Pharmacy Law: Does HIPAA Prevent Warrantless Searches of Pharmacy Records?

Did a law enforcement officer violate a patient's rights protected by the Health Insurance Portability and Accountability Act when he seized pharmacy records of a suspected prescription drug abuser?

Issue of the Case

When law enforcement searches pharmacy records related to transactions by a suspected prescription drug abuser, may those records be excluded from use in court either because of the individual’s constitutional right to privacy or based on a Health Insurance Portability and Accountability Act (HIPAA)-related privacy-of-records argument?

Facts of the Case

A police officer in a southeastern state was investigating a case of alleged “doctor shopping” by a female patient and visited a pharmacy to obtain records of her prescription drug transactions there. Those records were used to support charges against her. When the case came to trial, she argued that the law enforcement search for her records violated her constitutional rights to privacy and due process. She further argued that, under HIPAA, those records could not be released unless she was notified in advance and given the opportunity to consent or object. Based on those notions, she moved to have the evidence gained through the search suppressed and excluded from use at trial. The trial court judge granted that motion of exclusion, and the prosecutors appealed that decision.

The Court’s Ruling

The Court of Appeals ruled that neither the constitutional arguments nor the HIPAA-based arguments provided a legal basis for suppressing the evidence. The trial court’s decision on the motion was overturned—the evidence gained from the pharmacy could be used—and the case was returned to the trial court for further proceedings.

The Court’s Reasoning

The appellate court first noted that a trial court’s ruling on a motion to suppress evidence is accorded great deference on appeal and should be overturned only if the judge in the lower court made an erroneous application of the law. The appellate judges then reviewed the various arguments advanced by the defendant for suppressing the evidence.

The pharmacist released the records in accordance with a state statute that authorized such an action. In fact, the state statute requires that the controlled substances records at the pharmacy be maintained for 2 years and made available for inspection and copying to officers who enforce laws related to controlled substances.

State statutes on this topic were silent about whether patient consent was required for releasing such records from the pharmacy. This was in contrast with other state statutes that do require such consent for release of patient records of hospitals, nursing homes, and physician offices. Hence, the appellate court reasoned that the legislature could have added pharmacies to that list but did not do so, most likely in an attempt to address challenges with abuse of prescription controlled substances.

Turning to the defendant’s HIPAArelated arguments, the court quickly ruled that this federal statute does not “constitute a legal basis for suppression of the records at issue.” HIPAA does not prohibit release to law enforcement officials. In fact, HIPAA includes a provision that authorizes release of a patient’s protected health information “as otherwise required by law” or “in compliance with an authorized investigative demand.” Consequently, the action of the pharmacist in releasing the patient records to the law enforcement officers was highly consistent with the mandates or restrictions contained in HIPAA.

The appellate court also noted that even if such release of records was in violation of the statute, the remedies specified there for such a breach of the privacy protections created by the law were fines or imprisonment of the individuals who released the records. Suppression of evidence was not a remedy under the statute.

With regard to the constitutional right to privacy argument advanced by the defendant, the appellate court pointed out that “patients’ right to privacy in their medical records is not absolute.” If the government can show a “compelling state interest,” then the privacy rights will yield to that. In this case, the appellate court pointed to the high priority assigned to bringing abuse of controlled substances under control, emphasizing that “control and prosecution of criminal activity is a compelling state interest.” In addition, the court noted that courts in its own state, as well as other states, had ruled on numerous occasions that patients who present prescriptions for controlled substances have a limited expectation of privacy in the records maintained by the pharmacy. â– 

Dr. Fink is professor of pharmacy law and policy at the University of Kentucky College of Pharmacy, Lexington.