Whalen v. Roe: Privacy Rights and Prescription Monitoring

Whalen v. Roe, 429 U.S. 589 (1977), is the Supreme Court decision that upheld a New York law requiring doctors to report the names of patients receiving certain powerful prescription drugs to a state database, and in the process established the constitutional framework courts still use to evaluate government collection of sensitive personal information. Decided unanimously on February 22, 1977, the opinion by Justice Stevens recognized two distinct privacy interests under the Fourteenth Amendment but concluded that neither was violated when the state collects personal data for a legitimate purpose and protects it with adequate security.¹

The New York Law at Issue

The New York State Controlled Substances Act of 1972 targeted Schedule II drugs, a category that includes opium derivatives and stimulants like amphetamines. These substances have legitimate medical uses but carry a high risk of abuse, and before 1972 New York had no reliable way to track how they moved from doctors to patients. Stolen prescriptions circulated freely, patients could visit multiple doctors for the same drug, and pharmacists could refill prescriptions without detection.¹

Under the 1972 law, every Schedule II prescription had to be written in triplicate on an official state form. The doctor kept one copy, the pharmacist kept the second, and the third went to the New York State Department of Health in Albany. No prescription could exceed a 30-day supply, and refills were prohibited. Each form identified the prescribing physician, the dispensing pharmacy, the drug and dosage, and the patient’s name, address, and age. In Albany, the data was coded and recorded onto magnetic tapes for computer processing, and the original forms were held in a vault for five years before destruction.²

The statute made unauthorized disclosure of a patient’s identity a crime punishable by up to one year in prison and a $2,000 fine. Access to the data was restricted to a small group of health department staff and investigators, and disclosure was permitted only for enforcement purposes, under a judicial subpoena in a criminal investigation, or to a regulatory agency with authority over controlled substances.²

What the Patients and Doctors Argued

A group of patients and physicians challenged the reporting requirement on two related grounds. They argued first that having a patient’s name linked to a powerful narcotic in a government computer threatened to expose deeply private medical information and invited social stigma or professional consequences. They argued second that the requirement interfered with personal autonomy by discouraging people from seeking medically necessary treatment.²

Some of these fears had support in the record. Parents worried about stigma to their children, and at least one had discontinued a child’s Schedule II medication because of the reporting requirement. Adult patients described a fear of disclosure, and one had begun purchasing his drugs in another state. A physician had stopped prescribing Schedule II drugs entirely. Even so, roughly 100,000 Schedule II prescriptions were being filled each month in New York before the district court blocked the name-reporting provisions.²

A three-judge federal district court sided with the challengers, holding that the doctor-patient relationship falls within a zone of privacy entitled to constitutional protection and that the patient-identification provisions were too broad. New York’s Commissioner of Health, Robert P. Whalen, appealed directly to the Supreme Court.¹

The Supreme Court’s Ruling

The Court reversed and upheld the law in its entirety. Justice Stevens, writing for a unanimous Court, held that the reporting requirement was a reasonable exercise of New York’s police power and that neither the actual nor the threatened impact on patients was severe enough to constitute a constitutional violation. The Court emphasized that public disclosure of patient identities was prohibited and that access was limited to a small number of health officials, and it treated the statute’s security provisions as central to the analysis.¹

The Court acknowledged that some patients experienced genuine anxiety about the database but concluded that this discomfort did not amount to a constitutional injury. It also rejected the physicians’ separate claim that the statute impaired their right to practice medicine free from unwarranted state interference, finding that argument without merit.²

The opinion was careful to limit its reach. The Court explicitly declined to decide what would happen if the government disclosed collected data without authorization or operated a system without comparable security. Those questions were left open.¹

The Two Privacy Interests the Opinion Identified

The most lasting part of Whalen is the analytical framework Justice Stevens created. Earlier privacy cases had blended distinct concerns together, and the opinion pulled them apart. It identified two constitutional privacy interests: the individual interest in avoiding disclosure of personal matters, and the interest in independence in making certain kinds of important decisions.¹

The first, often called informational privacy, addresses the government’s power to collect and store personal data. The second, decisional privacy, covers the autonomy cases involving matters like contraception and family planning. Naming these interests separately gave lower courts a vocabulary for analyzing privacy challenges that did not fit cleanly under earlier decisions.

The Concurrences

Justice Brennan joined the majority but wrote separately to flag a concern about the future. He agreed that limited reporting requirements in medicine were familiar and not generally regarded as invasions of privacy, but he was troubled by centralized computer storage of the collected data. In his view, the Constitution limits not only what the government may gather but also how it stores that information. He wrote that “central storage and easy accessibility of computerized data vastly increase the potential for abuse” and that he was “not prepared to say that future developments will not demonstrate the necessity of some curb on such technology.” Broad dissemination of the data by state officials, he added, would clearly implicate constitutionally protected privacy rights and would presumably require a compelling state interest.²

Justice Stewart concurred as well but took a narrower view. Citing Katz v. United States, he emphasized that the Constitution contains no “general constitutional ‘right to privacy'” and that protection of a person’s general right to be let alone is left largely to state law. His concurrence signaled that at least one justice viewed the privacy analysis as more constrained than the majority’s language might suggest.¹

What Whalen Means Today

Whalen settled the constitutional question that made modern prescription drug monitoring possible. By holding that the government can collect sensitive medical data when the purpose is legitimate and the security is adequate, the decision removed the legal barrier that might otherwise have blocked comprehensive drug-tracking systems. Every state and the District of Columbia now operates a Prescription Drug Monitoring Program, and most cover a broader range of controlled substances than the Schedule II drugs at issue in the case.

The informational privacy framework itself remains unfinished. When the Supreme Court revisited the concept in NASA v. Nelson (2011), it assumed without deciding that the constitutional privacy interest described in Whalen actually exists, but declined to definitively establish it as a recognized right. The Court held that even if the right exists, it does not prevent the government from asking reasonable questions in an employment background investigation when those inquiries are subject to Privacy Act safeguards against disclosure.³

The result is a peculiar situation. Lower federal courts regularly apply the Whalen framework when evaluating government data collection, yet the Supreme Court has never fully confirmed that the right it described is enforceable. Justice Brennan’s 1977 warning about centralized computer storage has proved prescient in an era of large government databases, data breaches, and interconnected digital records. The security measures the Court found adequate in 1977 bear no resemblance to modern cybersecurity requirements under frameworks like the HIPAA Security Rule, and whether the constitutional analysis should evolve alongside the technology is a question the Court has so far declined to answer.

1
Justia U.S. Supreme Court Center. Whalen v. Roe, 429 U.S. 589 (1977)
2
Legal Information Institute. Whalen v. Roe, 429 U.S. 589 (1977)
3
Justia U.S. Supreme Court Center. NASA v. Nelson, 562 U.S. 134 (2011)