Hipaa Laws: Murder Investigations And Privacy Rights

The Health Insurance Portability and Accountability Act (HIPAA) is a US law that protects the privacy of patients' health information. While HIPAA does not apply to most state and local law enforcement agencies, it does regulate the disclosure of health information by health providers to law enforcement. In certain circumstances, such as when there is a court order or warrant, or when there is a need to identify or locate a suspect, health providers may disclose protected health information (PHI) to law enforcement without patient authorization. However, other federal and state laws may impose greater restrictions on the release of certain information, such as substance use disorder details. Criminal violations of HIPAA can result in fines and imprisonment, with penalties increasing for offenses committed under false pretenses or with the intent to sell, transfer, or use PHI for personal gain or malicious harm.

Law enforcement officials can request medical records without patient consent in certain circumstances

• Court Orders and Warrants: Law enforcement officials can obtain medical records without patient consent by presenting a court order, court-ordered warrant, subpoena, or administrative request. This process ensures that the individual's private information is protected during the legal proceedings.
• Identifying or Locating Individuals: Law enforcement may request PHI to identify or locate a suspect, fugitive, material witness, or missing person. However, the disclosure is limited to specific information, including name, address, date and place of birth, Social Security number, and distinguishing physical characteristics.
• Investigating Crimes: If law enforcement is investigating a crime, they can request PHI about a victim or suspected victim without their consent. In cases of child abuse, adult abuse, neglect, or domestic violence, there are specific provisions that allow for the disclosure of PHI to authorized law enforcement officials.
• Alerting Law Enforcement of a Suspicious Death: Medical providers can disclose PHI to law enforcement if they suspect that a patient's death was caused by criminal conduct. This helps facilitate the investigation into the potential criminal activity surrounding the death.
• Reporting Crimes Occurring on Premises: If a covered entity, such as a healthcare provider, believes that PHI is evidence of a crime that occurred on its premises, they can disclose this information to law enforcement without patient consent.
• Off-Site Medical Emergencies: During an off-site medical emergency, healthcare providers can disclose PHI to alert law enforcement about criminal activity, including the nature of the crime, the location, the identity of the perpetrator, and any victims involved.
• Averting a Serious Threat: In situations where there is a serious and imminent threat to an individual or the public, PHI can be disclosed without patient consent to law enforcement authorities to identify or apprehend the individual responsible.
• Correctional Institutions and Law Enforcement Custodial Institutions: Correctional institutions and law enforcement custodial institutions may request PHI for various purposes, including providing health care to inmates, maintaining the safety and security of the facility, and conducting investigations related to inmates or personnel.

It is important to note that while law enforcement can request medical records without patient consent in these circumstances, healthcare organizations must still ensure they follow proper procedures to avoid HIPAA breaches and associated fines. Additionally, when disclosing PHI, healthcare providers should only share the specific patient records requested and nothing more to protect patient privacy.

Criminal justice data can be PHI if it relates to an individual's health

Criminal justice data can be considered Protected Health Information (PHI) under HIPAA if it relates to an individual's health. This includes data on an individual's past, present, or future physical or mental health condition, as well as the provision of or payment for health care. For example, if a covered health care provider receives criminal justice data to inform the treatment and services they will provide to an individual, the criminal justice data becomes PHI.

HIPAA permits covered entities to disclose PHI to law enforcement officials without the individual's authorization in specific circumstances. These circumstances include:

• Complying with a court order, court-ordered warrant, subpoena, or summons issued by a judicial officer
• Responding to an administrative request, such as an administrative subpoena or summons, provided that the information is relevant and material to the law enforcement inquiry
• Identifying or locating a suspect, fugitive, material witness, or missing person
• Responding to a request for PHI about a victim of a crime, with the victim's agreement, or without it in certain emergency situations
• Alerting law enforcement of an individual's death if there is a suspicion that it resulted from criminal conduct
• Reporting PHI that is believed to be evidence of a crime that occurred on the covered entity's premises
• Responding to an off-site medical emergency and alerting law enforcement about criminal activity, such as the nature of the crime, the location, and the identity and description of the perpetrator
• Preventing or lessening a serious and imminent threat to the health or safety of an individual or the public, such as in cases of attempted suicide or mental health crises

It is important to note that while HIPAA provides exceptions for disclosing PHI to law enforcement, other Federal and State laws may impose additional restrictions on the release of certain information, such as substance use disorder information.

Criminal and civil penalties for violating HIPAA

Criminal and civil penalties may be imposed for violating HIPAA. The Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) enforces HIPAA through audits and investigations. The OCR prefers to resolve violations through non-punitive measures, but when fines are necessary, it follows a tiered penalty structure.

