[levinb]

Hi, I'm a former Federal LEO that has gotten warrentless access to medical records - a long time ago.

I can't speak for every agency (there are more than 100 Federal agencies with sworn officers and arrest authority, and thousands of state and local agencies), but the few times I did this in the early 2000s, even most of the HN crowd would have thought it reasonable.

I was an officer in the Coast Guard and had LE powers under two different branches of law - one public safety and one criminal. When Bad Things happened on federal waterways, my job was to first investigate threats to public safety. This comes with the power to issue a subpoena. This means we can 'compel speech' and then if you lie to us, you are in trouble.

This has more to do with what you might think the NTSB or FAA might do following an accident. The government has the right under current law to understand threats to the public. If a shipping company is currently doing something that could dump a barge full of Xylene into the bayou next to an elementary school (this is not a made up scenario, and you should look up Xylene) then there is a public interest compelling enough that we can tell people they have to sit down and tell us the truth, and the 4th amendment is not a barrier.

However, if a public safety investigation moves past 'understanding if something is a risk to the public', and individual criminal culpability appears possible, we are then required to disclose to the individuals involved that we have moved to a criminal investigation. In this case, the 4th comes back in play and warrants are required.

For me, this really only came up a couple times with individuals involved in an accident that were either using medical prescriptions ("I missed my medications, I'm not drunk") to delay us investigating a scene. Or, for a couple of injured mariners who were in the hospital at the time we showed up. We needed to go to the hospital get their version of the story and to confirm an injury; grave injuries would increase the 'level' and thus mandatory resources involved in an investigation. Also, we would need to get a witness testimony from a deckhand or something that was on a boat or facility and saw what happened (did the boat really slam into the terminal coupling or did the guy just mess up attaching it because he wasn't an officially trained Tankerman who shouldn't have been operating the equipment).

Being in the hospital or at the doctors was an excuse used more than once my companies trying to slow down inquiry into their mistakes. And yes, I think for our use case, it was completely reasonable for us to be able to call the hospital and ask "was so and so admitted last night?", just for us to find out that they were not, and went back home to mom's house to hide under orders from their captain.

Anyway, with all that said, it seems unlikely these powers are not frequently abused, even if most of the LEO community is just trying to do their job. So, tin-hat away, friends.

[pavon]

While all those are cases where LEO had legitimate reason to have access the information, none of them provide a compelling reason why a warrant couldn't be required.

The third-party doctrine has become far too broad. There are so many situations where people share information with a third party, but also expect and deserve a right to privacy regarding that information. The fact that HIPAA doesn't provide a reasonable expectation of privacy in information shared with your doctor/pharmacist is just absurd. The law does explicitly carve out these LEO exemptions, but reasonable expectation of privacy is a constitutional right, and those carve-outs should be deemed unconstitutional. And we should extend those lines with good privacy laws all around - any information that a company is required to protect under civil privacy laws should also be exempt from the third-party doctrine and require a warrant.

[jodacola]

It's not just with LEOs where patient privacy gets dodgy.

I've helped get a number of tech companies HIPAA compliant, so I've become very familiar with the workings and requirements of the act. My wife, a nurse, works in medical claim management. Lots of healthcare knowledge between us.

I've had some very interesting conversations with her because of a tool she's described being used by insurance companies: medical canvassing. It's an "interesting" tool used by investigators that doesn't technically request PHI, but can paint a picture of one's past medical care.

Basically, an investigator can ask a health care provider a bunch of yes/no questions - "did the patient receive care between $DATE1 and $DATE2?" "yes" "was the patient treated for $THING_RELEVANT_BUT_UNRELATED_TO_CLAIM?" "yes" "okay, thank you, that's all we needed." No "PHI" requested, none provided, but a picture still painted... and HIPAA allows for it.

I'm very curious to know what other interesting methods exist that allow for the circumvention of patient privacy.

[stackskipton]

>Basically, an investigator can ask a health care provider a bunch of yes/no questions - "did the patient receive care between $DATE1 and $DATE2?" "yes" "was the patient treated for $THING_RELEVANT_BUT_UNRELATED_TO_CLAIM?" "yes" "okay, thank you, that's all we needed." No "PHI" requested, none provided, but a picture still painted... and HIPAA allows for it.

How is that not PHI? You asked for treatment information and it was provided. Asking it roundabout way doesn't sidestep HIPAA.

[stevenicr]

I am aiming to help get companies HIPPA compliant and aware this next year, both changing tech stacks and educating. Would like to connect with any resources / checklists / firms / anything that could help me help others understand.

Contact in profile if willing to chat.

[levinb]

I won't belabor points I've made below, but I do want to agree with you about 3rd party doctrine in general; the modern world makes it almost impossible to live a normal life without non-consensually making your self available for full time monitoring by everyone within eyesight of you.

I think the point of this article is actually being elided over some by the conversation here though; it appears that these agencies are largely following the law. The question is, how broad should the reach of LE go given their legitimate authority?

