The Government Needs to Get a Warrant if It Wants Access to Our Private Health Information

The Drug Enforcement Administration is once again trying to access private prescription records of patients — this time in New Hampshire — without a warrant, despite a state law to the contrary. Today the ACLU filed a brief in support of the state of New Hampshire’s fight to defend the privacy of our sensitive medical information against unwarranted searches by law enforcement.

New Hampshire — like 48 other states, the District of Columbia, and Puerto Rico — has established a statewide Prescription Drug Monitoring Program (PDMP), which logs records of every prescription for a long list of “controlled substances,” including Xanax, Ambien, and many painkillers, filled by pharmacists in the state. The PDMP is intended to function as a public health tool to allow physicians and pharmacists to look up their patients’ past prescriptions for medications that have addictive potential. Because these prescription records are so sensitive, New Hampshire law bars law enforcement agents from accessing the database unless they have a search warrant signed by a judge.

That rule has worked just fine for state and local police, but the federal Drug Enforcement Administration refuses to respect it. The DEA insists that, because it is a federal agency, it can ignore state law and request people’s PDMP records with an administrative subpoena instead of a warrant. Unlike a warrant, a subpoena is issued directly by the agency based on a low legal standard, without requiring the approval of a judge.

When New Hampshire received a DEA subpoena for a patient’s PDMP records last year, the state rightly refused to comply because doing so would violate the state law requiring a warrant. The DEA then sued in federal court, but New Hampshire stood firm, arguing that the subpoena was improper under federal law and the Fourth Amendment to the U.S. Constitution. After losing in trial court, the state appealed to the First Circuit Court of Appeals.

The DEA’s most galling argument in the case is that people have no reasonable expectation of privacy in their prescription records held in the PDMP because of the “third-party doctrine.” Under that doctrine, a person is considered to lose their Fourth Amendment protections in information voluntarily shared with a “third party,” like a company they do business with.

We’ve seen that argument before when the DEA tried to obtain PDMP records in Oregon and Utah without a warrant. But the legal landscape has now changed. That’s because last year in Carpenter v. United States, the Supreme Court made clear that the third-party doctrine does not automatically apply to sensitive agglomerations of digital-age records. That case was about people’s sensitive location records held by their cell phone companies, but the lesson of Supreme Court’s holding should apply equally to the sensitive digital database of prescription records at issue here.

Our amicus brief, filed with the ACLU affiliates in the First Circuit — New Hampshire, Maine, Massachusetts, Puerto Rico, and Rhode Island — as well as the New Hampshire Medical Society, argues that law enforcement agencies, including the DEA, must get a warrant under the Fourth Amendment to access the private medical information in the PDMP database.

As we explain, information about the prescription medications we take can reveal a great deal of intimate and private details about our health, including our medical diagnoses and our doctors’ confidential medical advice. Indeed, this kind of medical information is among the most sensitive data about us. That’s why, for as long as there has been a medical profession, health care providers have been bound by a duty of confidentiality toward their patients’ medical information.

Moreover, this information is not voluntarily shared, in any meaningful sense, with the state’s database. The DEA suggests that people make a choice to give up their privacy protections when they share their medical information with their doctor and pharmacist. But as we write in our brief, choosing between obtaining health care and giving up one’s privacy rights is no choice at all.

The DEA’s aggressive position comes amid intensifying attention to the nation’s opioid addiction crisis. But far from hindering efforts to address that serious problem, strong Fourth Amendment protections are a crucial part of the solution. Successfully addressing drug addiction primarily requires public health approaches, not prosecutorial ones. Easy law enforcement access to medical records not only fuels mass incarceration, it deters patients from seeking necessary medical care.

Requiring the DEA to get a warrant ensures that people’s sensitive prescription records are only available to police when there is a real need. That’s good policy, and good Fourth Amendment law.