up agreeing with the DEA: patient info and prescription records aren't afforded additional privacy protections, no matter what HIPAA/state laws have to say about the matter. The court's rationale was that prescription medicine is part of a "closely regulated" industry, which lowers the bar for government access. This lumps pharmacies and hospitals in with pawn shops, gun dealers, and adult filmmakers.

The Francis' point out this reading of close regulation and the DEA's Supremacy assertions is incredibly broad. It proposes nearly no limits to what the government can grab without a warrant. While the court discussed the possibility this should be limited to prescriptions containing controlled substances, it drew no precedential conclusions that may have shortened the government's reach.

And, indeed, there are no court decisions that grant reasonable privacy expectations to records most members of the public feel should be accessed only by them and their healthcare providers. The blog points to the last Supreme Court ruling related to patient privacy -- one that's nearly 40 years old at this point. All the Whalen v. Roe decision did was indicate the Court believed New York state's statutory privacy protections were enough and that there was no need to drag the Fourth Amendment into this. As we can see from the DEA's actions and assertions, statutory privacy protections mean nothing, not if the federal government can step in and override protections put in place by state and local governments.

Filed Under: 4th amendment, dea, drug war, hipaa, law enforcement, medical records, prescriptions, privacy, warrant

California Highway Patrol Seizes Medical Records Of Woman An Officer Was Caught On Tape Beating

from the all-part-of-the-exoneration-process dept

Today's demonstration of post-brutality scrambling is brought to you by the California Highway Patrol. First off, we'll take a look at the "alleged" brutality, which looks incredibly similar to non-alleged brutality. (Apologies for the watermark the person who recorded the incident slapped all over the video.)

This head-punching (David Diaz, who recorded the incident, counts 15 punches in total) was performed as an act of civil service, according to the CHP.

Speaking to the television station ABC7, the California Highway Patrol said that the officer had ordered the woman to stop walking, out of fears for her safety.

She failed to follow this order, possibly due to mental illness. After the unnamed officer's fists were finished ensuring her safety, the CHP sent the woman to a mental health facility and refused to allow her family to see her. The video surfaced shortly thereafter, forcing the CHP to make further statements about how "physically combative" the woman was, as well as expressing its utmost desire to find a way out of this to see justice done.

"We're looking at every possibility, every fact, every circumstance that have contributed to this situation, and we're going to try to come to a just conclusion," Highway Patrol Assistant Chief Chris O'Quinn said at a news conference on Friday.

"Just," in this context, seems to actually mean "exonerating." The investigation continues, apparently, albeit in unexpected (and terrible) directions.

California Highway Patrol investigators have seized the medical records of a woman seen on video being repeatedly punched by one of its officers on the side of a Los Angeles freeway.

Chris Arevalo, executive administrator for psychiatric services at Los Angeles County-USC Medical Center, confirmed that the CHP served the search warrant Tuesday for Marlene Pinnock's records.

Why the CHP would need to seize the records, rather than just view them, is completely inexplicable. The person served the warrant noted that it was issued to grab "property or things" as part of a felony investigation, which apparently included communications with her doctor about her well-being and "references to her attorney."

I'm sure the ongoing investigation will clarify the CHP's need to violate its victim's privacy before this debacle is wrapped up. That's how it works. But it looks like an uphill battle. The statement released by the CHP commissioner sounds like even he was caught off-guard by this bizarre, smells-like-a-cover-up records seizure.

"I think what they're trying to do is, they don't have a statement from her, and they're trying to find that out," Farrow said. "I don't think the CHP is trying to put her on trial or make it an issue about her. What I'm looking at is entirely about the circumstances, we all saw what happened. Our job is to find out the why and the how."

So, the CHP gets statements by hospitalizing someone and seizing their medical records. While these records may offer some insight as to why she didn't immediately follow the officer's instructions, they really don't fill the "statement" void -- unless the CHP is going to further violate her privacy by releasing a statement on its own behalf using information gleaned from the seized records. As it stands now, it looks exactly like the CHP is planning to "make it an issue about her." If it isn't, then perhaps it might quid pro quo with the release of the disciplinary records of involved officers.

Moving on from this larger wrongness, I'd like to take a little time to point to the complicity of the Associated Press in the low-level whitewashing of this latest development by using that famous law enforcement standby, the passive voice.

My first notification came to me via Officer.com, whose headline read:

CHP Seizes Medical Records of Woman Seen Punched

"Seen punched?" Punched by whom? By the CHP, of course, not that this headline indicates that. As far as this headline goes, it may have just been a random mugging. A more accurate headline would be "CHP Seizes Medical Records of Woman They Were Seen Punching." Clumsy, but more honest. Considering this AP story was reposted by a police-centric site, the passive voice is completely expected. But it's not just cop sites like Officer.com. It's other places as well.





The AP buries the lede and other media sites run the feed without even altering it. Of course, Police One took the AP's weak title and made it even worse.

