United States v. Wilson

98 F.4th 1204

Opinion

FILED

United States Court of

PUBLISH Appeals Tenth Circuit

UNITED STATES COURT OF APPEALS April 15, 2024

FOR THE TENTH CIRCUIT Christopher M. Wolpert _________________________________ Clerk of Court

UNITED STATES OF AMERICA, Petitioner-Appellee, v. No. 23-2073 RICK Q. WILSON,

Respondent-Appellant.

_________________________________

Appeal from the United States District Court for the District of New Mexico (D.C. No. 1:22-MC-00020-JCH)

_________________________________

Brian G. Grayson of Grayson Law Office, LLC, Albuquerque, New Mexico, for Respondent-Appellant.

Casen B. Ross (Brian M. Boyton, Alexander M.M. Uballez, and Sarah Carroll with him on the brief) of United States Department of Justice, Civil Division, Washington, D.C., for Petitioner-Appellee.

_________________________________

Before HARTZ, PHILLIPS, and CARSON, Circuit Judges.

_________________________________

PHILLIPS, Circuit Judge.

_________________________________

Until the authorities caught up with him, California-based psychologist Dr. Rick Q. Wilson was the second-most prolific prescriber of benzodiazepines in New Mexico, despite visiting the Land of Enchantment only twice a month.

2

Over a five-year period, at least seventeen of his patients died within a month of filling a prescription he had written. These circumstances drew the attention of the Drug Enforcement Administration, which began investigating Wilson for potential violations of the Controlled Substances Act (CSA), 21 U.S.C. §§ 801– 904. The DEA’s investigative efforts included serving an administrative subpoena on Wilson to obtain medical, prescription, and billing records, pursuant to §§ 876(a) and 878(a)(2).

Wilson’s statutory and constitutional challenges to that subpoena are the subject of this appeal. Because we find his arguments without merit, we affirm the district court’s order granting in part the United States’ petition to enforce the administrative subpoena and compelling Wilson’s compliance.

BACKGROUND

I. Factual Background

Benzodiazepines are a class of drugs that include depressants and anti-

seizure medications such as Xanax (also known by its generic name, alprazolam), Valium (diazepam), and Ativan (lorazepam). Benzodiazepines are currently classified as Schedule IV drugs. See 21 C.F.R. § 1308.14 (listing alprazolam, diazepam, and lorazepam under Schedule IV). This means that the Attorney General has determined that the drugs have a “low[er] potential for abuse” than Schedule III drugs (such as ketamine, narcotics, and steroids), but a higher potential for abuse than those in Schedule V (such as stimulants with low quantities of narcotics), and may lead to correspondingly higher or lower

3

levels of “physical . . . or psychological dependence.” 21 U.S.C. § 812; see id. § 811(a) (authorizing the Attorney General to add or remove drugs from the Schedules); 21 C.F.R. §§ 1308.13 (listing Schedule III drugs), 1308.15 (listing Schedule V drugs).

Benzodiazepines are commonly used to treat anxiety disorders and insomnia. But benzodiazepines have also contributed to overdose deaths from opioid abuse: According to the National Institute on Drug Abuse, “[i]n 2021, nearly 14% of overdose deaths involving opioids also involved benzodiazepines.” National Institute on Drug Abuse, Benzodiazepines and Opioids (Nov. 7, 2022), https://nida.nih.gov/research- topics/opioids/benzodiazepines-opioids [https://perma.cc/3AND-7GS9]. Because different benzodiazepines have varying potencies, the DEA uses diazepam milligram equivalents as a standard unit of measure.

Wilson’s status as the second-highest prescriber of benzodiazepines comes from the DEA’s assessment that 359 of Wilson’s patients filled prescriptions totaling 3,184,590 diazepam milligram equivalents in a six-month period. In addition to the seventeen patients who died from the toxic effects of multiple drugs, including benzodiazepines, within one month of Wilson’s prescribing or dispensing that drug to them, another patient died within one month from a heart condition exacerbated by multiple drugs. And two other patients died within a month of their last prescription from the acute or chronic use of other drugs, but did not have benzodiazepines in their system, which

4

suggested to the DEA that Wilson was not verifying whether those patients were taking the drugs themselves or were selling or trading the controlled substance for other drugs.

Wilson’s prescribing practices caught the attention of both state and federal authorities. New Mexico’s Board of Psychologist Examiners began investigating Wilson, culminating in a December 2020 settlement agreement. By the terms of the agreement, Wilson relinquished his New Mexico controlled-substance license, his DEA registration, and his ability to write prescriptions in New Mexico.

The DEA also began investigating Wilson for possibly violating the CSA.

In November 2020, DEA Diversion Investigator Shirley Scott emailed Wilson administrative subpoena No. MM-21-075444, requesting “a list of all patients in the last five years and all prescriptions written for each patient,” in addition to “all documents relating or referring to the following patients to include, but not limited to, patient files, billing statements, prescriptions, communications, and any other documents that refer or relate to the listed patients.” App. 90. The subpoena then listed the names and dates of birth of forty of Wilson’s patients. The DEA personally served this subpoena on Wilson in March 2021.

The DEA re-issued the subpoena as No. MM-17-0128 on April 27, 2021, changing the return date to May 14, 2021, adding one more patient to the list of named patients, and inserting the qualifying words, “controlled substance”

5

before the word “prescriptions.” Id. at 83. The updated subpoena therefore read as follows:

Please provide a list of all patients in the last five years and all controlled substance prescriptions written for each patient. In addition, please provide all documents relating or referring to the following patients to include, but not limited to, patient files, billing statements, controlled substance prescriptions, communications, and any other documents which refer to or relate to the listed patients.

App. 12. The updated subpoena was served on Wilson on May 3, 2021.

Though the timeline of his production is unclear, Wilson only partially responded to the subpoena and “many of the documents” he did produce “were password protected.” App. 6. Despite the DEA’s requests, Wilson “refused to provide the password.” App. 83. Wilson produced patient records for “all but six of the requested patients” but “did not produce any other responsive documents” such as billing and payment records. App. 82. He also did not produce his patient list for the last five years, nor the “controlled substance prescriptions written for each patient.” App. 83. II. Procedural Background In June 2022, the United States petitioned the district court for an order compelling Wilson to comply with subpoena No. MM-17-0128. A few months later, just days after the United States moved for a default judgment, Wilson answered the petition and moved to dismiss it.

6

A. The Motion to Dismiss In his motion to dismiss, Wilson raised four main arguments to justify his non-compliance: (1) the subpoena’s overbreadth required him to violate the Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 1320d; (2) he could not disclose records without violating New Mexico’s patient-doctor privilege, according to Rule 11-504 of the New Mexico Rules of Evidence; (3) the subpoena was too broad to comply with the Fourth Amendment; and (4) the Fifth Amendment protected him from incriminating himself by responding to the subpoena.

After briefing was complete, the district court granted Wilson’s motion to dismiss on HIPAA and Fourth Amendment grounds. See United States v. Wilson (Wilson I), No. 22-MC-20, 2022 WL 17093457, at *1, *7 (D.N.M. Nov. 21, 2022). Specifically, the district court determined that the subpoena violated HIPAA because the DEA’s request for a “list of all patients in the last five years and all controlled substance prescriptions written for each patient” was “overly broad.” Id. at *7. It explained: “The request requires disclosure of the names of patients, even if they had never been prescribed a controlled substance” and so “their identities would not be relevant to the investigation.” Id. To cure this overbreadth, the district court declared that “the list of patients should be limited to those patients to whom Dr. Wilson prescribed controlled substances in the past five years and may include the controlled substance prescriptions as well.” Id.

7

Deciding Wilson’s Fourth Amendment arguments, the district court found that “Dr. Wilson’s expectation of privacy in prescription drug records is diminished” because the “CSA and its implementing regulations require registered dispensers of controlled substances to maintain complete and accurate records and to keep them available for inspection by law enforcement officers without a warrant.” Id. It then examined the scope of the subpoena in United States v. Zadeh, 820 F.3d 746 (5th Cir. 2016), a case on which the United States relied in its petition briefing. See Wilson I, 2022 WL 17093457, at *8. Comparing the subpoena in Zadeh to the requested subpoena here, the district court noted that the Zadeh subpoena was much narrower. Id.

The district court also ruled that New Mexico Rule of Evidence 11-504(B) was preempted by the CSA, so that Wilson could not assert the state- law privilege. Id. at *5–6. Because the district court decided the case on HIPAA and Fourth Amendment grounds, it did not consider Wilson’s Fifth Amendment arguments. Id. at *8. The district court therefore dismissed the United States’ petition to enforce the subpoena without prejudice. Id.

