Summary
In United States v. Pompy, No. 18-CR-20454, 2021 WL 978797 (E.D. Mich. Mar. 16, 2021), the district court addressed the issue of whether a solo practitioner physician had a legitimate expectation of privacy in his office as the sole shareholder of his medical practice.
Summary of this case from United States v. EversOpinion
Criminal Case No. 18-cr-20454
03-16-2021
UNITED STATES OF AMERICA Plaintiff, v. LESLY POMPY, Defendant.
U.S. MAGISTRATE JUDGE R. STEVEN WHALEN
ORDER DENYING DEFENDANT'S MOTION TO SUPPRESS MEDICAL RECORDS [25]
On June 26, 2018, Defendant Dr. Lesly Pompy, a pain management specialist, was charged with 22 counts of Distribution of Controlled Substances, Aiding and Abetting, in violation of 21 U.S.C. § 841(a)(1) and 18 U.S.C. § 2, and 15 counts of Health Care Fraud, Aiding and Abetting, in violation of 18 U.S.C. § 1347 and 18 U.S.C. § 2. (ECF No. 1). Before this Court is Dr. Pompy's Motion to Suppress Medical Records [25], which were seized during a search of his office. The Government filed a Response [27] on April 13, 2020. Defendant filed a Reply [32] on May 7, 2020. The Court held a hearing on the Motion [25] on November 23, 2020. For the reasons stated below, the Motion [25] is DENIED.
FACTUAL BACKGROUND
Dr. Pompy was a solo practitioner at Interventional Pain Management Associates (IPMA) in Monroe, Michigan. The Government alleges that from 2012 to 2016, Dr. Pompy orchestrated a scheme to prescribe prescription opioids outside of the usual course of medical practice. (Compl. ¶ 1-2). The Government additionally alleges that Dr. Pompy submitted fraudulent billing claims to Medicare, Medicaid, and Blue Cross Blue Shield of Michigan (BCBS) in connection with this scheme. (Id. ¶ 6). An investigation into Defendant's medical practice began in 2015. (ECF No. 28-1, PageID.250). As part of the investigation, BCBS, in collaboration with Monroe Area Narcotics Team and Investigative Service (MANTIS), sent an undercover investigator to pose as a patient in Defendant's clinic. (Id.).
Shortly after this investigation, on September 23, 2016, MANTIS obtained a search warrant from a Michigan Magistrate. (ECF No. 25-2). The warrant entitled the officers to search IPMA and, in relevant part, seize the following property:
A) Any and all business records of the medical practice of Lesly Pompy [. . .] and/or "Interventional Pain Management Associates," related to the identity or treatment of patients, including all patient medical records and billing information
[. . .]
E) Records . . . computers, and any other properties of Lesly Pompy
[. . .]
H) [. . .] As used above, the terms records or documents or information includes all of the foregoing items of evidence in whatever form and by whatever means they may have been created or stored, but is not limited to, records or documents or information that were created, modified or stored in electronic or magnetic form and any data, image, or
information that is capable of being read or interpreted by a computer. In order to search for any such items, searching agents may seize and search the following:ECF No. 25-2. IPMA contracted with iPatientCare, an electronic medical records (EMR) company headquartered in New Jersey, to store the clinic's records on a remote server. Despite this, all of the clinic's medical records were created and accessed through the clinic's computers, which Dr. Pompy and his staff did regularly, using a password. During the search, police asked and obtained passwords to the clinic's devices from Dr. Pompy. (ECF No. 25-3). The officers did not, however, ask for the EMR system's unique password and neither did Dr. Pompy volunteer it. (Id.). Instead of obtaining the medical records directly from the clinic's computers, the officers faxed the search warrant to iPatientCare to obtain the records more efficiently. The company promptly complied and sent the medical records to the police.
Any computer hardware [. . .] and computer-related equipment capable of creating or storing information in electronic form; any computer peripheral used to facilitate the transmission, creation, display, encoding or storage of information [. . .] data and information contained on the computer and electronic device to be searched; any passwords, password files, test keys, encryption codes and other computer codes necessary to access the computers and electronic device into a readable form.
