Texas AG Ken Paxton Can Access Your Prescription Records

Ken Paxton and other Republican officials can access your prescription records without a warrant and use it to target you and your healthcare as he's done with gender affirming care.

Early last fall, Texas Attorney General Ken Paxton sued Dallas pediatrician, Dr. May Lau for providing gender-affirming medical care to teens. The lawsuit accused Dr. Lau of prescribing testosterone to “at least 21” minors between the ages of 14 and 17, in an alleged defiance of a new state ban on providing gender affirming care to trans youth. Lau’s medical license is now on the line under Texas’ Senate Bill 14, which prohibits hormone therapy for transgender youth and requires the state medical board to revoke any doctor who violates it. Within weeks, Paxton’s office filed similar suits against two more physicians, branding them “scofflaws” and “radical gender activists” for treating adolescents with puberty blockers and hormones. By February, Paxton boasted that he had effectively shut down these three doctors’ ability to practice: two agreed to stop treating patients entirely, and a third is under court injunction barring any care for trans youth.

Paxton’s lawsuits are the first enforcement of Texas’s new transgender health restrictions. What is not immediately apparent is how it is a striking example of how government officials can weaponize private prescription records to target anyone they want. At the heart of these cases lies a statewide database that quietly logs every controlled substance dispensed to Texans: the Prescription Drug Monitoring Program ("PDMP"). The database enabling this crackdown was never billed as a tool for political persecution. PDMP's were originally established in the 2000s to combat the opioid epidemic and “doctor shopping” for narcotics. Every U.S. state and territory now maintains a PDMP – an electronic registry of controlled substance prescriptions, typically Schedules II through V, that doctors and pharmacies are required to report.

Testosterone, classified as a Schedule III controlled substance, is automatically tracked in the PDMP database. Although the attorney general’s complaints do not spell out how these physicians were caught, the detailed counts of their underage hormone prescriptions and the fact that virtually all of the patients were transmasculine points to the usage of the PDMP to find providers still prescribing hormones to trans youth. The reason for this is that Estrogen is not a controlled substance and is not subject to PDMP surveillance.

The PDMP itself is administered by the Texas State Board of Pharmacy. Within the system run by regulators, authorized personnel can query exactly which providers are prescribing a given drug, and even filter by patient age or other criteria. Paxton’s investigators appear to have combed through Texas’s pharmacy records for evidence that certain doctors continued providing testosterone to minors after the ban took effect, evidence they are now using to sue the providers and strip their licenses.

I submitted a Texas Public Information Act in November 2024 to query whether the Board was participating in an investigation or otherwise was used to access records for trans youth. The responses seemingly confirmed that the State Board of Pharmacy was complying with Paxton's requests for access to the PDMP. The full responses I received are at the bottom of the article.

From the initial confirmation I received on November 1, 2024.

"On October 21, 2024, the Texas State Board of Pharmacy (“TSBP”) received your two requests under the Texas Public Information Act (the “Act”) for specified categories of information related to testosterone prescriptions for minors, gender dysphoria, and compliance with Senate Bill 14."
. . .
"We have enclosed public information responsive to your request. We believe the remaining information responsive to your request is confidential. We have requested that the Open Records Division of the Office of the Attorney General issue a ruling as to whether this information may be withheld under the Act."

I subsequently received a ruling from the Attorney General's office that seemingly confirmed the documents I was seeking were barred from release due to being part of an active investigation.

"The information indicated consists of compilations of evidence created in the course of investigating and gathering evidence concerning alleged violations of the Texas Pharmacy Act or a Board Rule. The documents at issue are part of TSBP’s investigative files."
. . .
"Information or material compiled by the board in connection with an investigation, including an investigative file of the board, is confidential... including disclosure, discovery, or subpoena... to anyone other than the board or a board employee or board agent involved in discipline of a license holder."

While no smoking gun exists from the public information requests link the lawsuits specifically to the investigations by Ken Paxton's office and it's apparent usage of the PDMP to find providers, the response effectively confirms that this was the case. It would also not be difficult for Paxton to send civil investigative demands to the State Board of Pharmacy to access the records as there is no requirement to obtain a judicial warrant for law enforcement to access the PDMP.