B. The Motion to Reconsider The United States moved for reconsideration of the decision, or in the alternative, for leave to file an amended petition to enforce the subpoena. The United States attached a proposed amended petition, a declaration from DEA Diversion Investigator Shirley Scott, and sample subpoenas and declarations from other cases, including Zadeh. In the Declaration, Scott outlined her

8

credentials and statutory authority to investigate the “actual and potential diversion of legally manufactured controlled substances into other than legitimate medical . . . channels.” App. 81. The Declaration also explained some of the factual bases for the DEA’s interest in Wilson and briefly described Wilson’s partial production in response to the two subpoenas. The Declaration explained the connection between the subpoena’s request for patient identities, communications, and billing records, and factors that, in Scott’s experience, indicate improper prescription practices.

The district court issued a memorandum opinion and order addressing the United States’ motion to reconsider. United States v. Wilson (Wilson II), No. 22-MC-20, 2023 WL 3006888, at *1 (D.N.M. Apr. 19, 2023). It construed the motion as a motion to revise an interlocutory order under Federal Rule of Civil Procedure 54(b), but still declined to grant it, unconvinced that it had “erred in its application of the law based on the record before it.” Id. at *4. And “even if it prematurely reached the merits,” the district court concluded that “the best procedural course at this stage is to permit leave to file the proposed Amended Petition, which contains additional detail and seeks both full and partial enforcement of the Subpoena.” Id.

The district court then analyzed whether Wilson was correct that it would be futile for the United States to amend the petition because the proposed Amended Petition still violated HIPAA, the Fourth Amendment, and the Fifth Amendment. Informed by further explanatory detail from the United States’

9

briefing, the Declaration, and the sample subpoena in Zadeh, the district court re-examined whether the subpoena’s request for a list of all of Wilson’s patients for the last five years was relevant.

First, the district court limited the subpoena’s reach. The Declaration asserted that knowing the percentage of patients to whom Wilson had prescribed controlled substances would be helpful, because a high proportion suggests prescribing practices in violation of the CSA. The DEA needed to know the total number of Wilson’s patients to calculate the proportion receiving controlled substances. So, to meet HIPPA’s requirements, the court limited the subpoena to requesting the number of patients from the five-year period, and the identities of only those patients to whom controlled substances were prescribed. Id. at *5.

Turning next to the Fourth Amendment arguments, the district court concluded that “when limited to information leading to controlled substance prescriptions or concerning the manner in which Dr. Wilson determined whether and what controlled substance prescriptions to prescribe,” the subpoena was “sufficiently limited in scope, relevant in purpose, and specific in directive to comply with the Fourth Amendment.” Id. at *6.

As for Wilson’s Fifth Amendment concerns that he was being required to incriminate himself, the district court noted that such protection applies only to “testimonial communication that is incriminating.” Id. at *7 (quoting Baltimore City Dep’t. of Soc. Servs. v. Bouknight, 493 U.S. 549, 554 (1990)). The court

10

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 10

noted that “incriminating evidence may be the byproduct of obedience to a regulatory requirement, such as . . . maintaining required records,” but concluded that this alone “does not clothe such required conduct with the testimonial privilege.” Id. (quoting United States v. Hubbell, 530 U.S. 27, 35 (2000)).

The district court reasoned that “New Mexico has a statutory scheme governing the practice of psychology” and that “Dr. Wilson . . . does not dispute that . . . he kept the records as part of his regular medical practice.” Id. at *8. The district court therefore concluded that the requested “medical records have assumed sufficient public aspects to render them subject to production under the records exception,” so amendment would not be futile. Id.

The district court then granted the United States leave to amend its petition and enforce the subpoena, subject to narrowed language. Id. at *9. The district court ordered that Wilson “comply with the Subpoena as follows”:

a. Provide a list of all patients in the last five years to whom Dr.

Wilson prescribed controlled substances, produce all controlled substance prescriptions written for those patients, and provide the total number of Dr. Wilson’s patients in the last five years.

b. For the 41 listed patients in the Subpoena, provide all documents and information in the patient files, billing statements, and communications that are related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed; all records that contain the results of any laboratory work (including urinalysis records) pertaining to the diagnosis or treatment because of which a controlled substance was prescribed and all records that contain information concerning laboratory work

11

(including urinalysis records) involved in monitoring the use or amounts of controlled substances by the patients; and all documents containing information pertaining to the prescription of a controlled substance.

Id. Additionally, the district court ordered that the documents be placed “under seal with no access except to the United States Attorney’s Office, the agents involved in the DEA investigation of Dr. Wilson, and the Government’s retained expert in this matter.” Id. III. Legal Background: The Controlled Substances Act In enacting the CSA, Congress recognized that the “improper use of controlled substances ha[s] a substantial and detrimental effect on the health and general welfare of the American people,” while acknowledging that “[m]any of the drugs included” in the CSA “have a useful and legitimate medical purpose and are necessary to maintain the health and general welfare of the American people.” 21 U.S.C. § 801. In balancing these interests and concerns, Congress imposed controls and restrictions on the manufacture, dispensation, and distribution of such substances, enforcing them with criminal penalties. See generally id. §§ 801–904.

Congress delegated authority to the Attorney General to determine which drugs the CSA controls, including whether and when to add or remove drugs or other substances from the different schedules. Id. § 811(a). In making findings supportive of addition or removal of certain drugs, the Attorney General considers, among other things, the drug’s “potential for abuse,” “evidence of its

12

pharmacological effect,” its “history and current pattern of abuse,” the “scope, duration, and significance of the abuse,” its “risk . . . to the public health,” and the extent to which it is liable to foster “psychic or physiological dependence.” Id. § 811(c).

The CSA makes it unlawful for “any person knowingly or intentionally”

to distribute or dispense a controlled substance. Id. § 841(a)(1). But it exempts certain practitioners, such as physicians, pharmacists, and other licensed professionals who are registered and authorized to dispense and distribute these substances during their professional practice. See id. § 802(21) (defining “practitioner”); id. §§ 822–823 (outlining registration requirements).

But these practitioners “can be prosecuted under § 841 when their activities fall outside the usual course of professional practice,” United States v. Moore, 423 U.S. 122, 124 (1975), or when their prescriptions are not for a “legitimate medical purpose,” United States v. MacKay, 715 F.3d 807, 814 (10th Cir. 2013). “Thus, a physician remains criminally liable when he ceases to distribute or dispense controlled substances as a medical professional, and acts instead as a ‘pusher.’” United States v. Feingold, 454 F.3d 1001, 1004 (9th Cir. 2006) (quoting Moore, 423 U.S. at 138).

Practitioners who dispense or prescribe controlled substances must register with the Attorney General. 21 U.S.C. § 822; see also 21 C.F.R. § 1306.03(a)(1) (“A prescription for a controlled substance may be issued only by an individual practitioner who is . . . [a]uthorized to prescribe controlled

13

substances by the jurisdiction in which he is licensed to practice his profession.”).

As relevant here, for a prescription to be valid, it must be “issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice.” 21 C.F.R. § 1306.04(a). And “[a]ll prescriptions for controlled substances shall be dated as of, and signed on, the day when issued and shall bear the full name and address of the patient, the drug name, strength, dosage form, quantity prescribed, directions for use, and the name, address and registration number of the practitioner.” Id. § 1306.05(a).

DISCUSSION

Wilson makes three main arguments on appeal: (1) the subpoena is not

sufficiently limited to comply with HIPAA, even as narrowed by the district court; (2) the subpoena does not meet the Fourth Amendment’s requirement that it be sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome; and (3) the Fifth Amendment’s privilege against self-incrimination protects Wilson from producing the requested documents. Wilson does not argue that the district court erred procedurally.

Exercising jurisdiction under 28 U.S.C. § 1291, we “review[] a district court’s decision to enforce or quash an administrative subpoena . . . for abuse of discretion.” McLane Co. v. E.E.O.C., 581 U.S. 72, 79–80 (2017), as revised

14

(Apr. 3, 2017); see also E.E.O.C. v. Dillon Cos., Inc., 310 F.3d 1271, 1274 (10th Cir. 2002) (“We review the district court’s rulings on subpoenas for an abuse of discretion.”). For the reasons that follow, we find Wilson’s arguments to be without merit and affirm the district court’s order granting the United States’ petition to enforce the narrowed subpoena.

I. The district court sufficiently limited the administrative subpoena to comply with HIPAA.

HIPAA provides penalties for the wrongful disclosure by a health care provider of a patient’s “individually identifiable health information.” 42 U.S.C. § 1320d-6. HIPAA defines individually identifiable health information as:

any information, including demographic information collected from an individual, that—

(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—

(i) identifies the individual; or

(ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.

Id. § 1320d(6); see also 45 C.F.R. § 160.103.

15

Generally, a health care provider cannot disclose such information “without authorization” from the patient. 42 U.S.C. § 1320-d(a); see 45 C.F.R. § 164.508 (“Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.”). But patient authorization is not required when disclosure is “for a law enforcement purpose to a law enforcement official” and when certain criteria are met. 45 C.F.R. § 164.512(f).