CHP seizes medical records of woman in scuffle with cop

Not only does it side more with the CHP, but it also makes it appear as though the CHP seized her records during the "scuffle."

We expect this use of the passive voice from police officers. The media doesn't really need to assist law enforcement spokespeople in their blame-deflection efforts. When misconduct allegations arise, they're always followed by details of "weapons discharging" and innocent bystanders "receiving gunshot wounds" and officers never striking anybody but always "responding" to actions, movements or words from some person whose personal safety was ensured by hospitalization.

Filed Under: california highway patrol, chips, medical records, videotape

UK Police And Companies Will Have Access To Database Of All England's Medical Records

from the privacy-disaster-waiting-to-happen dept

The UK government is currently building a database called care.data that will contain all of England's medical records. It's being promoted as providing valuable information for healthcare management and medical researchers that will lead to improved treatment.

Given the extremely sensitive nature of the material that will be stored, you might have expected this to be opt-in, but instead the UK government has chosen to make it opt-out. Not only that, but the relatively sparse information about what was happening was sent in the form of a generic, unaddressed letter that differs little from the dozens of junk mail pieces received by most households each week, and failed to include any easy-to-use opt-out form.

This has fuelled suspicions that the UK government is making it hard to opt out in order to keep the numbers enrolled in the database as high as possible. More recently, good reasons why people might want to avoid the scheme have emerged. For example, it was revealed that as well as being provided to research scientists, the database could also be bought by companies:

Drug and insurance companies will from later this year be able to buy information on patients -- including mental health conditions and diseases such as cancer, as well as smoking and drinking habits -- once a single English database of medical data has been created.

Now we learn that the UK police will also have access:

The database that will store all of England's health records has a series of "backdoors" that will allow police and government bodies to access people's medical data.

As the UK MP David Davis told the Guardian:

"The idea that police will be able to request information from a central database without a warrant totally undermines a long-held belief in the confidentiality of the doctor-patient relationship," he said.

That means that as well as the risk of a privacy disaster of unprecedented proportions if the consolidated health data is lost or stolen as a result of being passed to third parties (as has already happened with a similar but smaller database), patients may be less likely to confide in their doctors knowing that details will end up in a database sold to companies and freely available to the police. Nice work, Mr Cameron.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: companies, database, healthcare data, medical records, nhs, police, privacy, uk

DEA Circumventing Oregon State Law To Grab Medical Records Without A Warrant

from the you-can-only-take-my-information-for-so-long,-until-you-take-it-all dept

Just in case you had slipped into some sort of uneasy comfort thinking maybe, JUST MAYBE, the government had already gathered as much personal information as it "needed" (all without warrants), along comes the news that another agency is looking to get just a little more.

Via Reason comes the news that the DEA is attempting to bypass state law in Oregon in order to access private prescription records without a warrant. Some might argue that the DEA has some sort of right to know who's taking what considering its position as "drug war enforcer," but as the ACLU points out, prescription records can reveal some very sensitive information.

Records of the prescription medications we take can reveal some of the most private and sensitive information about us. Knowing that a person self-administers prescription testosterone injections can reveal that he is a transgender man undergoing hormone replacement therapy. Knowing that someone takes Xanax, Valium, or other anti-anxiety medications can reveal a diagnosis of mental illness. If a person is on Marinol, a medication containing synthetic THC, she is likely fighting weight loss associated with AIDS. A prescription for a narcotic painkiller such as codeine or oxycodone might indicate a chronic or terminal illness. Ritalin and Adderall are associated with treatment of Attention Deficit Hyperactivity Disorder.

The state of Oregon tracks prescriptions like these for several good reasons: to prevent drug overdoses and cut down on substance abuse. While it would seem the DEA should be able to access the records carte blanche because of the latter concern, Oregon has made the right move and added a warrant requirement in order to protect patients' information. The DEA, like many other government agencies (*coughFBI*), has been using administrative subpoenas to circumvent this requirement.

Fortunately, the state of Oregon is fighting back, with some help from the ACLU.

The State of Oregon sued the DEA in federal court to defend its right to require law enforcement, including federal agencies, to obtain the warrants required by state law. Today, the ACLU filed a motion to intervene in the case on behalf of several patients and a doctor whose prescription records are contained in the PDMP. Our clients are concerned that the privacy of their medical information will be violated if the DEA is allowed to search through prescription records without a warrant. If the DEA can demonstrate to a judge that it has probable cause to believe that a crime has been committed and that prescription records will provide evidence of that crime, then it can legitimately obtain records from the PDMP. Because prescription records and the medical information they reveal are such a sensitive matter, protecting their privacy is vital, and we argue that obtaining private and confidential prescription records without a warrant constitutes an unreasonable search in violation of the Fourth Amendment.