Out of an abundance of caution, on August 14, 2017, MANTIS obtained a second search warrant for the same medical records, this time directed towards iPatientCare specifically. (ECF No. 25-4). The warrant was faxed to iPatientCare with the following note from MANTIS Detective Robert Blair.
In September of 2016 we provided you with a search warrant for Dr. Pompy's medical files for 2 years. During the Investigation there has been some debate whether the original warrant Included the files that you store for Dr. Pompy, In order to avoid any further issues on this matter we have completed a new search warrant specific for your location and the files in question. It should be noted that you do not need to provide the files again. You already provided us with this information when requested in 2016. There is no need to send US any files at this time.(Id. at PageID.181). No records were obtained as a result of this second warrant. Dr. Pompy makes three challenges to the seizure of his patients' medical records: (1) the seizure under the first warrant was a warrantless search and seizure, (2) the second warrant was extraterritorial, and (3) in the alternative, seizing records concerning patients seeking drug addiction treatment violated 42 C.F.R. Part 2.
ANALYSIS
A. Fourth Amendment Protection
As a threshold matter, Defendant has standing to challenge the warrants, because he has both a subjective and objective expectation of privacy in his office and the records contained therein. A defendant who has "neither a property nor a possessory interest in the [location], nor an interest in the property seized" lacks Fourth Amendment standing. Rakas v. Illinois, 439 U.S. 128 (1978). The Supreme Court also cautions "[t]he concept of standing Fourth Amendment cases can be a useful shorthand for capturing the idea that a person must have a cognizable Fourth Amendment interest in the place searched before seeking relief for an unconstitutional search; but it should not be confused with Article III standing, which is jurisdictional and must be assessed before reaching the merits." Byrd v. United States, 138 S. Ct. 1518, 1530 (2018).
Whether such an interest in the place searched exists depends on "1) whether [the defendant], manifested a subjective expectation of privacy in the object of the challenged search; and 2) whether society is prepared to recognize that expectation as legitimate." United States v. Sangineto-Miranda, 859 F.2d 1501, 1510 (6th Cir. 1988). The subjective expectation of privacy analysis is fact intensive and depends on several factors.
Aside from a defendant's proprietary or possessory interest in the place to be searched or item to be seized, some factors that courts have considered when identifying those expectations which qualify for Fourth Amendment protection include whether the defendant has the right to exclude others from the place in question; whether he had taken normal precautions to maintain his privacy; [and] whether he has exhibited a subjective expectation that the area would remain free from governmental intrusion. The proponent of a motion to suppress has the burden of establishing that his own Fourth Amendment rights were violated by the challenged search or seizure.United States v. Ocampo, 402 Fed. Appx. 90, 95-96, (6th Cir. 2010) (citing Rakas v. Illinois, 439 US. 128, 130 (1978)) (quotations omitted).
"It has long been settled that one has standing to object to a search of his office, as well as of his home." Mancusi v. DeForte, 392 U.S. 364, 369 (1968). "An owner or operator of a business thus has an expectation of privacy in commercial property, which society is prepared to consider to be reasonable." New York v. Burger, 482 U.S. 691, 699 (1987). Here, Defendant has a legitimate expectation of privacy in his office as the sole shareholder of his medical practice. (ECF No. 25-3, PageID.175).
In regards to the records seized, "[w]here the documents seized were normal corporate records not personally prepared by the defendant and not taken from his personal office, desk, or files, in a search that was not directed at him personally, the defendant cannot challenge a search as he would not have a reasonable expectation of privacy in such materials." United States v. Mohney, 949 F.2d 1397, 1403 (6th Cir. 1991) (citing United States v. Britt, 508 F.2d 1052, 1055 (5th Cir.)). Here, Defendant has a legitimate expectation of privacy in his patients' medical records, because he prepares and maintains them. See United States v. Newman, No. 3:19-CR-59-TAV-DCP, 2020 WL 7384864, at *7 (E.D. Tenn. Sept. 8, 2020), report and recommendation adopted, No. 3:19-CR-59-TAV-DCP, 2020 WL 6938815 (E.D. Tenn. Nov. 25, 2020) (finding that defendant physician had a legitimate expectation of privacy in his clinic's records, because he reviewed and maintained them as the majority owner of the clinic). Additionally, the records are password protected using an encrypted EMR system that only he and his staff have access to. (ECF No. 25-3, PageID.175). Dr. Pompy, therefore, has Fourth Amendment standing to challenge the search of his office and the seizure of his patients' medical records.
