The DEA Thinks You Have “No Constitutionally Protected Privacy Interest” in Your Confidential Prescription Records

The Drug Enforcement Administration thinks people have “no constitutionally protected privacy interest” in their confidential prescription records, according to a brief filed last month in federal court. That disconcerting statement comes in response to an ACLU lawsuit challenging the DEA’s practice of obtaining private medical information without a warrant. The ACLU has just filed its response brief, explaining to the court why the DEA’s position is both startling and wrong.

We represent four patients and a physician in Oregon whose confidential prescription records are contained in a state database that tracks prescriptions for certain drugs. The database, called the Oregon Prescription Drug Monitoring Program (PDMP), was intended to be a public health tool to help physicians avoid drug overdoses and abuse in their patients. Despite a state law requiring law enforcement to obtain a probable cause warrant from a judge before requesting records from the PDMP, the DEA has been requesting records using administrative subpoenas, which do not involve judicial authorization or probable cause. Our clients object to the DEA’s warrantless access to the PDMP because their prescription records reveal deeply private information about their health and medical history, including their gender identity (two of our clients are transgender men taking testosterone as part of their transition from female to male sex) and mental illness (one client takes medication to treat anxiety and post-traumatic stress disorders).

In July, we explained to the court why people have a “reasonable expectation of privacy” in their confidential prescription records and the medical information those records reveal. (Under the Fourth Amendment, if there is a reasonable expectation of privacy in an item or location, law enforcement can generally conduct a search only if it first obtains a warrant). In support of our arguments, we submitted sworn declarations from medical privacy experts, including a scholar of medical ethics and a physician who explained that maintaining the confidentiality of doctor-patient communications is vital to the successful practice of medicine, and an authority on the history of medical ethics who explained that principles of medical confidentiality were well established at the time of the writing of the Fourth Amendment and would have been relied on by the Amendment’s framers.

In its latest brief, the DEA ignores these points and instead argues that the mere fact that our clients’ prescription records are held in a database maintained by a third party—the State of Oregon—means that they have somehow given up their privacy interest in the records. Courts have found that no warrant is required for information contained in some kinds of business records like electricity consumption records held by a power company or room registration information held by a motel. This is because, in theory, people have voluntarily given up their privacy interest in information when they turn it over to a third party. We disagree with that principle, called the “third party doctrine,” in many situations, because when people provide sensitive information to a third party for a specific purpose, they typically do not intend for law enforcement to have unfettered access to it. The principle is particularly offensive in this case.

Even accepting the third party doctrine on its own terms, the DEA’s position that confidential medical records should be treated the same as electrical consumption records or banking records is absurd. The information we share with our doctors and the medical treatment our doctors prescribe constitutes some of the most deeply private and sensitive information about us. Just because we trust our doctors and pharmacists with our medical information doesn’t mean the DEA should be able to easily access it too. Telling your doctor that you have an anxiety disorder or HIV is nothing like letting the power company read your electricity meter. The information communicated is exponentially more private. And the decision to visit a physician or pharmacist to obtain urgent medical treatment is not voluntary in any meaningful sense. We need to disclose our medical information to our doctors because our physical and psychological ailments require it, and foregoing care because of privacy concerns can leave a person debilitated or dead. We shouldn’t have to choose between protecting our privacy and protecting our health. The DEA’s position insults the rights, and the intelligence, of everyone who will ever seek treatment from a physician.

The DEA seems to think the Constitution doesn’t apply to its investigations. This case provides the court with an opportunity to push back, and to ensure that overzealous law enforcement agencies do not erode the longstanding protections of the Fourth Amendment.

View comments (13)
Read the Terms of Use


So you can get information from your doctor about how to treat an illness and know that that is protected, but if you actually try to follow that advice by filling your prescription, you have lost your right to privacy? That is like saying that the secret ballot protects your right to fill out a ballot without revealing your vote to anyone, but if you actually turn in that ballot, the government has the right to see whom you voted for.