One example of a disclosure for law-enforcement purposes is an administrative subpoena, which allows health care providers to disclose otherwise protected health information, provided that: “(1) [t]he information sought is relevant and material to a legitimate law enforcement inquiry; (2) [t]he request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and (3) [d]e-identified information could not reasonably be used.” Id. § 164.512(f)(ii)(C)(1)–(3). Wilson argues that the district court’s modifications fail to satisfy the second and third prongs of that standard, thus conceding that the first prong— relevance and materiality—is met. See Op. Br. at 7 (“Dr. Wilson is primarily concerned with the second and third requirements of this [regulation].”). We turn now to those arguments.

16

A. The modified subpoena is “specific and limited in scope.”

Under the law-enforcement exception’s second prong, we must determine whether the district court’s modifications to the subpoena make it “specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought.” 45 C.F.R. § 164.512(f)(ii)(C)(2) (emphasis added). We start by considering the DEA’s purpose for seeking this information.

Broadly speaking, the DEA’s purpose is to investigate Wilson for potential violations of the CSA in distributing or dispensing Schedule IV substances. A health-care provider violates the CSA by prescribing a controlled substance without “a legitimate medical purpose” or by doing so outside “the usual course of his professional practice.” 21 C.F.R. § 1306.04(a); see also MacKay, 715 F.3d at 814 (applying 21 C.F.R. § 1306.04(a)). So we examine whether the subpoena is “specific and limited in scope” for the purpose of determining whether Wilson had a legitimate medical purpose and was acting within the usual course of his psychology practice when he prescribed or dispensed controlled substances. 45 C.F.R. § 164.512(f)(ii)(C)(2).

Though this court has not yet addressed the legitimate-medical-purpose standard in the context of an administrative subpoena, we have affirmed convictions of doctors who have violated that standard. See, e.g., MacKay, 715 F.3d at 815, 823–24 (affirming conviction of orthopedic physician who “did not take adequate medical histories, failed to conduct physical exams,

17

provided excessive quantities of drugs, and provided prescriptions to patients he never saw”); United States v. Schwartz, 702 F. App’x 748, 751–52, 757 (10th Cir. 2017) (unpublished) (affirming conviction of doctor who wrote prescriptions for “volume[s] significantly higher than the national standard for safe consumption” and “sometimes without obtaining full medical records or conducting adequate patient evaluations”); United States v. Celio, 230 F. App’x 818, 821–24 (10th Cir. 2007) (unpublished) (holding that evidence was sufficient to show doctor’s activities were not for a “legitimate medical purpose or in the ordinary course of professional practice” when he prescribed narcotics to an undercover agent posing as a patient who wanted pills for partying and distributing to friends, and distributed pills in a parking lot).

To evaluate the legitimacy of Wilson’s prescribing practices, Scott identified four areas of specific factual inquiry: (1) the percentage of patients to whom Wilson prescribed controlled substances; (2) the medical records and health status of those patients to whom Wilson prescribed controlled substances; (3) the method of payment and payment pattern for such prescriptions; and (4) any communications between Wilson and his patients that might bear on the legitimacy of his prescriptions.

First, Scott asserted in the Declaration: “In my experience as a Diversion Investigator, doctors who prescribe controlled substances to a large proportion of their patients are more likely to be prescribing improperly.” App. 85. For that reason, the “list of patients for the last five years” is “reasonably relevant

18

to the investigation and not overbroad because it will reveal the percentage of patients to whom [Wilson] prescribed controlled substances.” Id.

Considering Scott’s rationale for wanting the full patient list, the district court narrowed the subpoena, reasoning that “[t]he identities of patients not prescribed controlled substances . . . are not needed to determine that [proportion] calculation; rather, the percentage can be determined using the total number of Dr. Wilson’s patients.” Wilson II, 2023 WL 3006888, at *5 (emphases added). The district court therefore ruled that the first line of the subpoena—requesting “a list of all patients in the last five years,” App. 12— “would satisfy HIPAA if that request would be limited to a list of all patients in the last five years to whom Dr. Wilson prescribed controlled substances, all controlled substance prescriptions written for those patients, and the total number of Dr. Wilson’s patients in the last five years,” Wilson II, 2023 WL 3006888, at *5 (emphases added).

Second, Scott attested that the “[r]ecords reflecting a patient’s health status and condition are necessary to evaluate the legitimacy of controlled substances prescribed.” App. 86. Additionally, the CSA and its implementing regulations indicate the kinds of detail that medical records and prescription records may reveal about a prescription’s validity: “All prescriptions for controlled substances shall be dated as of, and signed on, the day when issued and shall bear the full name and address of the patient, the drug name, strength, dosage form, quantity prescribed, directions for use, and the name, address and

19

registration number of the practitioner.” 21 C.F.R. § 1306.05. And Schedule IV-substance “prescriptions may not be filled or refilled more than six months after the date thereof or be refilled more than five times after the date of the prescription unless renewed by the practitioner.” 21 U.S.C. § 829(b).

The district court narrowed the information requested about the forty-one named patients from all records to “all documents and information in the patient files, billing statements, and communications that are related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed.” Wilson II, 2023 WL 3006888, at *9 (emphasis added). The district court specified that the subpoena included a request for laboratory work and urinalysis records that were relevant to a condition for which a controlled substance was prescribed, and any documents “containing information pertaining to the prescription of a controlled substance.” Id. These records will show whether Wilson obtained adequate medical histories from his patients before prescribing them controlled substances, and whether he monitored his patients’ drug use. With this information, the DEA can determine whether Wilson adhered to acceptable professional standards. See Schwartz, 702 F. App’x at 752–53 (explaining how medical records, or lack thereof, supported the jury’s finding of prescriptions outside usual course of medical practice).

20

Third, Scott attested that “[a] patient’s method of payment and payment pattern are factors that may indicate improper prescribing, rendering billing and receipt records directly relevant to [the] DEA’s inquiry.” App. 87. She explained that “when doctors do not accept insurance and accept only cash or cash equivalents for payment it is indicative that the doctors are prescribing the controlled substances for improper or illegal purposes.” Id.

Relevant to this inquiry, as described above, the subpoena sought only the “patient files” and “billing statements” for the forty-one listed patients that “related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed.” Wilson II, 2023 WL 3006888, at *9.

Fourth, Scott explained that “[c]ommunications and other documents relating to patients may reveal discussions bearing on the legitimacy of a patient’s need for a prescription.” App. 87.

As with the medical and billing records, the district court narrowed the subpoena to request only “communications that are related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed.” Wilson II, 2023 WL 3006888, at *9.

Wilson argues that the district court’s modifications are still too broad because they cover “all records” for “a significant number of patients.” Op. Br. at 8. But the district court narrowed the subpoena so that it no longer requests “all records”—it now requests only “documents and information” relevant to “a condition or diagnosis for which a controlled substance was prescribed.”

21

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 21

Wilson II, 2023 WL 3006888, at *9. Though Wilson asserts that the subpoena “remains overbroad,” he does not explain why the district court’s narrowing was insufficient. Op. Br. at 8. He asserts that a subpoena is “overbroad and unreasonable” when it “sweepingly pursues material with little apparent or likely relevance to the subject matter.” Id. at 8–9 (quoting Concord Boat Corp. v. Brunswick Corp., 169 F.R.D. 44, 50 (S.D.N.Y. 1996)).

But Wilson doesn’t challenge the subpoena’s relevance under HIPAA’s first prong, 45 C.F.R. § 164.512(f)(ii)(C)(1), and he does not explain how the modified subpoena is as “sweeping[]” as the subpoena in Concord Boat, 169 F.R.D. at 50. In that case, the Rule 45 subpoena “encompass[ed] documents relating to every transaction . . . during the last ten years,” going “beyond any reasonable attempt to identify documents pertinent to” the business in question, and including “documents that are irrelevant . . . to plaintiffs’ underlying antitrust claims.” Id. at 50, 51; see id. at 48 (citing Fed. R. Civ. P. 45(a)). Unlike the subpoena in Concord Boat, the administrative subpoena at issue here is relevant to the DEA’s investigation, and is more “limited in scope” temporally, because it spans a five-year rather than a ten-year period—“records reflecting treatment from January 1, 2015, through November 15, 2020, a period that is part of the investigation,” App. 87.

We agree with the United States that the “district court carefully policed the boundaries of the request, narrowing the subpoena even further to ensure that it is no broader than necessary to further the DEA’s investigation.” Resp.

22

Br. at 25. We therefore conclude that the modified subpoena was sufficiently specific and limited in scope to comply with the law-enforcement exception’s second prong, 45 C.F.R. § 164.512(f)(ii)(C)(2), given the DEA’s overall purpose in evaluating Wilson’s controlled-substance prescription practices, and its specific goals of discerning the percentage of patients to whom Wilson was prescribing controlled substances and examining those patients’ medical records, billing records, and communications.

