The State appeals the suppression of evidence obtained from a pharmacy by an investigating law enforcement officer. Because section 893.07(4), Florida Statutes, requires pharmacies to make controlled substance records available to law enforcement officers, and does not require pharmacies to notify the patient or withhold such records until a warrant is presented, the order granting the motion to suppress is reversed.
*800 The police investigator obtained the records at issue while investigating a suspected “doctor shopping” violation. See § 893.13(7)(a)8., Fla. Stat. The pharmacy provided the records to the investigator pursuant to section 893.07(4), Florida Statutes. In both her motion to suppress and this appeal, Appellee asserted that the warrantless seizure of her prescription records violated her constitutional rights to privacy and to due process. She further argued that her pharmacy records could not legally be transmitted to law enforcement officers unless she was provided prior notice and the opportunity to consent or be heard. The trial court granted Appellee’s motion to suppress.
While a trial court’s ruling on a motion to suppress is accorded great deference on appeal, the suppression order on review is an erroneous application of the law. The facts surrounding the pharmacy records are not at issue. The application of the law to the facts is subject to this court’s
de novo
review.
See Brye v. State,
Florida legislative enactments do not supply a legal basis upon which to suppress the records at issue. To the contrary, section 893.07(4), Florida Statutes, requires pharmacies to maintain the records at issue here for a period of 2 years “for inspection and copying by law enforcement officers whose duty it is to enforce the laws of this state relating to controlled substances.” The statute does not require a subpoena, warrant, or prior notice to the patient. The enactment of section 893.07 was an extension of war-rantless search and seizure power by the Legislature “as part of a major legislative revision of the Florida drug abuse laws.”
Gettel v. State,
Section 465.017(2)(a), Florida Statutes, specifically addresses the release of controlled substance records maintained by a pharmacy. Release of such records to persons other than the patient is prohibited, “[ejxcept as permitted by” chapter 893, Florida Statutes. § 465.017(2)(a), Fla. Stat. The records at issue were obtained pursuant to chapter 893, Florida Statutes. If the Legislature intended to require pharmacies to notify patients in connection with section 893.07, the Legislature would have included this requirement in the statute, as it did in statutes governing disclosure by other health care entities. See § 395.3025, Fla. Stat. (hospitals); §§ 400.0077 & 400.022(l)(m), Fla. Stat. (nursing homes); and § 456.057(7), Fla. Stat. (physicians). The cases advanced by Appellee, pertaining to the procedures for a hospital’s disclosure of medical records governed by section 395.3025, Florida Statutes, do not apply to the pharmacy records at issue in this appeal.
The federal Health Insurance Portability and Accountability Act (“HIPAA”) does not constitute a legal basis for suppression of the records at issue. HIPAA addresses privacy in “protected health information” by regulating the release of such information by specified “covered entities:” health plans, health care clearinghouses, and certain health care providers. 45 C.F.R. § 160.103;
see also
42 U.S.C. § 1320d. “Covered entities” do not include law enforcement officers or prosecutors, and the conduct of these officials is not governed by HIPAA. See 45 C.F.R. §§ 160.102(a), 160.104(a);
State v. Straehler,
Even if HIPAA applied to determine whether the “property was illegally seized without a warrant,” pursuant to rule *801 3.190, Florida Rules of Criminal Procedure, no violation of HIPAA appears in the record on appeal. Among the permitted disclosures are “as otherwise required by law” or “[i]n compliance with ... an authorized investigative demand.” 45 C.F.R. § 164.512(f)(1) & (f)(l)(ii)(C). “Required by law” is defined as “a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law.” 45 C.F.R. § 164.103. Statutes requiring the production of information are included in the definition of “required by law.” Id. Section 893.07, Florida Statutes, is Florida’s statute that requires pharmacies to produce, for inspection and copying by law enforcement officers, records of controlled substances sold and dispensed. Thus, a pharmacy’s provision of records to investigating police officers in compliance with section 893.07, Florida Statutes, also comports with HIPAA.
Even where evidence is disclosed by a covered entity in violation of HIPAA standards, suppression of the records is not provided for by HIPAA and is thus not a proper remedy.
State v. Mubita,
Finally, article I, section 23 of the Florida Constitution does not support the suppression order on appeal. Patients’ right to privacy in their medical records is not absolute. Such privacy rights “will yield to compelling government interests” and “the control and prosecution of criminal activity is a compelling state interest.”
State v. Johnson,
Accordingly, the trial court’s ruling that the warrantless seizure of Appellee’s pharmacy records without prior notice to Ap-pellee was unlawful was erroneous. The order suppressing the prescription records is REVERSED and this case REMANDED.
