HIPAA and the Criminal Investigation

The Limbaugh investigation began after two informants told law enforcement authorities information that led them to believe Limbaugh might have violated Florida's “doctor shopping” statute. That statute prohibits a person from obtaining controlled substances from more than one practitioner without disclosing all relationships with other medical practitioners from whom he's gotten prescriptions. All prescribing practitioners must be registered under the controlled substance laws. Here, the informants told investigators that Limbaugh had obtained prescriptions from four sources over the course of five months.

The police obtained a warrant from a judge, which they served on Limbaugh's physicians and a clinic he had patronized. Limbaugh had not yet been charged with any crime when the warrant was issued. Surprisingly, all Limbaugh's health care providers, without resistance, turned over the entirety of his medical records.

The Unusual Issue

This case concerns a compelling collision between the subpoena powers of search and seizure through a search warrant against the backdrop of rights to medical privacy. The issue in the case turns on the interpretation of various Florida statutes intended to provide privacy of medical records as opposed to various Florida statutes about search warrants. Which right wins in a criminal investigation where the target has not been charged and there is no case yet underway? And, what about HIPAA? This Act created an affirmative duty for health care providers to notify a patient when there may be releases of protected health care information, and state health information privacy statutes are not pre-empted by HIPAA if they make release of such information more difficult than under the federal law.

Obviously, a Florida appellate court case ranks low in legal hierarchy, but how this court engaged in the analysis will, most certainly, guide other courts, which may have a much wider and broader influence. Further, in criminal investigations, there seems to be a tendency for law enforcement increasingly to delve into places where no law enforcement has previously gone. HIPAA may affect some of theses forays.

Limbaugh's Reaction

The search warrants issued by investigators to Limbaugh's health care providers were specific to Limbaugh, but were otherwise very broad, seeking:

• Records specifically and only pertaining to [Limbaugh] including the medical records;
• Medical questionnaire, cash receipts, sections of appointment book pertaining to [Limbaugh];
• Canceled checks, medical insurance forms submitted or prepared to be submitted to insurance companies; and
• Computerized records related to the ordering of narcotics, DEA prescriptions numbers and forms, records of dispersing or issuing prescriptions for controlled substances, written and or computerized pertaining only to [Limbaugh].

When the police received the records, they placed them under seal, and the State Attorney sent the following notice to Limbaugh's attorney: “The State is presently investigating a possible violation of Florida State Statute 893.13 against your client. Pursuant to Florida State Statute 395.3025(4)(d) and F.S.S. 933, the State has seized through a lawfully obtained search warrant the medical records and/or files of your client.” Further, the State proposed to unseal the medical records in ten days “without viewing any of the contents in the presence of the administrator or doctor pending your opportunity to be heard on your client's right [sic] privacy issues, in reference to the ongoing investigation.”

Limbaugh immediately moved to quash, claiming that this warrant was issued in bad faith since there was no prior notice to him that his medical records were going to be released to anyone. When the circuit court judge refused to grant any relief, Limbaugh appealed. Limbaugh v. Florida, 2004 Fla. App. LEXIS 14653 *37 n.14, 29 Fla. L. Weekly D 2213 (4th Dist. 2004). Because there was no matter pending and Limbaugh had not yet been charged, the appellate court was also limited in the relief it would be able to provide.

The Basis for Appeal

Florida's Constitution is quite specific: “[E]very natural person has the right to be let alone and free from governmental intrusion into the person's private life except as otherwise provided herein.” Art I, ' 23, Fla Const. (1980) (privacy amendment). It was this language Limbaugh wanted the appellate court to follow, limiting the state's intrusion into his medical affairs free from a law enforcement inquisition.

Limbaugh pointed to Florida's medical record subpoena statutes as authority for the proposition that he was entitled to notice and a hearing before the state could examine his medical records. The two statutes he cited, Fla. Stat. ' 395.3025(4)(d), (2003) and Fla. Stat. ' 456.057(5)(a)3, (2003), are similar in wording: ' 395.3025(4)(d) states: “Patient records are confidential and must not be disclosed without the consent of the person to whom they pertain, but appropriate disclosure may be made without such consent … in any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice by the party seeking such records to the patient or his or her legal representative”; ' 456.057(5)(a)3 states: “Except as otherwise provided in this section and in ' 440.13(4)(c), such records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient or the patient's legal representative or other health care practitioners and providers involved in the care or treatment of the patient, except upon written authorization of the patient. However, such records may be furnished without written authorization … in any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to the patient or the patient's legal representative by the party seeking such records.”

