Medical Marijuana: Is Your Health Information Privacy Going to Pot?
By John Henry Wright, Esq.
Imagine teams of law enforcement agents, including officers from local police departments and the Federal Drug Enforcement Agency (DEA) showing up at your door and requesting to enter your home to conduct a search simply because you have been issued a medical marijuana card (MMJ card) by the Nevada Department of Health and Human Services (NDHHS). One of the many problems with this scenario is that under applicable state law, except for the limited purpose of verifying a claim of authorization, law enforcement is not supposed to know who is a registered MMJ card holder.
Nevada’s Medical Marijuana Registry.
Article 4, Section 38 of the Nevada Constitution requires the legislature to promulgate laws for “a registry of patients, and their attendants, who are authorized to use the plant for medical purpose, to which law enforcement officers may resort to verify a claim of authorization, and which is otherwise confidential.”
Chapter 453A of the Nevada Revised Statutes governs medical use of marijuana. Medical marijuana patients must submit an application to NDHHS to obtain a MMJ card. NRS 453A.210. Upon approval of an application, NDHHS issues a serially numbered MMJ card to the applicant and, if the applicant designates a primary caregiver, to the designated primary caregiver. NRS 453A.220 & 453A.250. NDHHS is required to maintain the confidentiality of the name and other identifying information of any person who has applied for or has obtained a registry identification card. NRS 453A.700. Further, the information is not subject to a subpoena or discovery in a legal proceeding.Id. Exceptions to the confidentiality requirement allow NDHHS to provide authorized employees of NDHHS, or its designee, information necessary to perform official duties and authorized employees of state and local law enforcement agencies, but only as necessary to verify that a person is a lawful holder of a MMJ card. Id.
NDHHS’s Duty To Protect Patient’s Health Information.
The right to make decisions regarding one’s own bodily integrity and medical treatment is embraced in both federal and state constitutional privacy rights. The right of privacy has two main aspects: (1) the general law of privacy, which affords a tort action for damages for unlawful invasions of privacy; and (2) the constitutional right of privacy, which protects personal privacy against unlawful governmental invasion. There are two classes of privacy interests: (1) interest in precluding dissemination or misuse of sensitive and confidential information; and (2) the interest in making intimate personal decisions or conducting personal activities without observation, intrusion or interference.
Article 4, Section 38 of the Nevada Constitution, not only explicitly states that the information is confidential, and therefore subject to rights of privacy, it also makes it clear that law enforcement officers are only allowed access to the information to verify that the cardholder is authorized to have marijuana in his or her possession. Further, the verification is only allowed when the cardholder makes a “claim of authorization,” meaning that if a person is stopped while in possession of marijuana and actually makes a claim of authorization, the officer can then verify the validity of the cardholder’s authorization to possess medical marijuana. NRS 453.700 further limits type of law enforcement that can access the database to “state and local law enforcement agencies.”
Beyond this, the Health Insurance Portability and Accountability Act (HIPAA) also requires protection of protected health information (PHI). Under HIPAA, covered entities are required to protect PHI by implementing specific security standards which include both physical and technical safeguards. Technical safeguards include access control, audit controls, information integrity protection, entity authentication, and transmission security.
While covered entities are generally defined as health plans, health care providers, and health care clearinghouses, there are some instances where state, county, or municipal entities are classified as “hybrid entities” when the governmental entity handles PHI. Here, NDHHS certainly deals with PHI, and its function dealing with a person’s medical condition makes it a covered hybrid entity under HIPAA. See “HIPAA’s Privacy and Security Rules and Their Effect on Local Governments.”Municipal Lawyer, March/April 2005.
There are exceptions whereby law enforcement will be able to access information, See 45 C.F.R 164.512, et seq. However, none of those exceptions would encompass a “compliance check” inquiry or a proactive investigation of the type conducted by teams of law enforcement officials identified by the acronym “SCORE,” which is a joint task force funded by the White House under the High Intensity Drug Trafficking Areas (HIDTA) program. There are currently 28 HIDTAs in the U.S. that assess drug trafficking threats in their defined areas, develop strategies to address threats, design initiatives to implement strategies, propose funding needed to carry out the initiatives, and prepare annual reports describing their performances. A central feature of the HIDTA program is the discretion granted to the Executive Boards to design and implement initiatives that confront drug trafficking threats in each HIDTA.
NDHHS’s Failure to Protect MMJ Cardholders from Improper Government Action.
Arguably, there is a failure on the part of NDHHS to implement adequate technical safeguards to protect the PHI of MMJ card holders, which promotes a proactive versus reactive search of the registry and violates present law by allowing law enforcement access to the information without the cardholder’s knowledge or authorization.
The patient database is searchable in two ways: First, by the number on the MMJ card, which would require the officer to interact with the patient and the patient to make a “claim of authorization” by providing the card and/or number to allow the officer to verify the claim. Because the database only shows a patient number and effective dates, the patient is protected from unlawful disclosure of confidential medical information, a goal both of HIPAA and state law. Unfortunately, there appears to be a back door approach for law enforcement to access the database via a person’s driver license number. Since police already have ready access to driver license databases, the officer does not have to interact with a patient to determine if he is a cardholder. This loophole could leave the unwitting MMJ cardholder open to searches and criminal prosecution.
In a recent Nevada Eighth Judicial District Court case, the Clark County District Attorney’s Office filed a criminal complaint against a cardholder for possessing a firearm while being a cardholder. The special task force went to the cardholder’s home to conduct a compliance check, peered through the window, and saw firearms on the floor. An officer then checked with the NDHHS website and learned that the homeowner had an MMJ card. Using this information, the officer convinced a judge to sign a search warrant for the card holder’s home. The basis of the warrant was, “As an admitted chronic user of the controlled substance marijuana, which is admitted by being a medical marijuana patient, [homeowner] is prohibited from possessing firearms.”
The U.S. and Nevada Constitutions guarantee the right of privacy to all citizens. Likewise, HIPAA is intended to protect PHI and mandates specific procedures covered entities must implement to afford those protections. Yet, inadequately implemented security controls maintained by NDHHS are subject to exploitation in violation of cardholders’ constitutional rights to privacy.
As Nevada, like many other states, is embarking on relatively uncharted legal ground, battles regarding unlawful searches and seizures and improper access and use of health information will inevitably have to be resolved by the courts.
John Henry Wright, Esq. is an attorney practicing in Las Vegas in the areas of commercial litigation, criminal defense, and cannabis law.
“This article was originally published in the Communiqué, the official publication of the Clark County Bar Association (May 2015). https://www.clarkcountybar.org/communique/may-2015/
Wright Law Group P.C.
♦ John Henry Wright
♦ 2340 Paseo Del Prado
♦ Building D Suite 305
♦ Las Vegas, NV 89102
♦ 702.405.0001