Investigation: Your prescriptions aren’t private

Fox 4 Now

The prescriptions you have in your medicine cabinet might not be as private as you believe they are. Thirty-one states grant law enforcement warrantless access to databases containing drug histories, and the U.S. Drug Enforcement Administration is pushing hard to search records even in states that have privacy safeguards.

The disclosures to police agencies often take place without notifying the person targeted in a search and without offering a chance to object. That means no court ever approves the release of records that can reveal treatment for private medical conditions such as cancer, psychiatric disorders, HIV or gender reassignment.   

Prescription drug monitoring programs are operated by every state except Missouri and the District of Columbia. Missouri’s program awaits state legislative approval, and D.C. expects to have its program fully operational by the end of the year. The primary goal of the state programs is to track and analyze prescription data to help doctors and pharmacists curb the overuse of addictive drugs such as painkillers. But a patchwork of state laws has left the privacy of Americans largely unguarded, allowing police agencies easy access.

Scripps News found during a five-month investigation that law enforcement tapped into at least 344,921 prescription histories of Americans between 2014-2015 in the states that don’t require a warrant or another form of court authorization. That is more than six times the number of searches that took place by law enforcement in states that have more privacy safeguards enacted. It is access without oversight that leaves the door open for abuses.

Their lives were almost ruined

“I could have lost my family, I could have lost my career,” said Marlon Jones, an assistant fire chief with the Unified Fire Authority of Salt Lake County, Utah. Jones says he was falsely charged with felonies related to doctor shopping as a result of a warrantless search by local police in Cottonwood Heights.

Investigators were looking into the theft of prescription drugs from area ambulances. With no suspects, no probable cause and no warrant, a police officer working the case logged into Utah’s controlled substance database and searched the prescription drug records for all 480 fire department employees.

“I had no idea that a police officer, just on a whim, could go into my medical records and then determine what’s appropriate, in his opinion,” recounted Ryan Pyle, a fellow firefighter paramedic whose prescription records got swept up in the same warrantless search.

Police never made an arrest in the drug thefts but instead zeroed in on the prescription histories of Jones and Pyle and charged them with acquiring controlled substances under false pretenses. The charges had nothing to do with the crime police were initially investigating.

“It impacted every bit of our lives,” said Jones, who was placed on suspension just months after having been promoted. “What (the investigator) did threatened to take everything I held dear.”

Pyle’s arrest came as he and his wife were in the middle of adopting two boys. “When I was initially charged, that’s the first thing I thought of: We’re going to lose these kids,” he said.

Kelvyn Cullimore Jr., the mayor of Cottonwood Heights, said police followed proper protocol and used the tools they had available.

“We would not do anything that would go beyond the bounds of what the law allows,” he said. “We were acting purely according to the way the state law permitted.”

In hindsight, Cullimore said, police could have conducted a more narrowly tailored search, but he said sees no problem with warrantless searches if state laws allows them.

Prosecutors eventually dropped the charges but the controversy prompted Utah lawmakers to enact a new law in May 2015 requiring police agencies to obtain a search warrant before they can access the prescription database.

Last December, a state legislative audit looking back at police use of the database before the new law revealed police overreach might have been more widespread. Auditors reviewed records for four police agencies in Utah and concluded warrantless access “may have resulted in questionable use” of the database by police in more than half the cases sampled.

National battles brewing

Concern about privacy rights and potential abuses of the information stored in Utah’s database date back to when the state launched the program in the mid-90s. In a March 1995 letter to the Speaker of the House and President of the Senate, then Governor Mike Leavitt warned, “I will be watching the use of this database. If the information from the database is used in any manner other than its intended purpose, I will seek to have the database disbanded.”

Two decades later, controversies in Utah have helped shape the state into one of a handful of emerging legal battlegrounds where privacy advocates and law enforcement agencies from across the nation  will be pitted against each other in a fight that could ultimately help determine how private Americans’ prescription records are.

“Permitting law enforcement officers to go on fishing expeditions in people’s personal information, then make their own untrained medical judgments and prosecute people as a result, has the power to destroy lives,” said Scott Michelman, an attorney for the Washington, D.C.-based watchdog Public Citizen.

Michelman says warrantless searches of prescription records violate the Constitution’s Fourth Amendment, which bans unreasonable searches or seizures by police. “With tremendous power comes tremendous responsibility and also tremendous potential for abuse.”

Michelman will represent Pyle and Jones next month when their privacy lawsuit is argued in the Tenth Circuit Court of Appeals. The outcome could ultimately determine whether warrantless searches of prescription records will be considered legal or banned outright in six Western states.

DEA pushes hard for access

While privacy advocates have won important recent victories, the U.S. Drug Enforcement Administration has grown increasingly aggressive, pushing to circumvent privacy safeguards even when state legislatures put them in place.

In Oregon, privacy-focused lawmakers set up the state’s database in 2009 and required law enforcement to present a warrant in order to access prescription records in the state’s database.   But despite the state’s law, the DEA claimed a separate federal law still allowed them warrantless access to Oregon’s data.  The DEA wanted access using only an administrative subpoena —  a document that does not require approval by a court.  Alarmed, the State of Oregon sued to block the DEA’s attempts and the American Civil Liberties Union intervened in the lawsuit.

The court ruled in favor of Oregon and the ACLU, with the federal judge Ancer Haggerty concluding “the DEA’s use of administrative subpoenas to obtain prescription records from the (prescription drug monitoring program) violates the Fourth Amendment.”

