DEA Argues Oregonians Have No Protected Privacy Interest In Prescription Records

schwit1 writes "Like emails and documents stored in the cloud, your prescription medical records may have a tenuous right to privacy. In response to a lawsuit filed by the American Civil Liberties Union (ACLU) over the privacy of certain medical records, the U.S. Drug Enforcement Administration is arguing (ACLU response) that citizens whose medical records are handed over to a pharmacy — or any other third-party — have 'no expectation of privacy' for that information." Oregon mandates that pharmacies report information on people receiving certain drugs to a centralized database (ostensibly to "...help people work with their health care providers and pharmacists to know what medications are best for them."). State law does allow law enforcement to access the records, but only with a warrant. The DEA, however, thinks that, because the program is public, a citizen is knowingly disclosing that information to a third party thus losing all of their privacy rights (since you can always just opt out of receiving medical care) thanks to the Controlled Substances Act. The ACLU and medical professionals (PDF) don't think there's anything voluntary about receiving medical treatment, and that medical ethics override other concerns.

Medical records privacy act?

[Geoffrey.landis]

I'm puzzled; I'd think that this was covered by the Medical Records Privacy laws.

Personal information you give to your doctor is shared with insurance companies, pharmacies, researchers, and employers based on specific regulations.

http://www.hhs.gov/ocr/privacy/index.html [hhs.gov]
https://www.privacyrights.org/fs/fs8-med.htm [privacyrights.org]

Re:Medical records privacy act?

[nbauman]

That deceitful, misleading hhs.gov page doesn't tell you that there are many exceptions to HIPAA, including law enforcement access, which is buried within links that are difficult to get to:

Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; or to identify or locate a suspect, fugitive, material witness, or missing person. http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html [hhs.gov] Summary of the HIPAA Privacy Rule (emphasis added)

What that means is that a cop can go into a hospital, flash his badge, and copy all your medical records if he feels like it, without violating HIPAA. Individual hospitals may have different policies, but nothing in HIPAA prevents that.

There are also no penalties under HIPAA for releasing private health information to third parties like that. All those big fines that HHS is touting are for structural problems with their databases, not for improperly releasing information about specific individuals.

Re:America is fucked ...

[cayenne8]

It's expensive and time consuming to push something like that all the way to the Supreme Court, which is where it would have to be decided. The expensive criminal lawyers specialize on getting their clients released on technicalities or having evidence/testimony thrown out. The cheap criminal lawyers specialize on plea bargaining their clients' cases to lower the penalty. There hasn't been the interest, up to this point.

Now that marijuana has been legalized in Washington and Colorado we may see someone willing to take the principled stand and spend the time/money to fight it. I'm hoping so, anyway.

Well, Timothy Leary [wikipedia.org] got the Marijuana Tax Stamp act thrown out before Nixon signed in the DEA acts.....so, we just need someone else to come up and get the laws for drug scheduling struck down.

I know it takes more money to do that these days, but surely there are some big money types on the left (and maybe some on the right too) that could fund this for some poor sap that is caught up on these draconian laws.

Interstate Commerce Clause = Instrastate Powers

[cervesaebraciator]

Indeed, the Interstate Commerce Clause is one of the most abused sections of the Constitution. If something is grown and consumed locally, you and I might deny it has much to do with interstate commerce. Indeed, it would seem to be the very definition of intrastate commerce. But the sophists, er... sorry, the Constitutional lawyers will argue that growing drugs locally rather than buying them from other states will affect the markets in those other states. Since the activity has interstate effects it will be counted as interstate commerce.

So it's not just that an air molecule might cross the state border. It's also that by having air within the state borders, we have no vacuum within the state. Our lack of a vacuum in the state means that we will not draw on other state's supply of air, so affecting the air market in those states. We're in charge now...

Lest what I say seem to absurd, consider this from the font of all knowledge [wikipedia.org]:

In United States v. Wrightwood Dairy Co. (1942) the Court upheld federal price regulation of intrastate milk commerce, stating:

The commerce power is not confined in its exercise to the regulation of commerce among the states. It extends to those activities intrastate which so affect interstate commerce, or the exertion of the power of Congress over it, as to make regulation of them appropriate means to the attainment of a legitimate end, the effective execution of the granted power to regulate interstate commerce. [ ...] The power of Congress over interstate commerce is plenary and complete in itself, may be exercised to its utmost extent, and acknowledges no limitations other than are prescribed in the Constitution. [ ... ] It follows that no form of state activity can constitutionally thwart the regulatory power granted by the commerce clause to Congress. Hence, the reach of that power extends to those intrastate activities which in a substantial way interfere with or obstruct the exercise of the granted power.[13]

In Wickard v. Filburn (1942) the Court upheld the Agricultural Adjustment Act of 1938, which sought to stabilize wide fluctuations in the market price for wheat. The Court found that Congress could apply national quotas to wheat grown on one's own land, for one's own consumption, because the total of such local production and consumption could potentially be sufficiently large as to impact the overall national goal of stabilizing prices. The Court cited its recent Wrightwood decision and decided that "[w]hether the subject of the regulation in question was "production," "consumption," or "marketing" is, therefore, not material for purposes of deciding the question of federal power before us."

Re:Medical records privacy act?

[nbauman]

It's not hyperbole. There are cases like that. (There may be a few cases cited on the Wikipedia HIPAA or Electronic Medical Record pages.)

Law enforcement access is explicitly permitted by HIPAA. I don't think that a law enforcement officer needs a court order, warrant or subpoena to get access to medical records. If you know of any regulation or cases to the contrary, I'd like to see the citation.

Hospitals can impose stricter access than HIPAA , but they don't have to.