B. De-identified information cannot reasonably be used.

The third prong of HIPAA’s law-enforcement exception prohibits medical providers from disclosing individually identifiable health information, unless “[d]e-identified information cannot reasonably be used.” See 45 C.F.R. § 164.512(f)(ii)(C)(3). As stated above, the district court modified the subpoena so that it now seeks de-identified information for all of Wilson’s patients in the five-year period; namely, it now requests only the total number of his patients. See Wilson II, 2023 WL 3006888, at *9.

True, the modified subpoena still orders Wilson to produce individually identifiable information for patients to whom he prescribed controlled substances during that time, and for the forty-one named patients. See id. But this is sufficiently supported. For example, the Declaration explained that “[t]he patient names are necessary to cross-reference with prescriptions for [the] purpose of the investigation.” App. 85. The United States elaborated that the DEA may need to use information from other sources in its investigation,

23

such as information from “the relevant prescriber, information obtained from other law-enforcement agencies or other sources, . . . information in the public domain,” and information from “other investigative efforts” to determine the prescriptions’ legitimacy. Resp. Br. at 23.

Wilson contends that the Declaration does not explain “why de-identified information would be inadequate,” and asserts that “de-identified information could still be used to assess the medical propriety of what Dr. Wilson prescribed.” Op. Br. at 10. Wilson suggests using pseudonyms, such as John and Jane Doe, instead of actual patient names. Id. But, according to the United States, using pseudonyms would prevent the DEA from cross-referencing prescriptions, contacting prescribers, and searching the public domain, and so Wilson’s proposed restriction is not “reasonabl[e].” 45 C.F.R. § 164.512(f)(ii)(C)(3).

In sum, we agree with the United States that the modified subpoena satisfies HIPAA’s law-enforcement exception. Thus, the district court did not abuse its discretion in ordering Wilson to produce individually identifiable information for patients prescribed controlled substances.

II. The administrative subpoena satisfies the Fourth Amendment’s requirements.

The Fourth Amendment protects the right of citizens to “be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” U.S. Const. amend. IV. Though “no Warrants shall issue” without

24

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 24

probable cause, id. (emphasis added), “an investigatory or administrative subpoena is not subject to the same probable cause requirements as a search warrant,” Becker v. Kroll, 494 F.3d 904, 916 (10th Cir. 2007). Rather, administrative subpoenas will generally be enforced if “the inquiry is within the [statutory] authority of the agency,” United States v. Morton Salt Co., 338 U.S. 632, 652 (1950); accord Zadeh, 820 F.3d at 755, and if the subpoena is “sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome,” Becker, 494 F.3d at 916 (quoting See v. City of Seattle, 387 U.S. 541, 544 (1967)). Courts have termed this the “reasonable relevance” standard. See, e.g., Becker, 494 F.3d at 917 (applying the “reasonable relevance” standard); Zadeh, 820 F.3d at 755, 757–58 (same); Doe v. United States, 253 F.3d 256, 263–65 (6th Cir. 2001) (discussing the “reasonable relevance” standard).

Under the reasonable-relevance standard, “[t]he government need only make a prima facie showing . . . , at which point the party opposing enforcement bears the heavy burden of demonstrating that the government has not met this standard.” Zadeh, 820 F.3d at 757 (cleaned up). This prima facie showing “can be fulfilled by a simple affidavit of an agent involved in the investigation.” Id. at 757–58 (cleaned up). That the administrative subpoena may have “potential criminal ramifications does not change the analysis.” Becker, 494 F.3d at 917. For example, “an administrative summons issued by the IRS in the initial stages of a tax fraud investigation did not violate the

25

Fourth Amendment when it was issued in good faith and prior to a recommendation for criminal prosecution.” Id. (citing United States v. Smith, 484 F.2d 8, 11 (10th Cir. 1973)).

Though Wilson does not argue that he has third-party standing to assert his patients’ privacy interests, he “has his own interests in medical records he created and that are kept in his possession” that enable him “to challenge an administrative subpoena.” Wilson I, 2022 WL 17093457, at *7 n.2 (citing Zadeh, 820 F.3d at 755–56)). It is to those interests—protected under the reasonable-relevance standard—we now turn.

A. The administrative subpoena was issued within the DEA’s statutory authority.

To enforce an administrative subpoena, we must first ensure it was issued within the agency’s authority. Morton Salt, 338 U.S. at 652. Under the CSA, the Attorney General may, as part of his investigatory powers, “require the production of any records . . . which the Attorney General finds relevant or material to the investigation.” 21 U.S.C. § 876(a). Any DEA officer or employee may “execute and serve” such subpoenas. Id. § 878(a)(2). If production is not forthcoming, the Attorney General may petition the district court to “compel compliance with the subpena [sic].” Id. § 876(c).

Wilson does not contest that the subpoena was properly issued under the DEA’s statutory authority. See Op. Br. at 12 (“Respondent does not contest that the first prong of this test is satisfied . . . .”). Indeed, the subpoena was issued

26

under the authority of 21 U.S.C. § 876 by Investigator Scott, was served by another DEA Diversion Investigator, and was signed by a DEA Diversion Program Manager. It was therefore properly issued under the DEA’s authority.

B. The modified subpoena meets the reasonable-relevance standard.

The modified subpoena meets the reasonable-relevance standard because it is sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome. Becker, 494 F.3d at 916.

1. Limited in Scope

The subpoena is sufficiently limited in scope because, as explained above in Discussion § I(A), the district court narrowed the subpoena’s request for the identities of all of Wilson’s patients from the five-year period to just those to whom he had prescribed or dispensed controlled substances, and only to the records of the forty-one patients that “related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed.” Wilson II, 2023 WL 3006888, at *9. Wilson argues that the district court’s limitation on the subpoena was “a distinction without difference.” Op. Br. at 13. We disagree.

The subpoena originally requested “all documents relating to or referring to the [forty-one] patients,” but the district court narrowed it to requesting only documents and records that are relevant to conditions for which a controlled

27

substance was prescribed. See id. And so, we think that the subpoena, as narrowed by the district court, is sufficiently limited to comply with the Fourth Amendment, as well as HIPAA.

2. Relevant in Purpose The subpoena is relevant in purpose. Wilson argues that “[t]he records . . . requested in the Subpoena [are] not reasonably relevant to the inquiry.” Op. Br. at 12. But Wilson does not explain why this is so. Indeed, Wilson does not dispute that the narrowed subpoena satisfies HIPAA’s materiality- and relevance-requirement, which is much like the Fourth Amendment’s reasonable relevance standard. See Op. Br. at 7 (stating that “Dr. Wilson is primarily concerned with the second and third requirements” of HIPAA’s law-enforcement exception, not the materiality-and-relevance requirement); Discussion § I, supra. Compare 45 C.F.R. § 164.512(f)(ii)(C)(1) (“The information sought is relevant and material to a legitimate law enforcement inquiry.”), with Becker, 494 F.3d at 916 (stating that a subpoena must be “relevant in purpose”).

Wilson’s relevance arguments on appeal seem more directed to the pre-narrowed subpoena than the district court’s modified subpoena: “[T]he Subpoena uses such all-inclusive language as ‘all documents relating to or referring to the patients,’” which “is not meant to tailor the request to reasonably relevant materials, but rather it was drafted to maximize the material that would fall under the scope of the subpoena.” Op. Br. at 12–13.

28

But as stated earlier, the district court’s modified subpoena limited the inquiry to records from the forty-one patients that “are related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed.” Wilson II, 2023 WL 3006888, at *9. These records are directly relevant to the DEA’s purposes for its investigation—determining whether Wilson had a legitimate medical reason to prescribe controlled substances and whether those prescriptions were written in the usual course of his professional practice.

Wilson asserts that the subpoena should be further narrowed to exclude patients who died from “causes that are wholly orthogonal to [Wilson’s] treatment and care (e.g. car accidents, cancer, suicide, etc.)” and suggests that the subpoena does not account for the death toll from the COVID-19 pandemic. Op. Br. at 15. But this argument ignores the DEA’s purpose for its investigation, which is to determine whether Wilson prescribed or dispensed controlled substances for an illegitimate medical purpose, or outside the normal course of his professional practice. See 21 C.F.R. § 1306.04(a) (stating that, for a prescription to be valid, it must be “issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice”); 21 U.S.C. § 841 (imposing felony penalties for anyone who unlawfully “distribute[s], or dispense[s]” a controlled substance). It does not matter whether the patient receiving the prescription later died from cancer, a car accident, COVID-19, or an overdose: the violations occurred, if they

29

occurred at all, when Wilson wrote the prescriptions or dispensed the substances.

In conclusion, the records sought in the modified subpoena are relevant in purpose.

