Murray visited the home of Russell Smithey, 42, and Candy Holmes, 37, three times a month from January through July 2011, saying he was doing a "pill check," said attorney Tyler Ayres.
Murray timed his visits to coincide with their refills and knew their full list of medications. If the couple didn't produce all of the drugs, he asked for the ones that were missing.
Wearing his official clothing and badge, Murray asked for their prescriptions and went through the pills, pocketing several while Holmes and Smithey were distracted, Ayres said once taking up to 50 pills, they said.
After several months, the couple bought a video cassette camera, put it on a living room shelf and waited for one of Murray's visits, Ayers said.
The Aug. 1 tape shows a polite Murray characterizing his visit as a help to the couple, saying, "If you need something holler. I want to see you guys succeed." He dumps out pills and counts them, asking Smithey to help him as he slips what appear to be pills in his pocket several times during the approximately 20-minute tape.
"We've been in trouble before; we thought we had no choice," than to submit to the pill searches, Holmes told The Tribune Wednesday. "I'll never look at police and law enforcement the same way again. I've lost all faith."
Ayres said he knows about up to six additional victims.
Holmes and Smithey filed notice Monday that they intend to sue the city and the state for $2 million in damages.
The state's Controlled Substance Database, Ayres said, is the only way Murray could have gained such detailed information about the couple's medications. He compared the database to a bowl of Halloween candy left in front of an empty house with a sign telling trick-or-treaters to "take just one."
Created in 1998 and expanded in 2010, the database is designed to curb abuse of potentially addictive prescription drugs by allowing doctors and pharmacists to check patients' activity.
Police also have access to the database and can access the records without a warrant.
"Once you get your name and password, you're on," said attorney Troy Walker. "There's no monitoring ... you can look at anybody."
Mark Steinagel, director of the Division of Occupational and Professional Licensing, said the agency allows medical professionals to use the database following a background check. Police are required to input a specific case number. Their access, however, doesn't automatically end there. They can potentially access other people.
"We don't check every single search request," Steinagel said. More than 5 million records are entered into the database every year. Inappropriate usage of the database can result in a third-degree felony charge and "when we find out about it, we take it seriously," Steinagel said.
Walker says officers should be required to get a warrant before accessing the database, as is the case in New York.
Florida has a system administrator who monitors usage of the site.
Three Utah state legislators chimed into at a press conference with the couple's attorneys Tuesday, saying the database needs more monitoring.
One of those was Rep. Brad Daw, R-Orem, who sponsored the 2010 law that expanded the database.
"I appreciate this abuse being brought to light, and I will give my full attention to ensuring that this can never happen again," he said in a statement, adding that he planned to craft legislation to install more safeguards.
Rep. Greg Hughes, R-Draper, said, "Some checks and balances are lacking in that process."
And Sen. Howard Stephenson, R-Draper, said the current law can allow information grazing by those who access the information. "I believe the executive branch needs to take immediate action to ensure this doesn't happen again," he said.
Due to incorrect information from attorneys in the case, the surname of Russell Smithey was incorrectly spelled in an earlier version of this article. Also, attorneys have corrected that Murray visited the home of Smithey and Holmes three times a month.