Opinion
Civil Action No. 19-mc-00105-RM
04-21-2020
UNITED STATES DEPARTMENT OF JUSTICE, DRUG ENFORCEMENT ADMINISTRATION, Petitioner, v. STATE OF COLORADO BOARD OF PHARMACY, PATTY SALAZAR, EXECUTIVE DIRECTOR OF THE COLORADO DEPARTMENT OF REGULATORY AGENCIES, and APPRISS, INC., Respondents.
ORDER ON PETITION
This matter is before the Court on Petitioner United States Department of Justice, Drug Enforcement Administration's ("DEA") Petition for Expedited Order Enforcing Administrative Subpoenas ("Petition") (ECF No. 1). The Petition is fully briefed and the American Civil Liberties Union and the American Civil Liberties Union of Colorado (collectively, "ACLU") have filed an Amici Brief. Respondents State of Colorado Board of Pharmacy and Patty Salazar, in her official capacity as Executive Director of the Colorado Department of Regulatory Agencies, (collectively, "State Respondents") have separately moved for an evidentiary hearing which the DEA opposes but Respondent Appriss, Inc. does not. Upon consideration of the Petition, the court record, and the applicable rules and case law, and being otherwise fully advised, the Court finds and orders as follows.
Nonetheless, because Appriss's corporate headquarters are located in Kentucky, it reserves the right to object to providing testimony or personal attendance of an Appriss representative during any evidentiary hearing in Colorado.
I. BACKGROUND
At issue here is the DEA's petition for this Court to issue an order directing State Respondents to comply with two DEA administrative subpoenas seeking data regarding the controlled substances dispensed by two Colorado pharmacies under investigation. The DEA's rationale and the bases for its request are as follows.
The Petition is directed to all Respondents but it is undisputed that no subpoena was served on Appriss and Appriss has no authority to release the information which the DEA seeks. Appriss takes no position on the relief the DEA seeks, and will comply with any court order. Thus, this Order addresses the Petition as it relates to the State Respondents.
The names of the two pharmacies have been redacted and are not relevant in determining the merits of the Petition.
The DEA, in coordination with the United States Attorney's Office, is investigating the two pharmacies to determine whether each complied (and is complying) with the Comprehensive Drug Abuse Prevention and Control Act of 1970 ("Controlled Substance Act" or "CSA"), 21 U.S.C. §§ 801-904, when dispensing controlled substances to patients. The DEA has concerns about the dispensing practices at each pharmacy. Thus, the DEA issued the two subpoenas under the CSA to the State Respondents. In the subpoenas the DEA seeks data which has been collected by the Colorado Prescription Drug Monitoring Program ("PDMP"). Under Colorado law, pharmacies in Colorado are required to report daily to the PDMP data concerning all controlled substances dispensed in that 24-hour period. The State of Colorado Board of Pharmacy is charged with developing, procuring, and administering the PDMP; Patty Salazar, in her official capacity, has the authority to release the subpoenaed information; and Appriss, a private corporation, is tasked with collecting, maintaining, and processing the PDMP data.
For prescriptions for controlled substances, each pharmacy is required to report the following data: the date the prescription was dispensed; the name of the patient and the practitioner; the name and amount of the controlled substance; the method of payment; the name of the dispensing pharmacy; and "[a]ny other data elements necessary to determine whether a patient is visiting multiple practitioners or pharmacies, or both, to receive the same or similar medication." Colo. Rev. Stat. § 12-280-403(1). On the flip side of the requirement to report to the PDMP is the requirement that the practitioner and the dispensing pharmacy report to the patient, i.e., that "[e]ach practitioner and each dispensing pharmacy shall disclose to a patient receiving a controlled substance that his or her identifying prescription information will be entered into the program database and may be accessed for limited purposes by specified individuals." Colo. Rev. Stat. § 12-280-403(3).
The Colorado statute expressly permits the PDMP data to be disclosed, but only to specific recipients. As relevant here, the statute allows PDMP data to be disclosed in response to subpoenas from law enforcement. Colo. Rev. Stat. § 12-280-404(3)(g) (The PDMP "is available for query only to the following persons or groups of persons:...Law enforcement officials so long as the information released is specific to an individual patient, pharmacy, or practitioner and is part of a bona fide investigation, and the request for information is accompanied by an official court order or subpoena."). Here, the DEA's request is accompanied by subpoenas.
