Court Rules Feds Need Warrant to Access Drug Prescriptions Database

In a significant win for the privacy rights of anyone who has ever gotten a drug prescription, a federal judge in Oregon ruled yesterday that the DEA needs a warrant to search confidential prescription records.

Oregon, like 48 other states, has a Prescription Drug Monitoring Program (PDMP), which tracks patients’ prescriptions for medications used to treat a long list of sensitive medical conditions. Although Oregon law requires police to get a warrant from a judge before searching prescription records in the database, the DEA has been requesting records using administrative subpoenas, which do not involve judicial authorization or probable cause. After the State of Oregon sued the DEA over this practice, the ACLU and ACLU of Oregon joined the suit on behalf of four patients and a doctor in the state. Last month, we argued in court that the DEA is violating the Fourth Amendment by bypassing the Constitution’s warrant requirement when seeking private prescription records. Yesterday, the court agreed.

The court’s ruling is the first time a judge has held that law enforcement must get a probable cause warrant to access confidential prescription records from a state database in a criminal investigation. The opinion is significant for several reasons.

First, the court soundly rejected the DEA’s extreme argument that people lose their Fourth Amendment privacy rights in their medical information when they engage in confidential discussions with their doctor and pharmacist about their illnesses and treatment decisions. The federal government had argued that the “third party doctrine” applied, comparing confidential prescription records to electricity consumption records, bank records, and other categories of information held by third-party companies, for which courts have said police don’t need a warrant. The judge batted this argument aside, explaining that prescription records are “more inherently personal or private than bank records, and are entitled to and treated with a heightened expectation of privacy.” As the court held: “Although there is not an absolute right to privacy in prescription information, as patients must expect that physicians, pharmacists, and other medical personnel can and must access their records, it is more than reasonable for patients to believe that law enforcement agencies will not have unfettered access to their records.”

More importantly, this ruling fits into a series of recent opinions calling into question the continuing vitality of the third party doctrine in modern society. As Justice Sotomayor wrote in United States v. Jonestwo years ago, “it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties. This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.” This sentiment was echoed by the federal judge who ruled last year that the NSA’s bulk telephone metadata program violates the Fourth Amendment. The Oregon case is another blow to the third party doctrine’s shaky foundation.

In addition, although yesterday’s ruling is only binding within Oregon, it will be persuasive precedent for courts evaluating law enforcement’s use of subpoenas to obtain private prescription records—and similar information—around the country. The case is a reminder to the DEA and other law enforcement agencies that they are not above the law, and that they must comply with the Fourth Amendment’s warrant requirement when seeking sensitive information in criminal investigations.

Finally, the case should add momentum to a movement within state legislatures to amend PDMP statutes to require police to get a warrant for prescription records. Ten states currently require a warrant as a matter of state law (Rhode Island was the most recent state to add this requirement, last year). The Pennsylvania House has passed legislation creating a warrant requirement for that state’s PDMP, and is waiting for the state senate to act. The Florida legislature may update the privacy protections for its PDMP this year. Action by state legislatures will send a strong message to the DEA that it should be getting warrants everywhere, not just in Oregon.

Yesterday’s decision was a resounding win for privacy rights. We look forward to expanding on this success as we continue to defend the rights guaranteed by the Fourth Amendment.