In the current scenario, should a LEO from Idaho be allowed to see prescription records from a pharmacy in California? Should they have the right to get data from CVS about things that didn't happen in Idaho? Every prescription ever? Every doctors note?

The law as it stands allows states to determine the reproductive rights of their citizens and investigate violations thereof (note that I don't agree with the law, or the Supreme Court here). I think the question being raised by this letter is, what breadth of access should some Sheriff have over your medical records, and really, what the heck is even going on with this now?

The Dobbs case has opened up a new frontier of potential abuse, and I think the letter and article are appropriately exploring that frontier.

[chimeracoder]

As someone who also has a lot of experience in this area, I'll say that your comment is a classic example of the tactics that that LEOs use to minimize or defend abuses of power. It's actually a great case study, because it exemplifies the way that abuses of power are adopted structurally at an institutional level, while also drawing the line to how that is internalized and effected in practice by individuals. (This process is a key component of any stable system for abuse; that said, it's rare to see it illustrated so plainly).

> Being in the hospital or at the doctors was an excuse used more than once my companies trying to slow down inquiry into their mistakes. And yes, I think for our use case, it was completely reasonable for us to be able to call the hospital and ask "was so and so admitted last night?", just for us to find out that they were not, and went back home to mom's house to hide under orders from their captain.

Just because it made your job easier doesn't mean that it was legitimate. Constitutional rights, privacy laws, and case law have been created specifically to limit police power. Yes, it would be easier if cops didn't need warrants at all. No, that is not a valid argument for bypassing them.

Similarly - yes, it's common for LEOs to talk to witnesses to try and get them to incriminate themselves, either by engaging them in interactions that don't legally require a Miranda warning or by ignoring Miranda requirements altogether (which happens frequently). That doesn't justify it, either legally or ethically.

> Anyway, with all that said, it seems unlikely these powers are not frequently abused, even if most of the LEO community is just trying to do their job.

The assumption that "most LEOs are just trying to do their job" is itself questionable, given how much documentation there is of systemic abuse of police power. Even if it weren't, that isn't a valid defense when the government has explicitly placed restraints on the ways LEO can do their job (to say nothing of the broader question of the legitimacy of that job in the first place).

[levinb]

> Just because it made your job easier doesn't mean that it was legitimate.

So, I suppose that the main point. In these cases, we weren't investigating the individual as a suspect, we were trying to understand the nature of an incident that could affect the safety of others in a relatively linear fashion.

Imagine it's 20 years ago, there's no cameras everywhere, GPS is limited to multi-meter precision - did the 50-barge tow coming down the Mississipi river with millions of tons of cargo hit the interstate bridge broadside or did it just scrape it? There's a big pylon-shaped dent in the side of a naptha barge with cement dust on it, but the captain swears he just glanced it with the grain barge at the head of the tow. It's ancient and looks like it's battered 100 docks in the past year.

So, Mr. Deckhand, what hit the bridge?

In this scenario, he is not responsible for navigating the vessel, so we assume that it's unlikley that this would evolve into an investigation that would jeopardize him. And thus are free to issue a subpoenea if needed to find out if we need to shut down the only passage over the Mississippi for 100 miles.

I think it's fair that the public has the right to his honesty in this scenario.

Of course, these powers present the potential for abuse, and I'm sure it happens. Just not in the world I ever operated in; our powers and obligations were taken very seriously internally.

[chimeracoder]

> So, I suppose that the main point. In these cases, we weren't investigating the individual as a suspect, we were trying to understand the nature of an incident that could affect the safety of others in a relatively linear fashion.

That doesn't matter. You're still talking about accessing private, sensitive data about an individual.

> I think it's fair that the public has the right to his honesty in this scenario.

Yes, and that's exactly why warrants exist. The courts are specifically responsible for determining the outcome of cases in which private rights potentially conflict with public ones (or with private rights of other parties).

> Of course, these powers present the potential for abuse, and I'm sure it happens. Just not in the world I ever operating in; our powers and obligations were taken very seriously internally.

Having worked extensively in this area, I'll be blunt and say: anytime someone who works in law enforcement says that there are no abuses of power in their workplace, that means either they were so oblivious that they never saw abuses that are occurring around them, or they were so mired in the system that they are incapable of recognizing the abuses of power that they themselves are participating in.

Out of charity, I'll assume the former. But to be honest, every time I've spoken at length about this with LEOs, it's inevitably turned out to be the latter.

[levinb]

> Out of charity, I'll assume the former. But to be honest, every time I've spoken at length about this with LEOs, it's inevitably turned out to be the latter.

I am sure this is often true at the local LE level. But remember, they deal almost entirely with criminal investigations about individuals for things that do not present a broader risk to the public (beyond their continued individual behavior).

In our case, we are not reifying 'the drug menace' to a public level; we are trying to find out if a barge is full of vegetable oil or an explosive polymerization agent. And in those cases, no, I don't think your rights to privacy supersede our obligation to understand if there's a major threat to other people.