3. Not Unreasonably Burdensome The subpoena was not unreasonably broad or burdensome. Wilson argues to the contrary but does not explain why producing these limited records would be burdensome. To the extent that Wilson’s relevance arguments above also address the burdensome inquiry of this prong, they are also improperly directed to the pre-narrowed subpoena. Op. Br. at 12–14; Discussion § II(B)(2), supra. As the United States notes, Wilson has already provided many files to the DEA, albeit password-protected. So, to unlock these files, all Wilson need do is provide the DEA his password. Wilson “does not attempt to explain why providing a password and producing some additional records would be unduly burdensome.” Resp. Br. at 29.

The circumstances here are similar to those in Becker, where a state agency subpoenaed medical records from a neurologist for “forty-seven randomly-selected patients between 1995 and 1998.” 494 F.3d at 909. The agency suspected the neurologist of fraudulent billing practices under Utah’s Medicaid program. Id. We concluded that the administrative subpoena met the “minimal requirements for Fourth Amendment reasonableness,” noting that “the records sought were relevant to [the agency’s] investigation of potential

30

up-coding” and that the agency was “able to copy and return the files in a day.” Id. at 917.

Like the subpoena seeking forty-seven patient files in Becker, the subpoena here is not unreasonably burdensome: it seeks all controlled- substance-related records for forty-one of Wilson’s patients, all controlled- substance prescriptions and the identities of patients who received those prescriptions for the five-year period, and beyond that, the total number of patients he saw during that time.

Similarly, in Doe, the Sixth Circuit observed that only one request for certain documents “pose[d] any meaningful burden on Doe.” 253 F.3d at 268. And that was “the request for all professional journals, magazines, and newsletters subscribed to or received by Doe from January 1990 through March 1998.” Id. As to that request, the court observed that “Doe has made no attempt to reach a reasonable accommodation with the government regarding this aspect of the subpoena, an effort the Supreme Court has suggested should be expected before a court is willing to hold an administrative subpoena overly burdensome.” Id. at 268–69 (citing Morton Salt, 338 U.S. at 653). As in Doe, Wilson has not attempted to reach an accommodation with the government to cure any alleged burdensomeness. Wilson does not explain why production would be unreasonably burdensome in his case, and we cannot find support in the law for such a holding under this set of facts.

31

In sum, the subpoena, as narrowed by the district court, was sufficiently limited in scope and relevant in purpose to not be unreasonably burdensome under the Fourth Amendment.

III. The documents requested fall within the required-records exception to the Fifth Amendment’s privilege against self-incrimination.

The Self-Incrimination Clause of the Fifth Amendment provides that “[n]o person . . . shall be compelled in any criminal case to be a witness against himself.” U.S. Const. amend. V. But this protection “applies only when the accused is compelled to make a Testimonial Communication that is incriminating.” Fisher v. United States, 425 U.S. 391, 408 (1976). To be testimonial, “an accused’s communication must itself, explicitly or implicitly, relate a factual assertion or disclose information.” Pennsylvania v. Muniz, 496 U.S. 582, 589 (1990) (citation omitted). The privilege against self- incrimination also protects an accused from providing the state “with evidence of a testimonial or communicative nature.” Id. (citation omitted).

The Supreme Court has recognized that “incriminating evidence may be the byproduct of obedience to a regulatory requirement, such as filing an income tax return” or “maintaining required records.” Hubbell, 530 U.S. at 35 (footnotes omitted). For example, “the act of producing documents in response to a subpoena may have a compelled testimonial aspect” because it may “implicitly communicate” statements of fact, such as an admission that certain “papers existed, were in [the person’s] possession or control, and were

32

authentic.” Id. at 36 (citation omitted). Given this reality, there are “limits which the Government cannot constitutionally exceed in requiring the keeping of records which may be inspected by an administrative agency and may be used in prosecuting statutory violations committed by the recordkeeper himself.” Bouknight, 493 U.S. at 556 (quoting Shapiro v. United States, 335 U.S. 1, 32 (1948)).

But these limits apply to cases where a statute compels production of incriminating evidence: For example, in cases such as Marchetti v. United States, 390 U.S. 39 (1968), Grosso v. United States, 390 U.S. 62 (1968), Haynes v. United States, 390 U.S. 85 (1968), and Leary v. United States, 395 U.S. 6 (1969), the statutes in question “all required information about activities in an area ‘permeated with criminal statutes’ and applied to groups ‘inherently suspect of criminal activities.’” United States v. Reeves, 425 F.2d 1063, 1064 (10th Cir. 1970) (quoting Marchetti, 390 U.S. at 47). Those statutes involved a “wagering tax in Marchetti and Grosso, registration of firearms in Haynes, and marihuana traffic in Leary.” Id. In those cases, the statutes themselves required information that “was incriminating because it admitted conduct generally characterized as criminal” and “[b]y law or practice, the information was made freely available to prosecuting officials.” Id. at 1064–65. In such circumstances, the “hazards of incrimination can only be characterized as real and appreciable,” id. at 1065 (quoting Grosso, 390 U.S. at 67), and so

33

“the timely assertion of the Fifth Amendment privilege was a complete defense to a prosecution for noncompliance with the statutes,” id.

But where a statutory or regulatory scheme requiring records to be kept is not aimed primarily at criminal activities, or at groups inherently suspect of criminal activities, and is “constructed to effect the State’s public purposes unrelated to the enforcement of its criminal laws,” no Fifth Amendment protection applies. Bouknight, 493 U.S. at 556. This is true so long as the regulatory scheme requires that the records be kept “for the benefit of the public, and for public inspection,” and “not for [the recordkeeper’s] private uses.” Id. (quoting Shapiro, 335 U.S. at 17–18). Put another way,

[W]here, by virtue of their character and the rules of law applicable to them, . . . papers are held subject to examination by the demanding authority, the custodian has no privilege to refuse production although their contents tend to criminate him. In assuming their custody he has accepted the incident obligation to permit inspection.

Id. at 558 (quoting Wilson v. United States, 221 U.S. 361, 382 (1911)).

This test has become known as the “required records exception.” In re Doe, 711 F.2d 1187, 1191 (2d Cir. 1983); cf. Shapiro, 335 U.S. at 17, 19 (referring to the “‘required records’ test” and the “required records doctrine” (citation omitted)).

The majority of our sister circuits have embraced the required-records exception, commonly applying it to banking records. See, e.g., United States v. Zhong H. Chen, 815 F.3d 72, 74 (1st Cir. 2016) (applying required-records

34

exception to foreign banking records kept pursuant to the Bank Secrecy Act); United States v. Chabot, 793 F.3d 338, 345 (3d Cir. 2015) (same); In re Grand Jury Subpoena Dated Feb. 2, 2012, 741 F.3d 339, 342–43 (2d Cir. 2013) (same); United States v. Under Seal, 737 F.3d 330, 332–34 (4th Cir. 2013) (same); In re Grand Jury Proceedings, No. 4–10, 707 F.3d 1262, 1265, 1270 (11th Cir. 2013) (same); In re Grand Jury Subpoena, 696 F.3d 428, 430–31 (5th Cir. 2012) (same); In re Special February 2011–1 Grand Jury Subpoena Dated September 12, 2011, 691 F.3d 903, 904 (7th Cir. 2012) (same); In re M.H., 648 F.3d 1067, 1069 (9th Cir. 2011) (same).

Similarly, we have distinguished Marchetti and Grosso to hold that the production of tax records does not implicate the Fifth Amendment. See Pauldino v. United States, 500 F.2d 1369, 1370–72 (10th Cir. 1974) (affirming district court’s admission of tax returns as evidence in a gambling trial because those records were kept “pursuant to a reasonable regulatory scheme” (quoting United States v. Silverman, 449 F.2d 1341, 1345 (2d Cir. 1971)); Reeves, 425 F.2d at 1064 (rejecting self-incrimination defense for violations of federal liquor tax laws where licensees were required to keep records by statute); cf. United States v. One Coin-Operated Gaming Device, 648 F.2d 1297, 1300 (10th Cir. 1981) (reversing district court’s application of required-records exception to tax records kept by slot-machine operators because “use of these machines for gambling purposes [was] . . . extensively prohibited” and so the federal tax was “directed at a small group of people whose activities were

35

inherently suspect,” making the production of records incriminatory (citation omitted)).

And other courts have applied it to a variety of other statutorily-required records, from odometer records kept by automobile dealers, see In re Grand Jury Subpoena Duces Tecum Served Upon Underhill, 781 F.2d 64, 65 (6th Cir. 1986), to escrow deposit records kept by real estate brokers, see In re Grand Jury Subpoena to Custodian of Recs., Mid-City Realty Co., 497 F.2d 218, 219, 221 (6th Cir. 1974), to W-2 forms kept by taxpayers, see In re Doe, 711 F.2d at 1191, and to passports and I-94 forms kept by immigrants, see Rajah v. Mukasey, 544 F.3d 427, 441–42 (2d Cir. 2008).