The statutes created a duty for health care providers to recognize a right of privacy in medical records. Moreover, the statutes forbid outsiders from subpoenaing medical records from medical providers without prior notice to the patient. The operative effect of the statutes, however, resides in the subdivisions limiting the use of subpoenas for medical records; not one word is said in them about criminal investigations.

Generally, a subpoena is a legal order that compels a person to come to court or commands a possessor to produce things. In distinction, though, a search warrant is a court order that permits the State to enter premises, to make a search for particularized items, which if found, are to then be seized and to be used as evidence. In this case, the state proceeded by search warrant. Often, no court intervention or supervision is required for a subpoena, whereas only judicial officials may issue search warrants. 2004 Fla. App. LEXIS 14653, *16. The Florida search warrant statutes did not exclude or in any way exempt medical records from the warrant powers.

The appellate court, therefore, ultimately upheld the lower court's ruling, reasoning that the Florida Legislature's purpose in enacting the subpoena statutes was not connected to search warrants. The state's authority to seize defendant's medical records by a validly issued search warrant was unaffected by any right of privacy in such records. Because the search warrant was validly issued by a judge, there was no invasion of Limbaugh's zone of privacy. Without equivocation, the Florida appellate court stated, “[t]he right to privacy has no application to constitutionally valid search and seizure.”

Interestingly, the court, in denying Limbaugh's motion, did not prohibit Limbaugh from having the issuing judge examine the records to ensure that all the records produced fell within the scope of the warrants, and to seek other protective relief to prevent improper disclosures to third parties of records irrelevant to the prosecution – essentially, the very relief Limbaugh sought.

The Dissent

Judge Melanie G. May dissented, observing that in the majority's denial it allowed the very review the petitioner sought. Moreover, the Judge was concerned that the legislature had not created an exception for medical records when it allowed for the seizure of property. She noted that under HIPAA there is a “trend to enhance, not eliminate, the privacy afforded to patients and their medical records.” In addition, Judge May supported the protected status of medical records, writing, “[W]hether they are obtained by means of a subpoena or a warrant, their protected status remains the same.”

Judge May observed that search warrant laws “were not designed to set the parameters of 'disclosure' of items otherwise protected by our constitution.” In his view, a magistrate's determination of what might appear relevant at the time a warrant is issued is insufficient to protect an individual's right to privacy in their medical records. Only when the records have actually been seized can a full, fair, and specific determination of relevancy be made.

In Limbaugh, the warrant was non-specific, seeking “medical records,” not “medical records related to prescriptions,” the Judge reasoned. Here, Judge May showed considerable insight about medical practice habits and health care professionals' lack of sophistication in the ways of the law, stating, “[T]he medical providers, professional in medicine, are but lay persons in the law. They bundled up all of the medical … records … even those irrelevant to the crime under investigation … and turned them over to the State.”

To fail to provide Limbaugh with the relief he sought denied him protection, since his “privacy interest in his medical records are forever lost,” the Judge wrote. He noted that a post-seizure hearing would be of little value in this regard. Justice May advocated a new procedure: “[W]hen medical records are the subject of a search warrant, it would be a better practice for the State to keep the warrant and the accompanying affidavit under seal until an impartial magistrate is able to determine relevancy.”

The Future for Medical Privacy

Does medical information differ in some way from telephone records, electronic surveillance, or other forms of intrusive police investigatory techniques? Which one of us would like a judge to read our personal medical records, to cull through them visit by visit, to then decide which records the police are entitled to and only then protect the rest? Then again, is medical data so different from other personal information?

Under a recent District Court holding in which the court examined the physician's duty to the patient in responding to a subpoena, Limbaugh's physicians might have been held to have violated HIPAA's notification provisions. Law v. Zuckerman, 2004 U.S. Dist. LEXIS 3755 (D.MD. 2004). However, Law v. Zuckerman was a civil, not a criminal matter, so the debate goes on.

