Medical Records Privacy: Law Enforcement Access

Doctors and hospitals can disclose patient medical records to law enforcement under certain circumstances, such as when it is necessary to identify or locate a suspect, fugitive, witness, or missing person, or when a crime has been committed on the premises. While patient privacy is protected by laws like HIPAA in the US, these laws also provide exceptions that allow the release of protected health information without patient consent in some cases. Patients can also request their medical records, and in some states, physicians and hospitals are required to maintain patient records for a minimum period.

Criminal investigations

Doctors and other healthcare providers are generally bound by doctor-patient confidentiality. However, there are several exceptions to this rule, and medical records can be released to law enforcement in certain situations.

In the United States, both federal and state laws govern law enforcement access to medical information. The Health Insurance Portability and Accountability Act (HIPAA) sets out requirements for the use, disclosure, and storage of protected health information (PHI). HIPAA's Privacy Rule applies to covered entities, including doctors, psychologists, and pharmacies, as well as health insurance plans and billing services. Under HIPAA, covered entities must provide a notice to patients in plain language, describing the purposes for which they are permitted to disclose protected health information without the patient's written authorization. This includes situations where a court order or warrant is presented, or where there is a national security or intelligence threat.

State laws may also impact law enforcement access to medical records. For example, California's Confidentiality of Medical Information Act (CMIA) has stricter requirements for law enforcement access to medical data. In the context of criminal investigations, law enforcement may seek access to medical records in several scenarios. For instance, in “use-of-force” investigations, law enforcement may need to access medical records to determine the extent and severity of injuries, whether they resulted from police use of force or another cause, and if hospital admission or death occurred due to force-related wounds or pre-existing medical or psychiatric conditions. Emergency medical service (EMS) records and emergency department records are often the most helpful in these types of investigations.

In cases where a mental health professional or designated crisis responder is involved, they may be required to disclose the results of their investigation to law enforcement in writing within 72 hours of a request. This could include a statement of reasons for detaining or releasing the person investigated. Additionally, if law enforcement believes that health care information disclosed constitutes evidence of criminal conduct that occurred on the premises of a health care provider or facility, they may have access to those medical records.

It is important to note that the interpretation of medical records by law enforcement can be challenging due to medical jargon or shorthand. As such, a police department's on-staff physician or a volunteer doctor from the local community may be consulted to help determine injury severity, cause, and whether hospital admission was related to police use of force or other factors.

Patient consent

In most cases, written patient consent is required before medical records can be released to anyone, including law enforcement. However, there are exceptions where patient information can be disclosed without explicit consent. For example, in Washington, certain tribal law enforcement officers and attorneys can receive confidential patient information under specific circumstances. Additionally, researchers may access patient information with informed consent if it is for research purposes.

It is important to note that HIPAA prohibits the release of patient information without authorization, except in specific situations outlined in the regulations. These situations include when patient information is required for law enforcement purposes or pursuant to an administrative subpoena. Healthcare facilities must also comply with state privacy laws in addition to HIPAA regulations.

If an individual believes that their doctor or healthcare provider has violated their health information privacy rights by denying access to their medical records, they can file a HIPAA Privacy Rule Complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. This office provides individuals with the ability to access and obtain copies of their health information upon request.

HIPAA and state law

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes national standards to protect individuals' medical records and other identifiable health information. This rule applies to health plans, health care clearinghouses, and healthcare providers that conduct certain health care transactions electronically.

HIPAA's Privacy Rule permits covered entities to disclose protected health information (PHI) to law enforcement officials under certain conditions. For instance, providers may disclose PHI to alert law enforcement about criminal conduct on the premises of a HIPAA-covered entity or to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime. If a law enforcement official requests medical records via a phone call, they should be asked to provide a formal request in writing before releasing any PHI.

HIPAA also allows covered entities to disclose PHI to public health authorities for preventing or controlling disease, injury, or disability, and to government authorities for reports of child abuse and neglect. PHI can also be disclosed to individuals who may have been exposed to a communicable disease when notification is authorized by law, and to employers regarding work-related illnesses or injuries when the information is needed to comply with workplace safety regulations.

The Privacy Rule supersedes state law; however, state laws that provide greater privacy protections or greater individual access to PHI remain in effect. For example, state laws may give parents or guardians access to the medical records of their minor children, even if they are not the personal representatives of the child.

Substance abuse records

In the US, the law prohibits doctors from disclosing information about a patient's drug use to the police. This law, called the Confidentiality of Substance Use Disorder Patient Records, 42 CFR Part 2, has been in place since 1975. The purpose of this law is to encourage people to seek treatment for substance abuse disorders without fear of legal repercussions.

However, there are limited circumstances under which a doctor may disclose substance abuse records without a patient's written permission. These include:

• When the information is required by other healthcare providers involved in the patient's care.
• When a court order demands that the records be turned over to law enforcement.
• When the doctor believes the patient may harm themselves or others.
• When the information is sought by law enforcement to investigate or prosecute a serious crime, such as an act causing or threatening death or serious injury, including child abuse and neglect. In such cases, the court must balance the public interest in disclosure with any potential harm to the patient, the doctor-patient relationship, and the program's ability to provide services to other clients.

It is important to note that most states have laws protecting patients' medical information, known as "doctor-patient privilege." This privilege governs whether a clinician can be compelled to testify in court about a client. Counselors and doctors should consult the client, be sensitive to what information is disclosed, and review the case with a clinical supervisor before considering disclosing any substance abuse records.

Reproductive healthcare records

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) sets out rules regarding the privacy of individuals' health information, including their reproductive health records. The HIPAA Privacy Rule states that disclosures of Protected Health Information (PHI) to law enforcement are permitted in certain situations, but these are unlikely to apply to disclosures about an individual seeking or obtaining reproductive healthcare.

The Privacy Rule's permission to disclose PHI for law enforcement purposes does not permit a disclosure to law enforcement where a hospital or healthcare provider's workforce member chose to report an individual's abortion or other reproductive healthcare. This is true whether the workforce member disclosed PHI at the request of law enforcement or initiated the disclosure themselves.

The Privacy Rule permits, but does not require, certain disclosures to law enforcement, subject to specific conditions. For example, if a law enforcement official presents a reproductive healthcare clinic with a court order requiring the clinic to produce PHI about an individual who has obtained an abortion, the Privacy Rule would permit but not oblige the clinic to disclose the requested PHI. The clinic may only disclose the PHI expressly authorized by the court order.

The American College of Obstetricians and Gynecologists (ACOG) states that "obstetrician–gynecologists should protect patient autonomy, confidentiality, and the integrity of the patient–physician relationship." As such, ACOG "opposes administrative policies that interfere with the legal and ethical requirement to protect private medical information by mandating obstetrician–gynecologists and other clinicians to report to law enforcement" information related to individuals and their care.

Frequently asked questions