Most pertinently here, three circuits have applied it to the production of medical and prescription records. See, e.g., In re Grand Jury Proc., 801 F.2d 1164, 1166–68 (9th Cir. 1986) (applying required-records exception to prescription-drug records where physician was suspected of prescribing and dispensing anabolic steroids and androgenic hormones without a legitimate medical purpose); In re Kenny, 715 F.2d 51, 52–53 (2d Cir. 1983) (applying required-records exception to medical and x-ray records—but not business records—where chiropractor was suspected of fraudulent billing practices); In re Doe, 711 F.2d at 1190–92 (applying required-records exception, inter alia, to Schedule II prescription records where psychiatrist was suspected of illegal distribution of narcotics); In re Grand Jury Subpoena Duces Tecum, 105 F.3d 659, 1997 WL 12126, *1–4 (6th Cir. 1997) (unpublished table decision)

36

(applying required-records exception to Medicare and Medicaid patient files— but not to other patient files—where podiatrist was suspected of fraudulent billing).

Wilson does not argue on appeal that the district court erred in applying the required-records exception, and so he has waived any such challenge; nevertheless, we exercise our discretion to affirm the district court on that basis. See Margheim v. Buljko, 855 F.3d 1077, 1088 (10th Cir. 2017) (“[W]hen a party waives an issue, our precedent affords us discretion to raise and decide issues sua sponte, even for the purpose of reversing a lower-court judgment.” (cleaned up)). Wilson reasserts on appeal “his Fifth Amendment privilege against self-incrimination on grounds that the production as demanded in the Subpoena would require testimonial admissions.” Op. Br. at 19. And he argues that “the act of production per se can invoke Fifth Amendment protections.” Id. at 18. Without the required-records exception, Wilson’s invocation of the Self- Incrimination Clause—conclusory though it is—might have some merit. See Bouknight, 493 U.S. at 555 (“The Fifth Amendment’s protection may nonetheless be implicated because the act of complying with the government’s demand testifies to the existence, possession, or authenticity of the things produced.”); In re Doe, 711 F.2d at 1195 (Friendly, J., concurring in part and dissenting in part) (“[A]part from the required records exception, Dr. Doe could successfully invoke the self-incrimination privilege against production of these

37

files.”). So, we examine whether the required-records exception to the Fifth Amendment privilege applies in these circumstances.

We apply the test as articulated in Kenny, which we find more appropriate to the circumstances before us than the language in Grosso 1:

To satisfy th[e] [required records] exception, the subpoenaed documents (1) must be maintained pursuant to an administrative scheme that is essentially regulatory; (2) must be of a kind which the regulated party has customarily kept; and (3) must have assumed public aspects which render them at least analogous to public documents.

Kenny, 715 F.2d at 53 (cleaned up). Because the reach of the required-records exception is a factual inquiry, we apply the test to the specific facts of this case. We conclude that it applies in these particular circumstances.

1 In Grosso, the statute at issue required payment of federal excise tax for wagering—an illegal activity where the defendant lived. 390 U.S. at 63–65. The defendant contended that “payment of the excise tax would have required him to incriminate himself,” and so he argued that he “may not properly be prosecuted for willful failure to pay the tax or for conspiracy to evade its payment.” Id. at 64. The Court agreed. See id. at 64, 72. In that context, “the statutory obligations [were] directed almost exclusively to individuals inherently suspect of criminal activities,” and the United States’ “inquiry” in that case was the excise-tax statute itself, not a regulatory scheme requiring recordkeeping. Id. at 68.

The Court’s three-part test to determine whether the required-records exception applies in any given situation is: (1) “[T]he purposes of the United States’ inquiry must be essentially regulatory”; (2) the “information is to be obtained by requiring the preservation of records of a kind which the regulated party has customarily kept”; and (3) “the records themselves must have assumed ‘public aspects’ which render them at least analogous to public documents.” Id. at 67–68 (citing Shapiro, 335 U.S. at 1).

38

A. The subpoenaed records are maintained under an essentially regulatory scheme.

The New Mexico Professional Psychologist Act, N.M. Stat. Ann.

§§ 61-9-1 to -19, is codified alongside statutes governing other professionals such as nurses, physicians, dentists, counselors, physical therapists, veterinarians, engineers, accountants, and architects, to name a few, see generally id. §§ 61-1-1 to -38-15. The statutory scheme outlines licensure requirements and disciplinary procedures. See, e.g., id. § 61-9-4.1 (requiring license for practice of psychology); id. § 61-9-7 (requiring licensure and licensure-renewal fees); id. § 61-9-11 (describing education, training, and examination requirements for licensure); id. § 61-9-13 (providing for licensure denial, revocation, and suspension); id. § 61-9-14 (providing penalties for violations of licensing requirements or other provisions of the Act). 2 The Act authorizes the State’s Board of Psychologist Examiners to “promulgate rules . . . to carry into effect the provisions of the Professional Psychologist Act,” including a “code of conduct for psychologists.” Id. § 61-9-6(B)(1); see id. § 61-9-3(A). These rules “establish[] the standards against which the required professional conduct of a psychologist is measured.”

2 The required-records exception applies equally to state regulatory schemes as to federal. See In re Kenny, 715 F.2d at 54 (“If records are required to be maintained pursuant to valid regulatory programs, whether under state law or under federal law, those records will be subject to compelled production . . . .” (cleaned up)).

39

N.M. Admin. Code § 16.22.2.6. Among other things, this regulatory scheme requires psychologists to “maintain professional records that include”:

(a) the presenting problem(s) or the reason the client(s) or patient(s) sought the psychologist’s services;

(b) diagnosis and clinical formulation;

(c) the fee arrangement;

(d) the date and substance of each billed contact or service;

(e) any test results or other evaluative results obtained and any basic test data from which they were derived;

(f) notation and results of formal consultations with other providers;

(g) a copy of all test or other evaluative reports prepared as part of the professional relationship; [and]

(h) the date of termination of services.

Id. § 16.22.2.8(G)(1)(a)–(h). And psychologists must maintain these records for five years. Id. § 16.22.2.8(G)(2).

Prescribing psychologists are subject to further laws and regulations: to prescribe controlled substances, a psychologist must hold a “valid prescription certificate.” N.M. Stat. Ann. § 61-9-3(E); see id. §§ 61-9-3(F) (defining “prescription certificate”), (G) (defining “psychotropic medication”). A prescribing psychologist must keep “[r]ecords of all prescriptions” in patient files. Id. § 61-9-17.2(G). Before prescribing a controlled substance, a psychologist must review a patient’s “prescription monitoring report,” which lists all prescriptions received by that patient during the previous twelve

40

months. N.M. Admin. Code § 16.22.30.8(C). The psychologist must “document the receipt and review of such reports in the patient’s medical record,” id., and must review a patient’s prescription-monitoring report “a minimum of once every three months during a patient’s continuous use of a controlled substance,” id. § 16.22.30.8(D).

As part of the prescription-monitoring duties, the prescribing psychologist must “identify, document, and attempt to remain current” with all of a patient’s prescriptions, if the patient is known to be “receiving opioids and benzodiazepines concurrently” or “exhibiting potential for abuse or misuse of . . . controlled substances,” for example. Id. § 16.22.30.8(F)(2), (5). One indicator of the abuse or misuse of such substances is the “request[] to pay cash when insurance is available.” Id. § 16.22.30.8(F)(5)(d). If suspecting such abuse, the psychologist should “take action” to prevent “misuse, abuse, or overdose” and “document [these] actions.” Id. § 16.22.30.8(G).

Under the Uniform Licensing Act, New Mexico authorizes the State Board of Psychologist Examiners to subpoena these records. See N.M. Stat. Ann. §§ 61-1-4(A), 61-1-9(A); N.M. Admin. Code § 16.22.11.8(C)(4). If a psychologist refuses to respond to a subpoena, the “secretary of the board may apply to the district court . . . for an order directing that person to take the requisite action.” N.M. Stat. Ann. § 61-1-10.

We easily conclude that this extensive scheme is “essentially regulatory”

and not primarily designed to root out criminal behavior. Kenny, 715 F.2d at 53

41

(cleaned up). And this regulatory scheme requires records to be kept for “regulatory, not criminal” purposes. In re Grand Jury Proc., 801 F.2d at 1168. Unlike the groups targeted by incriminatory statutes in Grosso, Marchetti, Haynes, and Leary, psychologists are not “inherently suspect of criminal activities,” and the practice of psychology is not an area “permeated with criminal statutes.” Marchetti, 390 U.S. at 47 (citation omitted). Though the Act makes it a “misdemeanor” to practice psychology without a license; to practice under a “suspended, revoked or lapsed” license; or to “otherwise violate the provisions of the Professional Psychologist Act,” N.M. Stat. Ann. § 61-9-14(A)(1)–(3), this penalty provision does not make the whole regulatory scheme criminal in nature. The State has an interest in regulating the profession of psychology separate from its interest in preventing criminal conduct by psychologists.