It is interesting how the police proceeded here since, under federal Drug Enforcement Administration law and Florida law, they could have initiated their investigation of Limbaugh by examining the medical licensees' medical records for violations of controlled substance law. As a quid pro quo for medical licensure, licensees agree to cooperate in such investigations, and the investigators do not need probable cause (or any cause, for that matter). Those statutes tend to be far more liberal and allow investigators wide latitude. Investigators simply obtain an investigative subpoena from the licensing agency and they then have access to virtually any record they wish.

Many states engage in compliance checks where investigators simply examine files to make sure that licensees are prescribing controlled substances for legitimate medical purposes. Had the Florida officials preliminarily proceeded in this fashion, they might have completely avoided this confrontation.

Regardless, the bottom line is that health care professionals are liable for wrongful disclosure of protected health care information under HIPAA and various state statutes. Not knowing the law will not excuse them if they give medical records up to the wrong person without meeting appropriate statutory requirements.

But the erosion of privacy by medical record releases such as the one that occurred here are not a thing of the past, as many practitioners and their patients might have thought. Although this is, admittedly, a broad generalization, law enforcement appears to be pushing the outer limits in its quest to pursue justice. The general rule remains, however, that privacy, no matter how important, is a shield and never a sword. The government's powers remain potent to investigate wrongdoing. Clearly, one obvious factor influenced how the police proceeded and the court reacted: there was no prosecution underway.

Conclusion

It's certain that the last word on this issue has not yet been heard. Justice May's dissent makes that clear. The trend toward providing more privacy regarding patient records is still in its infancy, and higher courts than the that in Limbaugh will surely be making important new law that medical care providers would be wise to keep abreast of.

As medical practitioners and the attorneys who defend (or sue) them have learned over the last few years, health care professionals are liable for wrongful disclosure of protected health care information under HIPAA and various state statutes. Health Insurance Portability and Accountability Act, Pub. L. No. 104-191, 110 Stat. 1936 (1996) (amending, Employee Retirement Income Security Act of 1974, 29 U.S.C. 1001-1461 (1994) (ERISA). Lack of sophistication of the law in this area is no excuse for turning over medical records to unauthorized recipients, and appropriate statutory requirements must always be met. But it's not always easy to tell when those safeguards on patient privacy are paramount and when other considerations might trump them. A recent case offers an interesting permutation on the question by asking: When can law enforcement authorities access medical records without the patient's authorization? The wrong answer could leave the health care facility or provider that hands over patient records vulnerable to liability for unauthorized release.

The Rush Limbaugh Investigation

Rush Limbaugh, the famous radio talk show host, is also famous for having been suspected of going to several doctors in order to get duplicate prescriptions for pain relievers that are controlled substances.

The Limbaugh investigation began after two informants told law enforcement authorities information that led them to believe Limbaugh might have violated Florida's “doctor shopping” statute. That statute prohibits a person from obtaining controlled substances from more than one practitioner without disclosing all relationships with other medical practitioners from whom he's gotten prescriptions. All prescribing practitioners must be registered under the controlled substance laws. Here, the informants told investigators that Limbaugh had obtained prescriptions from four sources over the course of five months.

The police obtained a warrant from a judge, which they served on Limbaugh's physicians and a clinic he had patronized. Limbaugh had not yet been charged with any crime when the warrant was issued. Surprisingly, all Limbaugh's health care providers, without resistance, turned over the entirety of his medical records.

The Unusual Issue

This case concerns a compelling collision between the subpoena powers of search and seizure through a search warrant against the backdrop of rights to medical privacy. The issue in the case turns on the interpretation of various Florida statutes intended to provide privacy of medical records as opposed to various Florida statutes about search warrants. Which right wins in a criminal investigation where the target has not been charged and there is no case yet underway? And, what about HIPAA? This Act created an affirmative duty for health care providers to notify a patient when there may be releases of protected health care information, and state health information privacy statutes are not pre-empted by HIPAA if they make release of such information more difficult than under the federal law.

Obviously, a Florida appellate court case ranks low in legal hierarchy, but how this court engaged in the analysis will, most certainly, guide other courts, which may have a much wider and broader influence. Further, in criminal investigations, there seems to be a tendency for law enforcement increasingly to delve into places where no law enforcement has previously gone. HIPAA may affect some of theses forays.