> That doesn't matter. You're still talking about accessing private, sensitive data about an individual.

This is true and I can assure you I know quite a bit about what can be in people medical records (I am a MD who has worked extensively in medical records exchange and machine learning). I don't think accessing this kind of data should be possible without genuine need.

> Yes, and that's exactly why warrants exist.

In our case at least, warrants wouldn't even make sense. We were not conducting criminal investigations and asking for access to pursue a person against their will, in response to a crime. We were trying to find out about near-term threats to other people.

I think you and I probably agree on the spirit here - it's just that in our case (and cases like the NTSB or FAA) there are compelling public interests that supersede someones right to privacy. Finding out if you were prescribed benzos so I can charge you for some garbage possession misdemeanor is not one; finding out if there's 30,000 barrels of explosive leaking under a highway is.

No?

[chimeracoder]

> In our case at least, warrants wouldn't even make sense. We were not conducting criminal investigations and asking for access to pursue a person against their will, in response to a crime. We were trying to find out about near-term threats to other people....Finding out if you were prescribed benzos so I can charge you for some garbage possession misdemeanor is not one; finding out if there's 30,000 barrels of explosive leaking under a highway is.

Nothing you have said, in this comment or in the rest of the thread, refutes the point that warrants are the mechanism by which the legal system intermediates this power. It's quite telling that even in a completely constructed example chosen for the discussion at hand, you're not actually making a case that cops need access to people's medical information without a warrant.

> I think you and I probably agree on the spirit here - it's just that in our case (and cases like the NTSB or FAA) there are compelling public interests that supersede someones right to privacy.

No, I'm saying that it is literally not your job as a member of law enforcement to decide when the public interest "supersedes" someone's right to privacy. That's what a judge is for. That's why warrants exist.

[stackskipton]

Yes, No.

  there are compelling public interests that supersede someones right to privacy.

This is road to hell path paved with good intentions. All crime has compelling public interests to be prevented. Using that logic, cops should be able to search everywhere. It's compelling public interest to stop people who do bad things.

[caskstrength]

> And in those cases, no, I don't think your rights to privacy supersede our obligation to understand if there's a major threat to other people.

> No?

No.

[yieldcrv]

Just because you couldn't think of a tool to "understand the nature of an incident that could affect the safety of others" doesn't mean it legitimizes your department policy or personal tactics

I would be 100% fine with stripping that group of this discretion, sanctioning them, and sending them back to the drawing board on how to "understand the nature of incidents that could affect the safety of others", aka investigate.

[ralph84]

Checks and balances are essential to the American way of government. Law enforcement should have to follow the Constitution, which means dealing with the check of obtaining a warrant. If the reason is really that compelling you’ll have no problem convincing a judge or magistrate.

[levinb]

I guess that's the point I was trying to make - in our case we were not conducting a criminal investigation. And if we were headed that way (which only happened every once in a while) then yes, we'd have to go in to Criminal Mode rather than Public Safety mode, and 4th and 5th Amendment obligations where back on.

[jkaplowitz]

Wouldn’t 5th amendment self-incrimination protections be in place even if the compelled questioning is purely part of a public safety investigation? Those protections are not about whether the particular kind of questioning is itself a criminal investigation but instead about whether the person is being compelled by the government to give answers that could tend to incriminate them.

For example, maybe your concern is just how fast and recklessly a boat was going with the goal of figuring out if they are a threat to fresh into another boat, but maybe the person doesn’t want to open themselves up for Boating Under the Influence or Controlled Substances Act criminal charges (whether or not they are legally guilty).

5th amendment self-incrimination protections apply even in compelled congressional testimony and routine tax return filing obligations, which are definitely not criminal investigations.

4th amendment protections also apply well beyond the criminal context, although I can well believe that your public safety investigations may have fallen into a judicially recognized exception. For a legally very clear example, no law can constitutionally authorize an LEO to nonconsensually conduct a warrantless suspicionless search of someone’s home to see if they might have failed to pay any applicable taxes or duties on any imported cigarettes which they may happen to have present there.

(Emphasis on suspicionless - the legal answer would probably be very different if the LEO sees someone transporting a pallet of imported cigarettes from the home into a truck in their driveway following having received a tip from the FedEx customs clearance people, even if there’s no time for a warrant. But there’s no constitutional reason for any investigation like this, whether about criminally intentional tax evasion or merely noncriminal accidental tax underpayment, to be occurring without suspicion.)

[johnnyo]

I think the interest here is less about how it was used in the past, and how it might be used in the future.

With changing landscape of laws related to things like abortion and transgender rights, people are rightly worried that a zealous prosecutor in one state will subpoena for records of things like abortion drugs or hormone blockers, and use that data to start harassing or prosecuting people.

It sounds like it would be feasible for a prosecutor to ask for a list of all patients currently prescribed hormone blockers and then open child welfare cases against all those families across an entire state.

[selimthegrim]

Why do I get the feeling this (xylene) happened in southern Louisiana?