I agree with the entire argument about the privacy of medical and pharmaceutical records. Law enforcement absolutely must have a warrant for access. But I also am startled to see the more relaxed attitude about utility use records. Do you realize that as "smart meters" are installed (and they are covering the nation even now), more and more personal data will be available from each household. Energy Star "chips" in new appliances will "report" specific usage. Details of a home business might become apparent, revealed by extra servers, or by "grow lights," etc. We MUST halt this dystopian growth in police powers!


Interestingly, according to the FAQ page from the Health Authority, ( "Will law enforcement be looking up my information?

Law enforcement agencies will not have direct access to the system, but law enforcement officials may request information from the Oregon Health Authority if they have a valid court order based on probable cause for an authorized drug-related investigation of an individual."

Seattle Psychiatrist

Washington State's new incredibly gestapoesque chronic non-cancer pain management laws went into effect at the same time that WA's so-called Prescription Drug Monitoring System, which monitors all Schedule II and IV meds picked up at any pharmacy in WA.

The monitoring system is quite error prone and relies on accurate entry of information by pharmacies. In addition, it is being used by pharmacists to make decisions about whether to fill a prescription or not or whether to classify a patient as a "drug seeker" or a doctor as a "drug dealer" or make decisions and complaints of alleged "beyond scope of practice" to the physician, to the patient as they refuse to fill the prescription, or to the disciplinary board without any discussion with the physician allegedly practicing beyond the scope of his practice.

In other words, pharmacists have become defacto disciplinary deputies for the WA Medical Quality Assurance Commission ("disciplinary board"). There are no legal responsibilities or ethical guidelines established for pharmacist complaints to the medical disciplinary board -- no requirements for a good faith or due diligence. Thus, just because a pharmacist doesn't like you, or they believe that certain meds are evil or bad, or, you name it, they can create worry and huge amounts of work and expense without any concerns about accountability, from a legal, ethical or pharmacy board disciplinary action standpoint.

Since the law and the data base kicked in on Jan. 1, 2012, the stigma and profiling of my patients and myself has been unrelenting.

Pharmacists aggressively profile patients and doctors using a profiling methodology that comes directly from the DEA -- is the doctor in an insurance plan, is the patient using insurance, does the patient pay cash for meds, do they travel "long distance" to see the doctor, and, of all things, does the doctor have weekend office hours.

I have been questioned by a NW DEA Agent on two occasions by phone with respect to so-called "audits" they (or he) do using actual copies of or originals of prescriptions -- not a database, actual alleged useable copies of my actual prescription to the patient, with questions like, "The date seems to be in different handwriting than the rest of the script," "is it?" Are you kidding me. Not just the draconian use of databases that should be, as noted, private, but the actual ability to obtain the prescriptions, themselves, for "auditing" purposes.

WA state is out of control in its disregard for stigma, profiling, and terrorizing in various ways, both doctors and patients. God help us.


Why is there not one mention of HIPAA in this article?

We have a federal statute pertaining to medical record privacy. Why can the DEA sidestep it?


I was hoping someone would ask the HIPAA question. I think that the rationale for not being protected under HIPAA is that the state has essentially demanded disclosure of the information (Information disclosed appropriately under 45 CFR 164.512), which removes HIPAA protections. HIPAA applies to Covered Entities, and it is very unlikely that the state would be considered such an entity.


I live in a state with a similar database. I did not give consent for my name to be in it. The state passed a law requiring physicans to participate in this program. The DEA is wrong. Nobody give permission for this. They need to have a warrent signed by a Judge to get information out of the database.


I second the above. Where is HIPAA in all of this? My own family can't get access to my medical records without my consent, but the DEA can, and without even a court order? There is something deeply wrong here.

ACA Navigator

If the DEA, and possibly other government agencies (e.g., NSA), think they have unfettered access to this information, how safe will the more revealing information in the Marketplace be?


Kentucky has a similar law in effect. Lawmakers, doctors, Health and Family Services, and law enforcement all argued for control of the database. It remains in KY Human Resources under the Inspector General. The Justice Dept. is supposedly only allowed access to these records if the patient is part of an ongoing investigation. It's creepy... these investigations can last for 1-2 years. If a patient is being investigated, does that open the door to all the prescribing doctor's patients' records???

YES. God help us! We are living in a police state, fascists at the helm, with no promise or reasonablle expectation of privacy.


Stay Informed