To combat "doctor shopping," "pill mills," and addiction to medications such as pain and anti-anxiety pills, many states have created databases that track the doctors who prescribe and patients who take these medications. Used by pharmacies and practices to ensure consumers aren't seeing multiple physicians to get controlled substances, these databases also have become a tool for law enforcement -- and at least one medical board's investigative arm. But could investigators' access to these records, which also include non-controlled medications, jeopardize patient privacy, especially when data segues from deidentified to clearly identified information and patients are called upon to hand over their complete medical records as part of an investigation?