In response to the subpoenas, State Respondents have taken the position that they will not disclose any patient-identifying data on the pharmacy dispensed controlled substances. This includes the patient's name, date of birth, and address. State Respondents contend the patient-identifying information should not be disclosed because it would violate the Fourth Amendment right to privacy guaranteed to the more than 14,000 patients whose medical data is at issue. Thus, State Respondents have offered (a) to provide, and have produced to the Court, de-identified, pseudonymized responsive records and (b) to respond to follow-up requests for particularized patient information when the DEA identifies individualized targets of investigation from its analysis of the produced data. The DEA has rejected this offer, arguing the patient-identifying data is critical to its investigation and should be produced under the relevant standards. After reaching an impasse, the DEA filed the instant Petition.
State Respondents substituted the patients' identities with unique numeric pseudonyms by using an algorithm that matches unique patients using data such as first name, last name, date of birth, and address. The data sets maintain the pseudonymous patients' actual zip codes.
II. DISCUSSION
A. The Petition
In its Petition, the DEA argues the subpoenas should be judicially enforced under the standards set forth in United States v. Morton Salt Co., 338 U.S. 632 (1950) and Donovan v. Lone Steer, Inc., 464 U.S. 408 (1984). Under Morton Salt an administrative subpoena "is sufficient if the inquiry is within the authority of the agency, the demand is not too indefinite and the information sought is reasonably relevant." 338 U.S. at 652. Under Donovan, the "constitutional requirements for administrative subpoenas" are "'that the subpoena be sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome.'" 464 U.S. at 415 (quoting See v. City of Seattle, 387 U.S. 541, 544 (1967)); see also Becker v. Kroll, 494 F.3d 904, 916 (10th Cir. 2007) (stating that "[t]he Fourth Amendment requires only that an [administrative] subpoena" meets these standards, citing City of Seattle).
The parties also raise other arguments such as the effect, if any, of Carpenter v. United States, -- U.S. --, 138 S. Ct. 2206, 201 L.Ed.2d 507 (2018) and the exact nature of any Fourth Amendment privacy right in this case. In light of the Court's determination, it need not reach these other arguments.
In response, State Respondents object to the subpoenas asserting that each patient has a right to privacy in the data at issue and, to overcome this right, the DEA must satisfy the Fourth Amendment's "reasonable relevance" test for administrative subpoenas, relying on City of Seattle. (ECF No 18, e.g., p. 12.). However, the ACLU, as amicus, asserts that because patients have a reasonable expectation of privacy in the records at issue, a warrant is required. (ECF No. 24, p. 17.) But, as the DEA argues, the ACLU may not seek additional relief or enlarge the issues - at least not in this case. Thus, the Court focuses on the parties' agreed upon standard - reasonable relevance. As State Respondents acknowledge, they bear the burden of showing that the DEA's subpoenas are unreasonable. See United States v. Donaldson, 400 U.S. 517, 527 (1971); ECF No. 18, p. 25.
There are no contentions that State Respondents may not properly raise such objections to the enforcement of the subpoenas. See Donovan, 464 U.S. at 415 (recognizing person subpoenaed may "question the reasonableness of the subpoena, before suffering any penalties for refusing to comply with it, by raising objections in an action in district court"); Aid for Women v. Foulston, 441 F.3d 1101, 1111-1114 (10th Cir. 2006) (discussing third-party standing).
As used in this Order, the page references are to the page numbers assigned to the document by the District's CM/ECF System, found in the upper right hand corner of the document.
The ACLU agrees with State Respondents that patient-identifying information should not be disclosed but asserts State Respondents' proposed resolution may not fully vindicate the patients' Fourth Amendment rights. Thus, the ACLU contends that with any follow-up requests from the DEA for full disclosure of a patient's information, the Court should either order the DEA to give notice to the affected patients or require the DEA to obtain a warrant.