Limbaugh's Reaction

The search warrants issued by investigators to Limbaugh's health care providers were specific to Limbaugh, but were otherwise very broad, seeking:

• Records specifically and only pertaining to [Limbaugh] including the medical records;
• Medical questionnaire, cash receipts, sections of appointment book pertaining to [Limbaugh];
• Canceled checks, medical insurance forms submitted or prepared to be submitted to insurance companies; and
• Computerized records related to the ordering of narcotics, DEA prescriptions numbers and forms, records of dispersing or issuing prescriptions for controlled substances, written and or computerized pertaining only to [Limbaugh].

When the police received the records, they placed them under seal, and the State Attorney sent the following notice to Limbaugh's attorney: “The State is presently investigating a possible violation of Florida State Statute 893.13 against your client. Pursuant to Florida State Statute 395.3025(4)(d) and F.S.S. 933, the State has seized through a lawfully obtained search warrant the medical records and/or files of your client.” Further, the State proposed to unseal the medical records in ten days “without viewing any of the contents in the presence of the administrator or doctor pending your opportunity to be heard on your client's right [sic] privacy issues, in reference to the ongoing investigation.”

Limbaugh immediately moved to quash, claiming that this warrant was issued in bad faith since there was no prior notice to him that his medical records were going to be released to anyone. When the circuit court judge refused to grant any relief, Limbaugh appealed. Limbaugh v. Florida, 2004 Fla. App. LEXIS 14653 *37 n.14, 29 Fla. L. Weekly D 2213 (4th Dist. 2004). Because there was no matter pending and Limbaugh had not yet been charged, the appellate court was also limited in the relief it would be able to provide.

The Basis for Appeal

Florida's Constitution is quite specific: “[E]very natural person has the right to be let alone and free from governmental intrusion into the person's private life except as otherwise provided herein.” Art I, ' 23, Fla Const. (1980) (privacy amendment). It was this language Limbaugh wanted the appellate court to follow, limiting the state's intrusion into his medical affairs free from a law enforcement inquisition.

Limbaugh pointed to Florida's medical record subpoena statutes as authority for the proposition that he was entitled to notice and a hearing before the state could examine his medical records. The two statutes he cited, Fla. Stat. ' 395.3025(4)(d), (2003) and Fla. Stat. ' 456.057(5)(a)3, (2003), are similar in wording: ' 395.3025(4)(d) states: “Patient records are confidential and must not be disclosed without the consent of the person to whom they pertain, but appropriate disclosure may be made without such consent … in any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice by the party seeking such records to the patient or his or her legal representative”; ' 456.057(5)(a)3 states: “Except as otherwise provided in this section and in ' 440.13(4)(c), such records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient or the patient's legal representative or other health care practitioners and providers involved in the care or treatment of the patient, except upon written authorization of the patient. However, such records may be furnished without written authorization … in any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to the patient or the patient's legal representative by the party seeking such records.”

The statutes created a duty for health care providers to recognize a right of privacy in medical records. Moreover, the statutes forbid outsiders from subpoenaing medical records from medical providers without prior notice to the patient. The operative effect of the statutes, however, resides in the subdivisions limiting the use of subpoenas for medical records; not one word is said in them about criminal investigations.

Generally, a subpoena is a legal order that compels a person to come to court or commands a possessor to produce things. In distinction, though, a search warrant is a court order that permits the State to enter premises, to make a search for particularized items, which if found, are to then be seized and to be used as evidence. In this case, the state proceeded by search warrant. Often, no court intervention or supervision is required for a subpoena, whereas only judicial officials may issue search warrants. 2004 Fla. App. LEXIS 14653, *16. The Florida search warrant statutes did not exclude or in any way exempt medical records from the warrant powers.

The appellate court, therefore, ultimately upheld the lower court's ruling, reasoning that the Florida Legislature's purpose in enacting the subpoena statutes was not connected to search warrants. The state's authority to seize defendant's medical records by a validly issued search warrant was unaffected by any right of privacy in such records. Because the search warrant was validly issued by a judge, there was no invasion of Limbaugh's zone of privacy. Without equivocation, the Florida appellate court stated, “[t]he right to privacy has no application to constitutionally valid search and seizure.”

