09-04: Statute requiring pharmacies to provide prescription records to a law enforcement officer in furtherance of a lawful investigation is valid; Delivery of such records does not require a search warrant or notice to the patient, nor does the statute violate HIPAA or constitutional protections

CASE: State v. Carter, 34 FLW D2466a, Fla. 1st DCA

DATE: November 30, 2009

FACTS: A police investigator obtained patient pharmacy records while investigating a "doctor shopping" violation, as described in Section 893.13(7)(a)8, Florida Statutes. The records were obtained pursuant to Section 893.07(4), Florida Statutes, which requires pharmacies to make controlled substance records available to law enforcement officers. The defendant filed a Motion to Suppress, arguing that the warrantless seizure of her prescription records violated her constitutional rights to privacy and due process. She further alleged that her pharmacy records could not legally be transmitted to law enforcement unless she was provided with prior notice, and the opportunity to object. The trial court agreed with the defendant, and suppressed the records. The State appealed.

RULING: The First District Court of Appeal reversed the trial court, and held that suppression of the records was not mandated by state or federal law. The court noted that the statute at issue, 893.07(4), requires pharmacies to maintain prescription records for a period of two years "for inspection and copying by law enforcement officers whose duty it is to enforce the laws of this state relating to controlled substances," and observed that the statutes does not require a subpoena, warrant, or prior notice to the patient. The court stated that Section 465.017(2)(a), which prohibits the release of controlled substance records to anyone other than the patient, was not violated, since that statute specifically contains an exception when the release is allowed by Chapter 893, which applied in this case. The court also held that warrantless release of the pharmacy records did not violate the federal Health Insurance Portability and Accountability Act (HIPAA.) HIPAA regulates the release of patient information by specified "covered entities," but the court noted that law enforcement and prosecutors are not "covered entities" under the Act. Further, the court noted that HIPAA permits disclosures "as otherwise required by law" or in "compliance with...an authorized investigative demand." Thus, a pharmacy's provision of prescription records to law enforcement in compliance with Section 893.07(4), Florida Statutes, also comports with HIPAA. Finally, the court held that the warrantless access to the records at issue did not violate the privacy interests recognized by Article I, Section 23 of the Florida Constitution.

NOTES: Investigators should carefully note that the statute addressed and approved in this case pertains specifically to controlled substance records held by a pharmacy, when requested in furtherance of an investigation into a violation of Chapter 893. This holding does not extend to other patient medical records. In fact, Florida law does contain specific notice and due process requirements relating to the release of other types of medical records, e.g. those in the possession of hospitals, nursing homes, and physicians. Investigators should obtain legal advice from their agency legal advisors or prosecutors when seeking these types of records.

John Kemner
Regional Legal Advisor
Florida Department of Law Enforcement

Officers should consult with their agency legal advisors to confirm the interpretation provided in this Update and to determine to what extent the case discussed will affect their activities.