Police/DHS can spy on your medical & financial records

Print Friendly, PDF & Email

The Health Insur­ance Porta­bil­i­ty & Account­abil­i­ty Act (HIPPA) is the pri­ma­ry fed­er­al law that address­es health records.

The HIPAA pri­va­cy rules have spe­cial excep­tions for law enforce­ment and nation­al secu­ri­ty investigations.

The law enforce­ment pro­vi­sion is very broad. It cov­ers all the usu­al police pro­ce­dures, includ­ing sub­poe­nas. Those don’t require a judge’s advance per­mis­sion, and they also require much less basis than prob­a­ble cause.

Big Broth­er is col­lect­ing out baby pic­tures, med­ical records, resumes & our chil­dren’s DNA.

Click here to read more.

The nation­al secu­ri­ty excep­tion is even broader.

A cov­ered enti­ty may dis­close pro­tect­ed health infor­ma­tion to autho­rized fed­er­al offi­cials for the con­duct of law­ful intel­li­gence, counter-intel­li­gence, and oth­er nation­al secu­ri­ty activ­i­ties autho­rized by the Nation­al Secu­ri­ty Act (50 U.S.C. 401, et seq.) and imple­ment­ing author­i­ty (e.g., Exec­u­tive Order 12333).

Unit­ed States v. Miller held that rou­tine finan­cial records are not pro­tect­ed by the Fourth Amend­ment. Two years lat­er, Con­gress passed the Right to Finan­cial Pri­va­cy Act… which large­ly cod­i­fied Miller. Law enforce­ment agen­cies can still access finan­cial records with just a subpoena.

RFPA includes a spe­cial set of nation­al secu­ri­ty pro­ce­dures. Fed­er­al grand jury sub­poe­nas and war­rants aren’t cov­ered by RFPA, so long as the inves­ti­gat­ing agency self-cer­ti­fies “there may result a dan­ger to the nation­al secu­ri­ty of the Unit­ed States.”

RFPA also includes a Nation­al Secu­ri­ty Let­ter pro­vi­sion. In counter-intel­li­gence and counter-ter­ror­ism inves­ti­ga­tions, the FBI (and, by proxy, the NSA) doesn’t even need a grand jury sub­poe­na. It can demand finan­cial records with a mere self-certification.

A plain read­ing of RFPA sug­gests some pri­va­cy pro­tec­tion: tar­gets receive advance notice of a sub­poe­na and have an oppor­tu­ni­ty to con­test the sub­poe­na. In every­day prac­tice, how­ev­er, RFPA’s delayed notice pro­vi­sions have swal­lowed the rule. Law enforce­ment agen­cies rou­tine­ly obtain court orders that both elim­i­nate the advance notice require­ment and tem­porar­i­ly gag finan­cial insti­tu­tions from disclosure.

The pre­cise statu­to­ry pro­vi­sion at issue in Smith and Klay­man is Sec­tion 215 of the USA PATRIOT Act. Allows the FBI/NSA access to any busi­ness records when con­duct­ing a counter-intel­li­gence or counter-ter­ror­ism inves­ti­ga­tion. A FISA judge’s approval is required, though the stan­dard for issuance is very low.

Sec­tion 215 cov­ers med­ical records. A part of the statute, in fact, express­ly address­es them.
Sec­tion 215 also cov­ers finan­cial records. In a 2010 opin­ion, the FISA Court held as much. And, in fact, the CIA oper­ates a bulk finan­cial sur­veil­lance pro­gram under Sec­tion 215.

In sum: not only are nation­al secu­ri­ty inves­ti­ga­tions gen­er­al­ly out­side HIPAA and RFPA, but the very same author­i­ty at issue in Smith and Klay­man allows access to med­ical and finan­cial records.