From Opioid Tracking to Dragnet Surveillance

In theory, PDMP's allow physicians to spot signs of addiction and help authorities flag illicit prescribing practices and abuses by patients and doctors. In practice, PDMPs have evolved into something much broader. From a recent law review article by Jennifer Oliva in the Fordham Law Review, she describes how modern PDMP platforms “collect a litany of sensitive, prescribing-related information about every monitored prescription drug” and increasingly about other medications as well. Oliva goes on to say that what began as a targeted public-health database has morphed into a “dragnet” of personal health information.

PDMP datasets typically include patient details, medication dosages, refill schedules, and identifying information for the prescriber and pharmacy. In nine states, the PDMP entry even contains the diagnosis code (ICD-10) associated with the prescription. That means a police officer scrutinizing the file could directly see why a person was prescribed a drug. In states like Tennessee or Florida, which track diagnoses, a record showing testosterone cypionate accompanied by an ICD code for “gender dysphoria” would immediately telegraph that the patient is transgender.

As is often the case with law enforcement surveillance tools, PDMPs have proven susceptible to mission creep, Oliva writes, noting that most state programs now track not only opioids but “all controlled substances as well as non-controlled ‘drugs of concern.’” In other words, a system built to catch illicit OxyContin refills has quietly become a mechanism to monitor any number of treatments – from anxiety medications and stimulants for the treatment of ADHD to testosterone for gender transition.

Crucially, this vast trove of prescription records exists in a legal gray zone outside standard medical privacy protections. The questions about HIPAA compliance typically come up when I've discussed this subject. However, once a pharmacy uploads your data to a PDMP, that information is no longer covered by HIPAA privacy rules. Instead, each state dictates who can access the PDMP and for what purpose. Unfortunately, law enforcement agencies have lobbied hard for access.

Today, every state allows police or prosecutors to retrieve PDMP data, often without so much as a warrant. In many jurisdictions, all it takes is an administrative request or subpoena to sift through a person’s prescription history. Some PDMPs even generate unsolicited alerts such as if the software’s algorithms deem someone’s prescribing or usage “suspicious,” it can automatically tip off law enforcement.

Not all states are so lax with access regarding PDMPs. A handful of states such as Maine, Missouri, and Utah now require a warrant for police PDMP queries, but most do not. However, federal agencies have tried to sidestep the stricter state rules; the DEA, for example, has argued that state warrant requirements don’t apply to its investigators in drug diversion cases. The result is a patchwork of policies ripe for exploitation. With a few clicks, authorities can compile a detailed profile of a person’s medications and infer diagnoses, all without ever notifying the individual that their records were searched.

Warrantless and Borderless Surveillance

Not only are PDMPs accessible without judicial oversight in much of the country, they also function as a nationwide surveillance network. According to Oliva, at least 42 states allow PDMP data-sharing across state lines. Through interstate agreements and centralized data hubs, an authorized official in one state can often query the prescription records held by another. For example, a law enforcement officer in Texas investigating a doctor or patient can retrieve PDMP entries from Oklahoma or Louisiana if those states participate in sharing with no court order needed.

This interoperability was originally intended to catch opioid users crossing state lines to fill multiple prescriptions. But in an era of red state/blue state divisions over healthcare, it means a prosecutor in a ban state can potentially hunt for evidence of prohibited care beyond their borders. In fact, Paxton’s office has taken exactly that approach in its pursuit of transgender care: last year the Texas attorney general issued sweeping civil investigative demands to clinics in other states, fishing for any Texas families they had served. Paxton’s subpoenas to Seattle Children’s Hospital in Washington and QueerMed, a telehealth clinic in Georgia, demanded the names of Texas minors treated, the medications prescribed to them, their diagnoses, and even which laboratories were used for testing. Seattle Children’s refused and sued Paxton to block the disclosure, citing Washington’s new abortion/trans health “shield law” that forbids cooperation with out-of-state investigations. The parties ultimately settled and Seattle Children's agreed to no longer conduct any business in the state of Texas.

A training presentation I obtained from the public information request confirms this broad access and shows how Texas can access the PDMP data from 37 other states via the "PMP Interconnect," including many blue states that are supportive of access to gender affirming care.

