> the information sought is relevant and material to a legitimate law enforcement inquiry
Your average PharmTech at CVS isn't assessing the legitimacy of the inquiry or its relevancy, but is instead blindly acquiescing (or being told to do so).
The other part that is a problem is the use of "and":
> and de-identified information
There's no de-identified information in "Show me all the prescriptions you filled for Mr XYZ."
But what there is is enough plausible deniability for the corporations to say they were following their interpretation of the law.
It's a bit wordy, but it's not really asking for anything too special.
Something like "I'm a police officer with ABC department, and I need to know which drugs Mr. XYZ has purchased between [x] and [y] in regards to a criminal drug trafficking investigation I am investigating" seems to satisfy all of the requirements.
* "administrative request": the officer is asking
* "the information sought is relevant and material to a legitimate law enforcement inquiry": they are real police, and they are investigating a crime regarding this person and these drugs.
* "the request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought": It is about Mr XYZ, and it is about drugs he purchased, the crime being investigated is about the same.
* "and de-identified information could not reasonably be used": because it is specifically about Mr XYZ
> the information sought is relevant and material to a legitimate law enforcement inquiry
Your average PharmTech at CVS isn't assessing the legitimacy of the inquiry or its relevancy, but is instead blindly acquiescing (or being told to do so).
The other part that is a problem is the use of "and":
> and de-identified information
There's no de-identified information in "Show me all the prescriptions you filled for Mr XYZ."
But what there is is enough plausible deniability for the corporations to say they were following their interpretation of the law.