The ACLU points out that the "third-party doctrine" is being used to portray information provided to a doctor or pharmacist as exempt from warrant requirements. Courts have shown in the past that information turned over to a third party is no longer protected by the "reasonable expectation of privacy." This is a false equation, the ACLU states:

We disagree with this principle—but even on its own terms, the third party doctrine should not apply here. Medical records are different than the trash we put out on the curb, or the canceled checks we provide to our bank, or the electrical usage records we transmit to the power company. The information we share with our doctors and pharmacists can be some of our most private information. Just because we trust our doctors with our medical information doesn’t mean the DEA should be able to easily access it too.

In case you were wondering what sort of harm could come from unfettered access to medical records by law enforcement, here's a splendid example that combines prescription records with the domestic wing of the War on Drugs into one horrible (and horribly stupid) incident.

Barbara Alice Mahaffey died of colon cancer in her bedroom last May. [Vernal, UT resident] Ben D. Mahaffey, 80, said he was distraught and trying to make sure his wife's body would be taken to the funeral home with dignity, when he says officers insisted he help them look for the drugs.

"I was holding her hand saying goodbye when all the intrusion happened," he told the Deseret News.

Barbara Mahaffey died at 12:35 a.m. with Mahaffey, a Navy medic in the Korean War, and his friend, an EMT, at her side. In addition to police, a mortician and a hospice worker arrived at the home about 12:45 a.m., Mahaffey said. He said he doesn't know how police came to be there.

Mahaffey said he was treated as if he were going to sell the painkillers, which included OxyContin, oxycodone and morphine, on the street.

Yep. If your loved ones use certain painkillers, you can expect to be raided at any time, especially if they've just passed on, leaving behind a treasure trove of highly marketable controlled substances. But don't worry, Vernal City Manager Ken Bassett would expect nothing less than a raid by Vernal's finest during the final moments of his loved ones' lives:

In his suit, Mahaffey alleges that Vernal City Manager Ken Bassett told Mahaffey he was being "'overly sensitive' and that police were just trying to protect the public from illegal use of prescription drugs." The suit also alleges that Bassett then told Mahaffey "his own parents had recently died and he wouldn't have cared had police searched their house for drugs."

Also noted: this is "common practice" for Vernal police, although it's often "selectively applied." Yay! A badly written law, randomly enforced and noxious from any angle, that latter of which perfectly describes the DEA's attempt to circumvent patient privacy by exploiting a few loopholes. 
 

Filed Under: dea, medical records, oregon, privacy

Doctors In Tennessee Have Been Faxing Patient Info To The Wrong Place For Years

from the that-seems-bad dept

Live in Tennessee? Thought the records at your doctor's office were private? You might want to check again. Michael Scott alerts us to the news that a bunch of doctors offices in Tennessee have been accidentally faxing patient records, including confidential info, to a small solar company in Indiana... for three years. Luckily, the guy on the receiving end says he's been shredding the records as they come in, but he's getting pretty damn frustrated. He's contacted tons of people, including the Governor of Tennessee, but no luck. The faxes keep coming. Apparently, the problem is that the phone number of the business is close to the one that doctors are supposed to use. Given the number of faxes, my guess is that it's not so much people mistyping it into their fax machines each time, but at some point there must have been a typo in a mailing or on a website or something. Of course, we won't even get started on why these record transfers are still handled by fax. That's another post for another day...

Filed Under: doctors, faxing, medical records, privacy, tennessee

Google Wants Your Medical Records

from the well-of-course-they-do dept

While it's been rumored for years, Google is finally revealing a little bit about its Google Health plans, as it's opening up the service to a few thousand patients of the Cleveland Clinic. Those patients will be turning over their medical records to Google which, of course, is raising security and privacy concerns. It probably doesn't help that the news of this is breaking at about the same time as reports that Google accidentally exposed Gmail accounts in Kuwait. Exposing emails is bad enough, but your health records? Obviously, one hopes that Google is doing everything possible to protect the info, but as the AP report points out, Google is not covered by HIPAA (the Health Insurance Portability and Accountability Act,), meaning that even under the best intentions of Google, handing your records over to the company could make them easier for the government or legal adversaries to get at those records, since they've left the bounds of protected communication between a doctor and patient.

Despite all of that, there is something to be said for granting individuals more power to manager their own medical records. Assuming Google could make those records more searchable, more understandable and more useful by putting additional services around them, you could see how that could be valuable. On top of that, one of the benefits of such a service could be to allow medical providers easy access to specific, relevant portions of your medical history. However, Google isn't the only player trying to build such a system (with Microsoft having already announced something similar), and as we discussed about a year ago, perhaps a better solution than a centralized system (which is prone to attack) is to allow individuals to store and manage their own records. While some people may feel comfortable trusting Google to store the records, it seems likely that plenty of others will rather control the data themselves, while still being interested in making use of the value-added features one imagines Google will be providing.

Filed Under: centralized storage, google health, medical records, privacy