Gender-Affirming Care and Reproductive Health in the Crosshairs

The Texas cases underscore how PDMP surveillance can be aimed at politically charged medical care. But gender affirming care isn’t the only area of concern. The same prescription databases could be used to monitor and punish those seeking reproductive care or other stigmatized treatments. After the overturning of Roe v. Wade, states that outlawed abortion began exploring new avenues to track and prevent medication abortions. Their task is made easier by the sheer scope of PDMP monitoring.

Ultimately, the PDMP effectively becomes a shortcut to gleaning some of the most sensitive details of a patient’s health status. While Abortion medications like Mifepristone are not federally scheduled controlled substances, and thus not routinely logged in PDMPs yet, Louisiana recently classified the abortion medication Mifepristone as a controlled substance, which could now be tracked by Louisiana's PDMP and might be flagged with a code indicating miscarriage or abortion. But many states vest their pharmacy boards with power to add any drug to the PDMP’s watch-list as a “drug of concern,” without legislative approval. Conceivably, an anti-abortion regulator could designate abortion-inducing medications or other reproductive treatments for tracking, instantly pulling them into the surveillance dragnet.

The targeting of gender-affirming care is thus part of a much larger pattern. It exemplifies how data collected for one purpose – public health and patient safety – can be repurposed for surveillance and social control. Paxton’s unprecedented fishing expeditions into pharmacy and hospital files have made Texas a bellwether. Other states are watching closely: Republican officials in at least nine states have requested information on gender clinic patients or treatments in the past two years, either through PDMP queries or direct subpoenas, according to the Surveillance Technology Oversight Project’s new “Anti-Care Cops” report. While current efforts focus on trans youth and abortion, the precedent could extend to many other areas such as fertility treatments, to PREP, to mental health medications. Essentially, wherever moral panic and culture wars seep into healthcare, surveillance is sure to follow.

Prescription Surveillance is the Plan

In the past, I have hesitated writing on PDMPs because of concern of highlighting this issue for bad actors. In short, don't give them any ideas. However, the far right knows that the PDMPs exist and have explicitly proposed requiring the surveillance of prescription records for all hormones to be included in PDMP monitoring. The pretext for this is to prevent access to trans youth but such a broad surveillance dragnet on hormones would sweep up everyone from a 20 year old college student on birth control to a post-menopausal grandmother on HRT or even a 70 year old prostate cancer patient. They know this and intentionally want this outcome. Genspect, an anti-transgender organization and SPLC-designated hate group, explicitly advocated for this in a now deleted report titled "Hormone Prescription Drug Monitoring Program (PDMP) Using the existing PDMP system to improve safety."

The report called for PDMPs to track all hormone medications and the reason for it, explicitly referring to birth control, menopause, and gender dysphoria. Similarly, the City Journal,the propaganda arm of the far right Manhattan Institute, published an article titled "How to Regulate Pediatric Gender Medicine" that also explicitly called for "drug registries" to track prescribing of hormones.

PDMPs can similarly be used to track the administration of puberty blockers and cross-sex hormones. Testosterone is already classified as a controlled substance and is therefore already tracked by state PDMPs. State law can simply add puberty blockers and estrogen to the list of drugs that pharmacists must enter into the PDMP. Doing so would both deter endocrinologists from excessive prescription of these drugs and allow for better collection of data on the frequency of these interventions.

In their quest to create a gender bureaucracy to police the lives of transgender people, the anti-trans side is on board with the creation of an Orwellian surveillance state that tracks everyone's prescriptions.

Closing Thoughts

Given how much more prevalent hormone prescriptions are among the cisgender population, any attempt to police and surveil transgender people's prescriptions will inevitably catch orders of magnitude more cis people in the surveillance dragnet. But that's entirely the intention. In this situation, it's become explicitly clear that transgender people are a mere pretext to enable a mass surveillance system to gain control over everyone's bodies and what prescriptions they are able to take. Ken Paxton and his cronies can access your prescription records, even if you don't live in Texas. It's a system so ripe for abuse, that it ultimately must be dismantled.

The classic meme around the torment nexus feels applicable in this situation. They see creating a surveillance state as a positive rather than a negative and don't care about the repercussions because it allows them to gain control over people they see as undesirable. Unfortunately, once you create the torment nexus, it will eventually come for us all.