Interestingly, the court, in denying Limbaugh's motion, did not prohibit Limbaugh from having the issuing judge examine the records to ensure that all the records produced fell within the scope of the warrants, and to seek other protective relief to prevent improper disclosures to third parties of records irrelevant to the prosecution – essentially, the very relief Limbaugh sought.

The Dissent

Judge Melanie G. May dissented, observing that in the majority's denial it allowed the very review the petitioner sought. Moreover, the Judge was concerned that the legislature had not created an exception for medical records when it allowed for the seizure of property. She noted that under HIPAA there is a “trend to enhance, not eliminate, the privacy afforded to patients and their medical records.” In addition, Judge May supported the protected status of medical records, writing, “[W]hether they are obtained by means of a subpoena or a warrant, their protected status remains the same.”

Judge May observed that search warrant laws “were not designed to set the parameters of 'disclosure' of items otherwise protected by our constitution.” In his view, a magistrate's determination of what might appear relevant at the time a warrant is issued is insufficient to protect an individual's right to privacy in their medical records. Only when the records have actually been seized can a full, fair, and specific determination of relevancy be made.

In Limbaugh, the warrant was non-specific, seeking “medical records,” not “medical records related to prescriptions,” the Judge reasoned. Here, Judge May showed considerable insight about medical practice habits and health care professionals' lack of sophistication in the ways of the law, stating, “[T]he medical providers, professional in medicine, are but lay persons in the law. They bundled up all of the medical … records … even those irrelevant to the crime under investigation … and turned them over to the State.”

To fail to provide Limbaugh with the relief he sought denied him protection, since his “privacy interest in his medical records are forever lost,” the Judge wrote. He noted that a post-seizure hearing would be of little value in this regard. Justice May advocated a new procedure: “[W]hen medical records are the subject of a search warrant, it would be a better practice for the State to keep the warrant and the accompanying affidavit under seal until an impartial magistrate is able to determine relevancy.”

The Future for Medical Privacy

Does medical information differ in some way from telephone records, electronic surveillance, or other forms of intrusive police investigatory techniques? Which one of us would like a judge to read our personal medical records, to cull through them visit by visit, to then decide which records the police are entitled to and only then protect the rest? Then again, is medical data so different from other personal information?

Under a recent District Court holding in which the court examined the physician's duty to the patient in responding to a subpoena, Limbaugh's physicians might have been held to have violated HIPAA's notification provisions. Law v. Zuckerman, 2004 U.S. Dist. LEXIS 3755 (D.MD. 2004). However, Law v. Zuckerman was a civil, not a criminal matter, so the debate goes on.

It is interesting how the police proceeded here since, under federal Drug Enforcement Administration law and Florida law, they could have initiated their investigation of Limbaugh by examining the medical licensees' medical records for violations of controlled substance law. As a quid pro quo for medical licensure, licensees agree to cooperate in such investigations, and the investigators do not need probable cause (or any cause, for that matter). Those statutes tend to be far more liberal and allow investigators wide latitude. Investigators simply obtain an investigative subpoena from the licensing agency and they then have access to virtually any record they wish.

Many states engage in compliance checks where investigators simply examine files to make sure that licensees are prescribing controlled substances for legitimate medical purposes. Had the Florida officials preliminarily proceeded in this fashion, they might have completely avoided this confrontation.

Regardless, the bottom line is that health care professionals are liable for wrongful disclosure of protected health care information under HIPAA and various state statutes. Not knowing the law will not excuse them if they give medical records up to the wrong person without meeting appropriate statutory requirements.

But the erosion of privacy by medical record releases such as the one that occurred here are not a thing of the past, as many practitioners and their patients might have thought. Although this is, admittedly, a broad generalization, law enforcement appears to be pushing the outer limits in its quest to pursue justice. The general rule remains, however, that privacy, no matter how important, is a shield and never a sword. The government's powers remain potent to investigate wrongdoing. Clearly, one obvious factor influenced how the police proceeded and the court reacted: there was no prosecution underway.

Conclusion

It's certain that the last word on this issue has not yet been heard. Justice May's dissent makes that clear. The trend toward providing more privacy regarding patient records is still in its infancy, and higher courts than the that in Limbaugh will surely be making important new law that medical care providers would be wise to keep abreast of.