B. Search Warrants
Defendant claims that the seizure of his medical records from iPatientCare constituted a warrantless search and seizure, because the warrant only authorized the search of Defendant's office, not iPatientCare. The Court, however, finds that the officer's seizure of the medical records was valid under the warrant and not beyond the scope of its terms.
The Fourth Amendment protects against general searches. It states that "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. Const., Amend. IV (emphasis added). "This prevents the issue of warrants on loose, vague or doubtful bases of fact." Go-Bart Importing Co. v. United States, 282 U.S. 344, 357 (1931). "Everything to be searched or seized must be specified in warrant itself." Groh v. Ramirez, 540 U.S. 551, 557 (2004). "If the scope of the search exceeds that permitted by the terms of a validly issued warrant or the character of the relevant exception from the warrant requirement, the subsequent seizure is unconstitutional without more." Horton v. California, 496 U.S. 128, 140 (1990).
Under these parameters, the search of Defendant's office and seizure of his medical records was constitutional. The warrant authorized officers to seize "all patient medical records . . . in whatever form and by whatever means they may have been created or stored[,]" including in electronic form. (ECF No. 25-2). It additionally entitled officers to obtain "information that is capable of being read or interpreted by a computer," "any computer peripheral used to facilitate the transmission, creation, display, encoding or storage of information . . . and information contained on the computer and electronic device to be searched." (Id.).
This comprehensive language unquestionably includes records that have been created, maintained, and accessed by the office computers and electronically stored by iPatientCare's remote server. Notably, Defendant does not claim that the seizure would have been invalid if the records were taken directly from the computers in the office. Cloud memory is an integral part of a computer. In most instances, cloud memory is merely an extension of a device's storage capacity which provides a reliable safety net if a device's hardware malfunctions. It is modern technology's alternative to purchasing and maintaining costly hardware to expand a computer's memory. To say that one is wholly separate from the other, such that searching a computer's cloud storage requires a search warrant directed to the headquarters of the storage company, defies their fundamental tandem function and operation.
Furthermore, iPatientCare's cloud storage is not a publicly accessible network. C.f. Gray v. United States, No. 18-3067, 2018 WL 7107544, at *2 (6th Cir. Aug. 8, 2018) ("A defendant, however, lacks a legitimate expectation of privacy in a computer folder made publicly accessible over a peer-to-peer network" (citing United States v. Conner, 521 F. App'x 493, 497-98 (6th Cir. 2013))). It is an encrypted system that only staff with the unique password and access to clinic computers can obtain, further evidencing that the storage that contained the records in question are an integral part of the computers specified in the warrant.
Courts consistently find that accessing records on a computer when a warrant entitles officers to seize computer files is constitutional. See United States v. Fuller, 77 F. App'x 371, 377 (6th Cir. 2003) (Search warrant which identified defendant's computer as an item to be seized was sufficiently particularized to allow a search of defendant's computer and the files and records stored therein); see also Newman, 2020 WL 7384864, at *3 (upholding the search of a medical clinic's computer and seizure of its patients' records on a cloud based storage system). Even in a case where a warrant did not specifically state that computer data could be seized, the Sixth Circuit still held that seizure of records on a computer was valid when the warrant entitled officers to search the residence for "records pertaining to narcotics" and police reasonably believed that the computers contained such relevant data. United States v. Lucas, 640 F.3d 168, 177-78 (6th Cir. 2011).
Here, inherent in searching the clinic's computers was searching the data on the computer, including information on the cloud-based storage system. In light of this, executing the search warrant through asking iPatientCare was merely an alternative means of obtaining the same information the officers already had a legal right to access.
Defendant also challenges the second warrant directed to iPatientCare, because the magistrate did not have jurisdiction to authorize a search of a company headquartered in New Jersey. However, since the seizure of records is valid under the first warrant and no records were seized under the second warrant, Defendant's challenge to the second warrant is moot. See also United States v. Jenkins, 396 F.3d 751, 757 (6th Cir. 2005) ("[t]he independent source rule holds that evidence will be admitted if the government shows that it was discovered through sources 'wholly independent of any constitutional violation.'")(citing United States v. Leake, 95 F.3d 409, 412 (6th Cir. 1996))). Therefore, the seizure of Dr. Pompy's patients' medical records was valid.