As a psychologist licensed to practice in New Mexico, Wilson had to comply with the State’s statutory and regulatory scheme to maintain his license to practice psychology and to prescribe controlled substances, including with regulations that require him to keep patient records, medical records, prescription records, and billing records. See N.M. Admin. Code. § 16.22.2.6. We therefore conclude that these requirements are “essentially regulatory” rather than criminal, which satisfies the first prong of the required-records exception. Kenny, 715 F.2d at 53 (cleaned up).

42

B. The information requested is of a kind that the regulated party customarily keeps.

Psychologists licensed in the State of New Mexico are required to “maintain professional records that include,” in relevant part, information about a patient’s “presenting problem(s),” “diagnosis and clinical formulation,” “fee arrangement[s],” the “date and substance of each billed contact or service,” and “any test results or other evaluative results.” N.M. Admin. Code § 16.22.2.8(G)(1). Psychologists must maintain these records for five years. Id. § 16.22.2.8(G)(2). A prescribing psychologist also must keep “[r]ecords of all prescriptions” in patient files, N.M. Stat. Ann. § 61-9-17.2(G), and document any signs of controlled-substance misuse or abuse, N.M. Admin. Code § 16.22.30.8(F), (G).

The modified subpoena requests a “list of all patients in the last five years to whom Dr. Wilson prescribed controlled substances” and “all controlled substance prescriptions written for those patients.” Wilson II, 2023 WL 3006888, at *9. These are records a psychologist is required to—and therefore must customarily—keep, to comply with N.M. Admin. Code §§ 16.22.2.8(G)(1) and 16.22.30.8(F). Similarly, “all documents and information in the patient files, billing statements, and communications that are related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed,” Wilson II, 2023 WL 3006888, at *9, should be customarily kept under N.M. Admin. Code §§ 16.22.2.8(G)(1) and 16.22.30.8(C), (D), and (F).

43

Specifically, billing statements (and some communications) would be “records that include” the “fee arrangement” and “the date and substance of each billed contact or service,” which are required to be kept under § 16.22.2.8(G)(1)(c)–(d). And any communications between Wilson and his patients “related to the patient’s treatment for a condition or diagnosis for which a controlled substance was prescribed,” Wilson II, 2023 WL 3006888, at *9, would fall under that regulation’s requirement that he keep records including “the presenting problem(s) or the reason the client(s) or patient(s) sought [his] services” and records that include information about “diagnosis and clinical formulation,” N.M. Admin. Code § 16.22.2.8(G)(1)(a)–(b). Wilson is also required to keep communications regarding controlled substances as part of his prescription-monitoring duties where a patient is “known to be . . . receiving opioids and benzodiazepines concurrently.” Id. § 16.22.30.8(F). In those cases, and if he suspects misuse or abuse of controlled substances, he must “identify, document, and attempt to remain current with regard to all prescriptions” for those patients. Id.

The modified subpoena also requests “any laboratory work (including urinalysis records) pertaining to the diagnosis or treatment because of which a controlled substance was prescribed.” Wilson II, 2023 WL 3006888, at *9. To the extent that a prescription-monitoring report customarily includes laboratory work, such as urinalysis records, N.M. Admin. Code § 16.22.30.8(C)–(D) requires that documentation of such reports and records be customarily kept.

44

And to the extent that “test results or other evaluative reports” may contain laboratory work and urinalysis records, those records must also be customarily kept under § 16.22.2.8(G)(1)(e). 3 We therefore conclude that the modified subpoena satisfies the second prong of the required-records exception.

C. The documents have assumed public aspects which render them analogous to public documents.

Documents assume public aspects when they are required to be kept “for the benefit of the public and for public inspection.” Shapiro, 335 U.S. at 17–18; see Grosso, 390 U.S. at 68. So “if the government’s purpose in imposing the regulatory scheme is essentially regulatory, then it necessarily has some ‘public aspects.’” In re M.H., 648 F.3d 1067, 1076 (9th Cir. 2011) (quoting Shapiro, 335 U.S. at 33).

Though the medical records sought here “are typically considered private,” this “does not bar them from possessing the requisite public aspects.”

3 At oral argument, the United States posited that “the absence of [urinalysis] reports would additionally demonstrate whether [Wilson] was conducting appropriate procedures to determine whether to prescribe those controlled substances.” Oral Argument at 15:47–57. Wilson responded that, in Wilson’s type of practice, unlike in methadone clinics, “there are no . . . regulations or mandates” to conduct urinalysis testing once a month. Id. at 16:44–55. Wilson then criticized the Declaration for “insinuat[ing] that Dr. Wilson had these requirements and that he could be held criminally liable if his patients didn’t take the medications as prescribed.” Id. at 16:55–17:04. But Wilson did not argue in his briefing or at oral argument that urinalysis testing reports, if they exist, need not be customarily kept under New Mexico’s regulatory scheme.

45

In re Grand Jury Proc., No. 4-10, 707 F.3d 1262, 1273 (11th Cir. 2013) (quoting In re Grand Jury Subpoena, 696 F.3d 428, 436 (5th Cir. 2012)); see also Kenny, 715 F.2d at 53 (ruling that patient records kept for review of medical professionals have “‘public aspects’ sufficient for purposes of the required records exception”). Like the subpoenaed medical records in Kenny that were required to be kept and to be disclosed under a regulatory scheme, so too here the requested controlled-substance-related medical and other patient records have “public aspects” because they are required to be kept by New Mexico statutes and regulations. Kenny, 715 F.2d at 53. They also must be disclosed to the Board of Psychologist Examiners when the Board issues a subpoena for disciplinary or other investigative reasons. See N.M. Stat. Ann. § 61-1-10; N.M. Admin. Code § 16.22.2.19(E). As a prescribing psychologist, Wilson is required to keep these records for inspection by the Board of Psychologist Examiners, and the Board inspects these records to ensure compliance with New Mexico’s professional standards.

The concurrence echoes Judge Friendly’s partial dissent in In re Doe, which suggests that “[p]atient files would seem . . . to be the antithesis of a record with ‘public aspects,’” because “[t]hey typically contain intimate details with respect to physical or psychological ailments . . . which patients are reticent in revealing and the secrecy of which physicians are sworn to protect.” 711 F.2d at 1197 (Friendly, J., concurring in part and dissenting in part); see Concurring Op. at 3, infra. Expressing similar concerns, Wilson objected that

46

the United States “is seeking private records containing intimate details belonging to patients but held in trust by [Wilson],” and admonished us to “concern ourselves with both the privacy interests of the patients and of Dr. Wilson, especially given his obligations and duties to his patients,” Op. Br. at 11–12.

But these sound to us like qualms about patient privacy, not physician incrimination. 4 As discussed above, the district court considered Wilson’s patients’ privacy interests when it narrowed the subpoena to comply with HIPAA, see Discussion § I, supra, and when it ordered the documents be produced “under seal with no access except to the United States Attorney’s Office, the agents involved in the DEA investigation of Dr. Wilson, and the

4 Congress enacted HIPAA in 1996—thirteen years after In re Doe—in part to protect patient information from unauthorized or unwarranted disclosures; its implementing regulations include an exception for law-enforcement purposes. See Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996); 45 C.F.R. § 164.512.

As the Court observed in Whalen v. Roe, though many of society’s laws “require the orderly preservation of great quantities of information, much of which is personal in character and potentially embarrassing or harmful if disclosed,” the same laws that allow the “collect[ion] and use [of] such data for public purposes” are “typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures.” 429 U.S. 589, 605 (1977); see also Nat’l Aeronautics & Space Admin. v. Nelson, 562 U.S. 134, 147, 157 (2011) (repeating Whalen’s assumption that “the Government’s challenged inquiries implicate a privacy interest of constitutional significance” but noting Whalen’s approval of “statutory or regulatory protections against unwarranted disclosures” that need not be “ironclad . . . to satisfy privacy interests” (cleaned up)).

47

Government’s retained expert in this matter,” Wilson II, 2023 WL 3006888, at *9.

Patient-privacy concerns aside, the concurrence questions whether “an administrative agency. . . [can] override the Fifth Amendment simply by issuing a regulation requiring retention of particular records[.]” Concurring Op. at 4, infra. Quoting an oft-cited passage from Shapiro, Judge Friendly answered that question in the affirmative—an administrative agency may do so when “there is a sufficient relation between the activity sought to be regulated and the public concern so that the Government can constitutionally regulate or forbid the basic activity concerned, and can constitutionally require the keeping of particular records, subject to inspection by the Administrator.” In re Doe, 711 F.2d at 1198 (Friendly, J., concurring in part and dissenting in part) (quoting Shapiro, 335 U.S. at 32). 5 Here, New Mexico statutes and regulations clearly indicate a sufficient connection between controlled-substance prescriptions and “public concern” to justify the keeping and production of those types of records. Shapiro, 335 U.S. at 32. Judge Friendly’s critique holds less traction against the modified

The concurrence speculates that “the present Supreme Court, with its

5

concerns about regulatory overreach” would resonate with Judge Frankfurter’s dissent in Shapiro, implying that the Court is poised to overrule the required- records exception. Concurring Op. at 3–4, infra. But until we read the Court’s opinion doing so, we decline to read its tea leaves. We’ll await word from the Court itself.

