Oregon police violating federal HIPAA and state medical marijuana privacy laws

Jennifer Alexander, a legislative analyst for Oregon NORML, forwarded to me a complaint the organization is leveling at the Washington County Sheriff, Rob Gordon, a vocal critic of the twelve-year-old medical marijuana law.  At issue for Oregon NORML is the following part of the Oregon Medical Marijuana Act (emphasis mine):

ORS 475.331

(3) Authorized employees of state or local law enforcement agencies that obtain identifying information from the list as authorized under this section may not release or use the information for any purpose other than verification that a person IS a lawful possessor of a registry identification card or the designated primary caregiver of a lawful possessor of a registry identification card or that a location is an authorized marijuana grow site. [1999 c.4 §12; 2005 c.822 §5]

Washington County Sheriff Rob Gordon. 215 SW Adams, MS 32. Hillsboro, OR 97123. Phone: (503) 846-2700. Fax: (503) 846-2719

The first time I reported on Sheriff Rob Gordon was in October 2008.  The sheriff released to the media a map of one of the county’s largest cities, with “Red Cross / pot leaf” icons posted on the map where alleged out of compliance medical marijuana grows had been busted.  While the map didn’t give specific addresses and names, it was accurate enough that any home invader with spare time and a good sense of smell could stake out a neighborhood and find the medical marijuana growers.

The department spokesperson, Sgt. David Thompson, explains that the county knows it is violating the law, and they do not care:

With narcotics sales, or even when growers tell others about their operations, armed take-over robberies and serious assaults inevitably occur, Thompson said.

While these crimes occur in the county and throughout Oregon, the public is unlikely to know about crime trends because Oregon law says law enforcement cannot release or use OMMP participant information except to verify the person has a valid card, Thompson said.

“At this point, we are going against what the state advises,” Thompson said. “This law was designed to help sick people. But when they go out of compliance, or use the law to buy and sell marijuana, that’s not OK.”

So, while admitting that they are going against what the state “advises” (nice to know laws are just “advice” to county sheriffs), and while admitting that when grow operations are known it leads to robberies, they publish on the county sheriff’s website a map of these growsite locations.

Oregon NORML responded to that episode and others with the following:

We feel that this breach of confidentiality also violates the Federal Health Insurance Portability and Accountability Act (HIPAA), which is further supported by the OMMA’s statement of their own liability to protect the confidentiality of patient information:

The OMMP follows all Department of Human Services policies on the Health Insurance Portability and Accountability Act (HIPAA). HIPAA uses terms such as “identified data” and “de-identified” or “non-identifying data.” “Identified data” means data that can specifically identify individuals, such as name or date of birth. “De-identified” or “non-identifying data” means data that protects the identity of specific individuals. For example, a count of the number of patients currently registered with the OMMP does not allow the identification of specific individuals

Polk County Sheriff Robert Wolfe, 850 Main St, Dallas, OR 97338. Phone: 503-623-9251, Fax: 503-623-2060

Now we have another county, Polk County, engaging in even more egregious unlawful behavior, this time endangering the safety of an innocent woman and her children:

(Polk County Sheriff’s Office – no link to protect privacy) Medical Marijuana Grower Arrested for Selling Marijuana [date redacted]

Agents of the Polk Interagency Narcotics Team (POINT) served a search warrant at the residence of [name redacted by NORML, but not in the Polk County posting] at [address redacted by NORML, but not in the Polk County posting], Monmouth, Polk County, Oregon on [date redacted], following an investigation to the illegal sales of Marijuana and Prescription medications. Mr. [Name redacted], who is a registered Marijuana grower and Caregiver through the Oregon Medical Marijuana Program (OMMP), was arrested and charged with Illegal Distribution of Marijuana. The investigation concluded that Mr. [Name redacted] was illegally selling the marijuana that he was growing at his residence to non-cardholders in the Monmouth/Independence area. Detectives seized 56 growing marijuana plants, 2 firearms, 44.7 ounces of processed marijuana, 1.9 ounces of hashish, 274 tablets of prescription Percocet and several jars of marijuana butter. Mr. [name redacted]‘s wife, who is a card holding patient, was allowed to keep and maintain a user amount of marijuana at the residence. The Department of Human Services was called in to investigate the welfare of three (3) juveniles living at the residence. That investigation is ongoing.

So now the entire world knows Mrs. Name Redacted is sitting at home alone with her three kids at Address in Monmouth, Oregon, with no firearms to protect herself while her husband is in custody.  Since OMMA specifies that police can only seize that which is outside of compliance (assuming they even follow that part of OMMA), we all know she’s sitting there with no husband, no guns, and up to 6 mature marijuana plants, 18 seedlings, and a pound and a half of dried processed cannabis.

Even if Mr. Name Redacted was out of compliance, he was a registered grower and caregiver and subject to the privacy clause in OMMA.  Even if he is allegedly selling cannabis in violation of OMMA protections, he has not been convicted yet.  The police could report this as illegal marijuana growing and sales, but his registration in the medical marijuana program is not something they can release “for any purpose other than verification”, and, frankly, isn’t even germane to the story.

By letting her keep her medicine as a patient and not bringing her up on charges, the Polk County Sheriff is attempting to look compassionate.  However, what this really indicated is that Mrs. Name Redacted has had her privacy as a patient violated for no good reason whatsoever.  Perhaps she is employed somewhere that doesn’t look favorably on medical marijuana; her job isn’t protected by OMMA and they could opt to require a drug test from her tomorrow.  Perhaps her housing is federally subsidized and this news will earn her and her children an eviction notice.  Even if her husband has been using medical marijuana as a cover for illegal black market sales and she was well aware of it, that is no reason to put her home, job, and security at risk from violent criminals!

These data releases are not accidental; they are part of a conscious campaign by law enforcement to paint medical marijuana in Oregon as “out of control”.  They know medical marijuana passed here with 55% of the vote and it has only become more popular with the people over twelve years of smooth operations.  They need to orchestrate a campaign to discredit the compassion people have for the sick and disabled and the general positive support for outright legalization in Oregon among a growing majority of citizens, so they can get back to the easy statistic-padding and asset-forfeiture-booty provided by more marijuana law violation arrests.