The DEA makes a blanket assertion that because the ACLU is an amicus its arguments should be disregarded, but that is not the standard. Instead, while the framing of the issues is "appropriately restricted to the litigants," Tyler v. City of Manhattan, 118 F.3d 1400, 1403 (10th Cir. 1997), this Court nonetheless has the discretion to reach arguments raised only in an amicus curiae brief. This discretion, however, is to be exercised "only in exceptional circumstances," id. at 1404, such as if the argument or issue is adopted by State Respondents or the issue is jurisdictional or touches on an issue of federalism or comity which could be considered sua sponte. Id.; see also In re McGough, 737 F.3d 1268, 1277 n.8 (10th Cir. 2013). On review of the record, the Court finds no exceptional circumstances exist justifying its consideration of whether a warrant is required. Thus, the Court declines to do so here.
1. "Specific in Directive"
State Respondents concede the DEA's subpoenas are specific in directive; thus, the Court moves on to examine the remaining two factors.
2. "Relevant in Purpose"
The DEA provides an extensive list of reasons why patient-identifying information is relevant to its investigation of the two pharmacies; why the de-identified prescription records proposed by State Respondents are insufficient. State Respondents contend the DEA's rationale is wanting, but the Court's review shows they have not shown it is so.
First, the DEA states it uses this information to "connect the dots" between patients and other information or investigative leads already in its possession. State Respondents' argument is that the DEA could use an alternate method of investigation - a direct subpoena for those patients' information - not that the information sought is not reasonably relevant.
Next, the DEA maintains the patient-identifying information can shed light on the effectiveness of the pharmacy's overall controls on improper dispensing, such as whether the pharmacy dispensed to multiple patients who report living in the same address, to patients who used variations on the same name, or to employees of the pharmacy or other organizations of concern. State Respondents argue the DEA fails to explain why the information cannot be discerned just from the transactions - without the patient-identifying information. But, it should go without saying that without the name or address reported such information cannot be determined.
State Defendants' other argument that the pharmacist is not required to check the PDMP and the data would not show whether he/she queried the PDMP is a nonstarter. As the DEA counters, the PDMP data (which is provided by the pharmacy) shows what the pharmacy knew about its own dispensing history to patients and, thus, any improper dispensing.
Third, the DEA affirms it uses patient names to develop witnesses to interview. State Defendants do not argue the identities are irrelevant but, rather, the DEA should delay requesting such information until after it observed patterns of transactions. Of course, this confirms the information sought is reasonably relevant and nothing has been presented which convinces the Court that it should dictate when the DEA should have access to such information during its investigation.
Fourth, the DEA stresses the patient-specific information enables the DEA to obtain a full picture of a pharmacy's overall dispensing practices. The DEA does so by conducted automated analyses of the data to detect any unusual patterns, which requires the patient-identifying information. State Defendants argue the DEA "prefers complete patient data" when, in fact, its supporting declaration states this information is "necessary" for the automated analysis to be effective and complete. (ECF No. 1-1 at ¶ 30.) Further, as the DEA contends, the Court finds the DEA need not reveal its specific investigative approach or techniques to establish reasonable relevance.
There are two other issues which State Respondents raise to challenge the DEA's access to the data at issue. First, State Respondents argue HIPAA, the Health Insurance Portability and Accountability Act, may be used to evaluate the reasonableness of the DEA's request. But, as State Defendants acknowledge, HIPAA is not applicable to State Respondents. Instead, as the DEA contends, to the extent HIPAA applies and provides a useful guide, it supports the DEA's request. See 45 C.F.R. § 164.512(d) ("A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including ... civil, administrative, or criminal investigations....") Thus, this argument also fails to defeat the Petition.
As for the final issue, State Respondents argue the DEA cites to a number of cases to define relevance "more broadly," including a "fishing expedition." The Court finds it need not decide the outer contours of an administrative subpoena. It suffices to say the Court finds the record does not show the subpoenas were issued in search of a fishing expedition - nor does the DEA represent this is its intent. On the contrary, the Court finds the DEA has articulated reasons why the information is relevant to its investigation and State Respondents have not shown otherwise.
3. "Sufficiently Limited in Scope"
State Respondents argue the subpoenas are not sufficiently limited in scope because they seek more than is required for the DEA's investigative purposes, raising a number of contentions. The Court considers - and rejects - each in turn.