C. 42 C.F.R. Part 2 Violation
In the alternative, Defendant argues that any records seized regarding patients receiving treatment for substance abuse should be suppressed under 42 C.F.R. Part 2. This regulation states that police can neither investigate nor seize the records of a clinic providing substance abuse treatment without prior court approval. Specifically, the regulation restricts "the disclosure and use of substance use disorder patient records which are maintained in connection with the performance of any part 2 program . . . [and] prohibit[s] the disclosure and use of patient records unless certain circumstances exist." 42 C.F.R. § 2.2(a)-(b)(1).
The parties agree that Defendant's practice was once covered by this regulation, because he had a waiver to treat opioid dependent patients. However, the Government argues that this qualification expired when Defendant's license to practice medicine in Michigan lapsed in 2013. (ECF No. 28-3, PageID.316-17). Regardless, the Government sought and obtained approval from the U.S. Magistrate Judge to use the records seized by MANTIS to prosecute Dr. Pompy. (ECF No. 28-3). However, no court approval was obtained at the state level prior to the undercover investigation and execution of the search warrant. Despite this, the Court finds that violation of this regulation, if any, is not sufficient grounds to suppress the medical records in question.
First, the exclusionary rule deters constitutional violations, not violations of federal, state, or local regulations. See United States v. Leon, 468 U.S. 897, 906, 104 S. Ct. 3405, 3411, 82 L. Ed. 2d 677 (1984); see also United States v. Calandra, 414 U.S. 338, 348 (1974) ("the [exclusionary] rule is a judicially created remedy designed to safeguard Fourth Amendment rights generally through its deterrent effect"). Furthermore, suppression of evidence in a criminal prosecution is not the contemplated remedy for violating the regulation — a fine is. "[A]ny person who violates any provision of this section or any regulation issued pursuant to this section shall be fined in accordance with Title 18 of the U.S. Code." 42 C.F.R. § 2.3; see also State v. Magnuson, 210 Mont. 401, 407-08 (1984) ([f]inding that under the regulation "[i]f Congress had intended that suppression and dismissal were the appropriate remedies for a violation of a confidentiality it would have so provided.").
Second, the purpose of the regulation — to protect people who are seeking treatment for their drug addiction — is fulfilled here. Generally, under the regulation, disclosure of patient records and placement of an undercover agent for purposes of investigating and/or prosecuting a part 2 program requires a court order. 42 C.F.R. § 2.66 (a), 2.67 (a). No information obtained in such a way may be used to investigate or prosecute a patient in connection with a criminal matter. 42 C.F.R. § 2.66 (d). The reason for this is clear: to protect patients, not physicians, from criminal prosecution while they are seeking treatment for addiction. The regulation explicitly "intend[s] to ensure that a patient receiving treatment for a substance use disorder in a part 2 program is not made more vulnerable by reason of the availability of their patient record than an individual with a substance use disorder who does not seek treatment." 42 C.F.R. § 2.2 (b)(2). This purpose has been fulfilled here.
Under penalty of perjury, a Drug Enforcement Administration officer has sworn to the Court that "[p]atient identifying information was not and will not be revealed or otherwise disclosed unless absolutely necessary to criminally investigate or prosecute Dr. Pompy . . . [and] [n]o information obtained by an undercover agent or informant regarding any patient being legitimately treated by Dr. Pompy with buprenorphine products will be used to criminally investigate or prosecute such patient." (ECF No. 28-3, PageID.326). This assurance satisfies the Court's concerns and fulfills the Government's legal duty under the regulation. Therefore, the medical records for patients covered by 42 C.F.R. § 2 will not be excluded.
CONCLUSION
IT IS ORDERED that Defendant's Motion to Suppress Medical Records [25] is DENIED.
SO ORDERED.
s/Arthur J. Tarnow
Arthur J. Tarnow
Senior United States District Judge Dated: March 16, 2021