In March, U.S. Magistrate Judge Dustin Pead recommended that the state be ordered to comply with the subpoena.
"ACLU's arguments are akin to a criminal defendant suggesting that the federal government must seek a warrant to obtain a defendant's records from local police," Pead wrote.
In its objection to Pead's ruling, ACLU attorneys called that comparison off target. Though the ACLU is not a party to the case, it is an intervenor that joined the litigation.
"A better analogy would be to the contents of students' private emails stored on a state university's servers; though such files are held by a government entity, surely that fact alone does not divest them of protection under the Fourth Amendment," the group wrote in a court filing. State officials objected to Pead's recommendation, pointing to ACLU's reasoning.
On Thursday, U.S. District Judge David Nuffer's order settled the issue saying that the state's capacity to challenge the subpoena on grounds of violating Fourth Amendment protections against unreasonable searches and seizures is "limited" because neither the state nor the ACLU represent "individual patient or prescriber interests."
States cannot take on the role of protecting citizens' rights against the federal government, Nuffer wrote, because that role will be taken on by the federal government when appropriate. A supremacy clause requires state law to "give way" to the federal law when the two are in conflict with one another.
The prescription drug industry is "highly regulated," Nuffer said, and an expectation of privacy from patients and prescribers may have in the database "is not reasonable."
The subpoena from the DEA is legal, Nuffer added, because it requests records for one specific physician for a limited time period who is under investigation.,
Although Pead recommended the state be ordered to comply "immediately," Nuffer gave the Utah Department of Commerce and Utah Division of Occupational and Professional Licensing three weeks to comply or be held in contempt of court.
If the state files an appeal, it can apply for a stay in the case.
Marina Lowe, a spokeswoman for the ACLU, on Friday expressed disappointment in Nuffer's ruling and said the organization is interested to see what the state's next steps are.
The case and ruling help "identify this challenge" of seeing how the Fourth Amendment applies to a modern way of life heavily influenced by technology, Lowe said.
She added that Nuffer's explanation of his ruling seems to classify the release of private medical information as "just a risk one acknowledges when going to see a doctor."
This reasoning would means that a person "seeking potentially life-saving treatment" has to decide whether to "sacrifice my health or my privacy," Lowe said.
"I hope it's not the end of the road, and I certainly don't think it's the end of the road," Lowe said.
An emailed statement from Utah Department of Commerce and Division of Occupational and Professional Licensing said it hadn't yet made a decision on an appeal and declined to comment on the case.
More than 40 states keep databases similar to Utah, but Utah passed a law requiring investigators to get a warrant before they search it and is among the minority of states that have that requirement.
Utah's database contains "every prescription for a controlled substance dispensed in the state to any individual other than an inpatient in a licensed health care facility," court documents say. Nuffer noted the statute requiring the database's upkeep states that one of its express purposes is to identify "practitioners prescribing controlled substances in an unprofessional or unlawful manner."