The DEA also refutes State Respondents' various contentions that "a whole pharmacy's entire record of prescriptions" is being sought. As the DEA asserts, it seeks only a part of the pharmacies' records - those which the pharmacies were required to report as to prescriptions for controlled substances and which the patients would have been warned would be provided to the government. Records of other prescriptions filled by the target pharmacies or of other pharmacies used by the patients are not being requested.
First, State Respondents assert the records contain medications "for which no law enforcement interest could possibly exists." But, as the DEA contends, a controlled substance with a legitimate medical purpose is still a dangerous drug and may nonetheless be abused. See 21 U.S.C. § 812 (identifying schedules of controlled substances and their potential for abuse). Moreover, the DEA is also investigating combinations of controlled substances dispensed by the pharmacies, including what may be combined with opioids. Thus, the DEA has proffered sufficient justification for such records.
Second, to the extent State Respondents assert the time period of the request (from January 2014 to the present) is not sufficiently limited, the Court finds any such argument is waived as inadequately briefed. See United States v. Banks, 884 F.3d 998, 1024 (10th Cir. 2018) (recognizing an inadequately briefed issue may be deemed waived). Even if not waived, the Court finds the DEA's rationale shows the period is reasonable: this time period reasonably covers the applicable statute of limitations, see 28 U.S.C. § 2462 (5-year time bar for civil penalties) & 18 U.S.C. § 3282 (5-year time bar for criminal penalties), and allows the DEA to assess any patterns and trends that a more limited period would not.
Finally, State Respondents assert the data set is not sufficiently limited because it includes "large numbers of patients who necessarily are within the ordinary market area of the pharmacy, and thus for which no suspicious geographic considerations would apply." (ECF No. 18, p. 31.) State Respondent's argument here focuses on the DEA's consideration of whether a patient lived an unusual distance from a pharmacy or prescriber, in evaluating whether there has been improper dispensing by a pharmacy. But, as the DEA argues, it has never suggested the only factor that would show improper prescribing is the patient's distance from the pharmacy. Instead, it is but one patient-identifying factor relevant to the DEA's inquiry of the two pharmacies. See ECF No. 1-1, ¶¶ 28-30 (patients' names may be used, for example, to reveal a patient may have been using false identity). Thus, this argument too fails to show the data requested is beyond what is reasonable.
4. Administrative Burden and All Data Requested
As stated, the subpoenas must "be sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome." Donovan, 464 U.S. at 415 (quotation marks and citation omitted). State Respondents do not contend it would be an administrative burden to comply with the subpoenas, and it appears they can readily to so.
As a final matter, State Respondents' challenge is to providing the patient-identifying information but the DEA contends other important fields have been removed in the records produced. Specifically, State Respondents have also removed other fields that would not identify patients: Drug Category, DEA Schedule, Units, and Days' Supply. Because the production of this information has not been challenged, State Defendants must also provide this data. In summary, all data requested must be produced.
B. The Motion for Hearing
The Court, after reviewing the parties' submissions and applicable law, finds no oral argument or hearing is necessary in order to rule on whether the subpoenas should be enforced. See Tiffany Fine Arts, Inc. v. United States, 469 U.S. 310, 324 n.7 (1985) (stating it was well within the district court's discretion to conclude that an evidentiary hearing on the question of enforcement of summonses was unnecessary). The issues are well briefed by the parties and there are no factual disputes which would require the presentation of any evidence relevant to the Court's consideration of the Petition. Thus, State Respondents' request for a hearing is denied.
III. CONCLUSION
In summary, the subpoenas here met the minimal requirements under the reasonable relevance standard. See Becker, 494 F.3d at 917. Accordingly, based on the foregoing, it is ORDERED
(1) That Petition for Expedited Order Enforcing Administrative Subpoenas (ECF No. 1) is GRANTED and State Respondents, with the assistance of Respondent Apriss, shall produce all requested information on or before May 15, 2020;
(2) That State Respondents' Motion for Setting of Evidentiary Hearing (ECF No. 20) is DENIED; and
(3) That the Clerk shall close this case.
DATED this 21st day of April, 2020.
BY THE COURT:
/s/_________
RAYMOND P. MOORE
United States District Judge