48

subpoena at issue on appeal than it might have done against the pre-narrowed subpoena Wilson originally challenged. Unlike one of the subpoenas in In re Doe, which “required Dr. Doe to produce all patient files relating to persons purportedly treated by him . . . between August 1981 and June 1982,” 711 F.2d at 1194 (Friendly, J., concurring in part and dissenting in part) (emphasis added), here the modified subpoena requests only documents that are related to controlled-substance prescriptions or to conditions or diagnoses for which the controlled substances were prescribed, Wilson II, 2023 WL 3006888, at *9.

For all these reasons, we conclude that the records requested have “public aspects” satisfying the required-records exception’s third prong.

Because the required-records exception applies here, the Fifth Amendment’s privilege against self-incrimination does not shield Wilson from complying with the modified subpoena. 6

CONCLUSION

We affirm the district court’s order granting in part the United States’

petition to enforce the administrative subpoena and ordering Wilson’s compliance with the modified subpoena.

6 The United States also argues that Wilson waived his Fifth Amendment privilege by producing some records. Because we affirm the district court on the required-records exception, we need not reach the United States’ waiver arguments.

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 49

23-2073, United States v. Wilson HARTZ, J., concurring I join Judge Phillips’s opinion except for the discussion of the limitation on the privilege against self-incrimination generally referred to as the required-records exception. The discussion is wholly unnecessary because Wilson’s opening brief on appeal waived any objection to the district court’s reliance on the exception. And I would think it the more prudent course to refrain from entrenching in a published opinion a doctrine of doubtful merit, particularly (1) in the context of this case and (2) when the panel opinion goes further than the Supreme Court has been willing to go in limiting the self-incrimination privilege under the required-records exception.

That Wilson waived the required-records issue is undebatable. All that his opening appellate brief says on the subject is in the following paragraph, which discusses In re Kenny, 715 F.2d 51 (2nd Cir. 1983), the authority relied on by the district court in applying the required-records exception. Rather than challenging the district court’s application of the exception, the brief essentially concedes the point, saying that the subpoena nevertheless must still satisfy Fourth Amendment requirements:

Even if the case of In re Kenny, 715 F.2d 51 (2nd Cir. 1983), cited by the District Court, has some applicability here, it does not compel the production of documents through an overly broad subpoena. The Kenny Court still partially granted a motion to quash the subpoena due to it being overly broad. Id. The Kenny case does not turn an overbroad subpoena into a more narrow one simply by its citation. The Government must still show that the subpoena meets the “reasonable relevance” standard, and show that “(1) the subpoena is within the statutory authority of the agency; (2) the information sought is reasonably relevant to the inquiry; and (3) the demand is not unreasonably broad or burdensome.” See [United States v.] Zadeh, 820 F.3d 746[,] 755 [5th Cir. 2016]. The Subpoena fails to meet the second and

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 50

third prongs. In Re Kenny does not convert an otherwise invalid subpoena into a valid one. Enforcement of the subpoena would violate the Fifth Amendment.

Aplt. Br. at 19–20. With this concession Wilson has waived any challenge to one of the alternative grounds for denying his Fifth Amendment claim. We could therefore affirm denial of the claim on that procedural ground alone.

Of course, this court has discretion to address an issue even if a party has waived its right to require us to address it. But I would not do so in this case. All the discussion in the majority opinion does is entrench in this circuit the application of a questionable doctrine in particularly questionable circumstances.

The required-records doctrine eliminates any protection against self-incrimination when one is compelled to produce certain “required records.” The premises of the doctrine have been described as follows:

[F]irst, the purposes of the United States’ inquiry must be essentially regulatory; second, information is to be obtained by requiring the preservation of records of a kind which the regulated party has customarily kept; and third, the records themselves must have assumed “public aspects”

which render them at least analogous to public documents.

Grosso v. United States, 390 U.S. 62, 67–68 (1968). The doctrine has not been universally admired, particularly its reliance on the third premise. The leading case on the matter, Shapiro v. United States, 335 U.S. 1 (1948), was a 5-4 decision with vigorous dissents, including one from Justice Frankfurter, who wrote, “If records merely because required to be kept by law ipso facto become public records, we are indeed living in glass houses,” id. at 51 (Frankfurter, J., dissenting), and, “[i]f Congress by the easy device of requiring a man to keep the private papers he has

Page 2

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 51

customarily kept can render such papers ‘public’ and non-privileged, there is little left to either the right of privacy or the constitutional privilege,” id. at 70.

Judge Friendly, partially dissenting in a case pretty much on all fours with this one, questioned applying the doctrine to medical records:

Patients’ files would seem, almost by description, to be the antithesis of a record with ‘public aspects.’ They typically contain intimate details with respect to physical or psychological ailments, diagnoses, and treatments which patients are reticent in revealing and the secrecy of which physicians are sworn to protect. . . .

To hold that this particularized lifting of privacy directed by New York makes the files subject to compulsory production on behest of the United States in a grand jury investigation of violation of the narcotics laws would expand the public records exception considerably beyond the facts of Shapiro.

In re Doe, 711 F.2d 1187, 1197 (2d Cir. 1983) (Friendly, J., dissenting in part) (footnote omitted). 1 I would think that the sentiments of Justice Frankfurter and Judge Friendly might find resonance in the present Supreme Court, with its concerns about regulatory

1 The panel opinion pooh-poohs concerns for patient records, saying that they “sound to us like qualms about patient privacy, not physician incrimination.” Maj. Op. at 46. But this comment reveals a misunderstanding of the privilege against self- incrimination and the impact of the required-records exception. The incriminating nature of records one is ordered to produce is not the concern of the Fifth Amendment. “A person may not claim the Amendment’s protections based upon the incrimination that may result from the contents or nature of the thing demanded.” Baltimore City Dep’t of S.S. v. Bouknight, 493 U.S. 549, 555 (1990). Rather, the privilege against self- incrimination arises “because the act of complying with the government’s demand testifies to the existence, possession, or authenticity of the things produced.” Id. The required-records exception says that these testimonial features of compliance do not raise constitutional concerns when the records being produced are essentially “public.” Judge Friendly’s complaint was with characterizing patient records as “public” under the exception.

Page 3

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 52

overreach. Can an administrative agency, as in this case, override the Fifth Amendment simply by issuing a regulation requiring retention of particular records?

Indeed, one could reasonably infer that the Supreme Court has been wary of the required-records exception for quite some time. The cases that can be read to say that the exception overcomes any invocation of the privilege against self-incrimination are more than half a century old. And consider its most recent discussion of the doctrine, Baltimore City Department of Social Services v. Bouknight, 493 U.S. 549 (1990). The Supreme Court invoked the doctrine to hold that a mother, who had custody of her child under a court order placing the child under the oversight of city social services, could be ordered to disclose the child’s location. But it declined to say that the doctrine fully negated her Fifth Amendment interests. It wrote, “We are not called upon to define the precise limitations that may exist upon the State’s ability to use the testimonial aspects of Bouknight’s act of production in subsequent criminal proceedings. But we note that imposition of such limitations is not foreclosed.” Id. at 561. As the Court explained:

The same custodial role that limited the ability to resist the production order may give rise to corresponding limitations upon the direct and indirect use of that testimony. The State’s regulatory requirement in the usual case may neither compel incriminating testimony nor aid a criminal prosecution, but the Fifth Amendment protections are not thereby necessarily unavailable to the person who complies with the regulatory requirement after invoking the privilege and subsequently faces prosecution.

Id. at 561–62 (citation omitted). The opinion continues with citations to several precedents providing use immunity to those compelled to disclose information in civil proceedings. But it begins with the following suggestive citation and parenthetical: “See Marchetti [v. United States], 390 U.S. [39,] 58–59 [(1968)], (the ‘attractive and

Page 4

Appellate Case: 23-2073 Document: 010111031926 Date Filed: 04/15/2024 Page: 53

apparently practical’ course of subsequent use restriction is not appropriate where a significant element of the regulatory requirement is to aid law enforcement).” Id. at 562. I think two reasonable inferences from the discussion and, in particular, the Marchetti parenthetical are (1) in any future criminal prosecution of Wilson, the government may not be able to use the testimonial components of his compliance with the subpoena, and (2) the required-records exception does not apply to the subpoena if “a significant element of the [CSA] requirement is to aid law enforcement,” an issue not adequately addressed by the panel majority.

The panel majority should have let sleeping dogs lie.

Page 5