New Hampshire, like almost every other state, has a prescription drug monitoring program (PDMP) that keeps track of controlled substances deemed to have abuse potential. Recognizing the sensitive nature of that information, the state requires that law enforcement agencies obtain a probable-cause warrant before looking at it. The Drug Enforcement Administration does not like that rule, preferring to obtain whatever records it wants with an administrative subpoena. The clash between state law and the DEA's demands is at the center of a case in which the agency argues that patients do not have a reasonable expectation of privacy in PDMP records—an argument that the American Civil Liberties Union debunks in a brief it
filed last week.
Michelle Ricco-Jonas, a New Hampshire Board of Pharmacy program manager who is the custodian of the state's PDMP database, is challenging a subpoena for two years of a patient's records that the DEA served last June. In January a federal judge sided with the DEA, and New Hampshire is now
asking the U.S. Court of Appeals for the First Circuit to reverse that decision.
Relying on the "third party doctrine," the DEA argues that it does not need a warrant because examining PDMP records does not qualify as a search under the Fourth Amendment. The U.S. Supreme Court has repeatedly ruled that no warrant is required to peruse information that people voluntarily share with third parties such as
banksand
phone companies. But last year in
Carpenter v. United States, the Court declined to extend the third-party doctrine to cellphone location data, noting that such information is collected automatically and "provides an intimate window into a person's life." The ACLU, joined by the New Hampshire Medical Society, argues that
Carpenter's logic clearly applies to information about the medications people take.
The
ACLU brief notes that patients do not in any meaningful sense consent to the collection of their prescription records. If they seek medical treatment and it involves the prescription of a drug covered by New Hampshire's PDMP law, that information is automatically added to the database, where it stays for three years.