The DEA has since appealed the ruling and the case is expected be heard this fall.  But a legal defeat in Oregon did not stop the DEA from trying again elsewhere.  In June, the DEA sued the State of Utah in an attempt to force that state to still comply with the DEA’s administrative subpoenas, despite Utah’s warrant requirements that were put in place by the legislature in the wake of the controversy involving the firefighters. The ACLU filed a motion in July to intervene in that case as well, warning that the federal government’s latest actions constituted a broad intrusion on the will of state lawmakers.

“Utah’s law was passed with overwhelming support by Utah legislators and the general public, who clearly appreciate the need to protect the privacy of all Utahns from warrantless government searches,” said John Mejia, legal director for the ACLU of Utah.

The DEA declined an interview, but in an email spokesperson Barbara Carreno wrote, “it’s up to each state how to manage law enforcement access to its (prescription drug monitoring programs), including our access. Access is determined by the state legislature; we have no influence over a state’s legislative process, nor do we attempt to have influence.”

The statement continued, “we have no position on the question of whether there should be a national standard” for law enforcement access to prescription drug monitoring programs.

The agency has not responded to follow up questions.

Vast differences in state privacy safeguards

Seventy-eight Americans die every day from opioid overdose, according to the Centers for Disease Control and Prevention, and the White House said that when “properly implemented” the state’s prescription monitoring programs are a key part of the push to curb opioid abuse, but it declined to address whether there should be a national policy to guide states on what privacy safeguards should be implemented.

“Each state develops laws or guidelines to ensure the information in those systems is used effectively and appropriately,” said Mario Moreno, spokesperson for the White House Office on National Drug Control Policy.

Of the 31 states that allow warrantless access, 15 confirmed to Scripps they give law enforcement direct or login access to the sensitive information contained in the prescription drug databases. This allows some law enforcement officers to access the database from their computers.

“All registered users have direct logins (usernames and passwords) to be able to make requests. No prior contact to our agency needs to be made,” Indiana authorities said in response to a Scripps inquiry.  “They do not have to provide anything prior to a request, only the case number.”

In West Virginia, police must only promise they have an investigation to tap in.  “No case number or other certification is required,” said Michael Goff, administrator of the controlled substance database for the West Virginia Board of Pharmacy.

“When that type of information can be rifled through …by law enforcement, with the power to prosecute, that’s a very scary thing and something that should give all of us pause,” said attorney Michelman.

Minnesota limits the amount of information police can access to the most recent two years, preventing them from digging through a lifetime of prescription records that might reveal older treatments for depression or other conditions an individual would not want revealed.   New York goes back five years, and Virginia has information compiled dating back to 2003.

Among the states that provided numbers to Scripps, Texas, which doesn’t require law enforcement to present a search warrant first, leads the nation in the number of times police requested access to a state database.  Between 2014 and 2015 law enforcement tapped into the database 57,477 times to review the prescription histories of Texans. That is more than three times the number of requests for access as what took place in California, a state that has both a warrant requirement and a population that is nearly 50 percent larger than Texas.

Alabama, Georgia, Maine and New Jersey declined to provide the number of law enforcement searches of their respective prescription drug monitoring databases.

Thirty-four of the 49 state programs responding to the survey say they have never conducted an audit of their  programs. Twenty-three of the 31 states that allow warrantless access have never audited their prescription monitoring programs.

Balancing privacy with law enforcement

New Mexico has had one of the highest drug overdose rates in the nation for the past two decades, and officials there say the prescription drug monitoring program is an important tool to help combat the problem.

“We have an opportunity to make certain law enforcement, pharmacists, doctors themselves can accurately obtain the information that would lead them to believe a person is being over-prescribed or that they’re gaming the system,” said Mike Unthank, head of New Mexico’s Regulation and Licensing Department.

Unthank also acknowledges New Mexico officials have largely not wrestled with privacy issues bubbling up in other parts of the country. The state allows warrantless access for police and is among the states that give law enforcement direct log-in access to data. It also has never conducted an audit of its program.

He said he “absolutely, at this point certainly” has faith in police agencies to keep a close watch on any officers entrusted with direct access to the database.

The Albuquerque Police Department, one such agency, told Scripps it steers clear of the database altogether.

“We have never requested access to that database and don’t see any need to gain access to the database,” Tanner Tixier, a spokesperson for the Albuquerque Police Department, wrote in an email to Scripps.  “We believe it would be a violation of HIPPA.”

Yet, records released to Scripps from the State of New Mexico show at least two individuals from the Albuquerque Police Department have been accessing the database in all three years from 2014 and 2016.  One Albuquerque police officer made 35 requests for patient data in 2015 alone.

Unthank had no explanation for the discrepancy, but he acknowledged it is a sign New Mexico might want to audit its program and begin placing privacy safeguards above the state’s desire to increase utilization of its database.

“I am glad you brought this to my attention,” he said.  “Privacy rights would trump anything. The rights of the citizen, I think, are absolutely critical as a first consideration.”

Unthank, who is a direct appointee of the governor, said he does see the “potential” for privacy intrusions under the current setup of New Mexico’s system.

“The timing is good to attempt to balance these two. I think you could put both together. The rights of the public being protected and also the utilization by law enforcement,” he said.

It’s this balance that privacy advocates want to ensure is met in every state across the country.

“We’re not objecting to the collection of the information. It’s the accessing of the information by law enforcement without judicial approval of any kind,” said attorney Michelman.  “This issue is so important because of the depth of the privacy interest at stake.”