Civil Penalties

There are four tiers of civil penalties for violating HIPAA, with minimum and maximum penalty amounts and an annual cap on penalties for multiple violations of the same provision. The specific penalty imposed depends on the type and severity of the violation, the nature and extent of the harm resulting from the violation, and other aggravating and mitigating factors. The four tiers are:

• Tier 1: Lack of knowledge—the covered entity or business associate was unaware of and could not have known that the HIPAA rule was violated. Minimum penalty: $137 per violation; Maximum penalty: $68,928 per violation; Annual cap: $2,067,813.
• Tier 2: Reasonable cause and not willful neglect—the covered entity knew or should have known that its action violated HIPAA, but the violation was not due to willful neglect. Minimum penalty: $1,379 per violation; Maximum penalty: $68,928 per violation; Annual cap: $2,067,813.
• Tier 3: Willful neglect, corrected within 30 days—the violation was due to willful neglect, but the covered entity took corrective action within 30 days. Minimum penalty: $13,785 per violation; Maximum penalty: $68,928 per violation; Annual cap: $2,067,813.
• Tier 4: Willful neglect, not corrected within 30 days—the violation constituted willful neglect, and the entity made no attempt to correct it within 30 days. Minimum penalty: $68,928 per violation; Maximum penalty: $2,067,813; Annual cap: $2,067,813.

Criminal Penalties

The Department of Justice (DOJ) handles criminal penalties for HIPAA violations, which can range from fines to jail time depending on the severity of the offense. There are three tiers of criminal violations:

• Tier 1: Wrongful disclosure of PHI—this covers cases of reasonable cause or lack of knowledge. Maximum penalty: $50,000 fine, up to one year in prison, or both.
• Tier 2: Wrongful disclosure of PHI under false pretenses—this includes obtaining PHI under false pretenses or disclosing it without permission. Maximum penalty: $100,000 fine, up to five years in prison, or both.
• Tier 3: Wrongful disclosure of PHI under false pretenses with malicious intent—the most severe violation, involving the intent to sell, transfer, or use PHI for personal gain, commercial advantage, or malicious harm. Maximum penalty: $250,000 fine, up to ten years in prison, or both.

Law enforcement officials can request PHI to identify or locate a suspect, fugitive, witness, or missing person

Law enforcement officials can request Protected Health Information (PHI) to identify or locate a suspect, fugitive, witness, or missing person. This is a permitted disclosure under the HIPAA Privacy Rule, which normally requires patient authorization. However, in this instance, law enforcement officials can make the request without patient authorization.

The PHI that can be disclosed is limited to the following:

• Name and address
• Date and place of birth
• Social Security number
• ABO blood type and rh factor
• Type of injury
• Date and time of treatment
• Date and time of death
• Description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye colour, presence or absence of facial hair, and tattoos

PHI related to an individual's DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed without patient consent, a court order, or administrative request.

It is important to note that healthcare organizations must understand how to respond appropriately to law enforcement requests for PHI to avoid HIPAA breaches and associated fines.

When a healthcare organisation can disclose PHI to law enforcement without patient consent

The Health Insurance Portability and Accountability Act (HIPAA) includes a Privacy Rule that protects most individually identifiable health information. However, there are certain situations in which a healthcare organisation can disclose Protected Health Information (PHI) to law enforcement without patient consent. These situations are outlined below:

To Comply with a Court Order or Court-Ordered Warrant

If there is a court order, warrant, subpoena, or other administrative request, a healthcare organisation can disclose PHI to law enforcement without patient consent. This includes complying with a subpoena or summons issued by a judicial officer or a grand jury subpoena.

To Respond to an Administrative Request

A healthcare organisation can disclose PHI to law enforcement without patient consent if it is in response to an administrative request, including an administrative subpoena or summons, a civil or authorised investigative demand, or a similar process authorised under the law. The information requested must be relevant and material to a legitimate law enforcement inquiry, and the request must be specific and limited in scope.

To Identify or Locate a Suspect, Fugitive, Material Witness, or Missing Person

A healthcare organisation is permitted to disclose PHI to law enforcement without patient consent for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person. However, the information disclosed must be limited to the individual's name, address, date and place of birth, Social Security number, ABO blood type and Rh factor, injury type, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics.

To Provide PHI About a Crime Victim

A healthcare organisation can disclose PHI about a crime victim to law enforcement without the victim's consent in certain circumstances. If it is an emergency or the individual lacks the capacity to consent, physicians can disclose PHI if it is in the best interest of the patient. If the victim is a child, their agreement is not required for the disclosure of PHI. For adult victims of abuse, neglect, or domestic violence, PHI can be disclosed if the patient agrees, if the report is required by law, or if the report is necessary to prevent serious harm based on the professional judgment of the clinician.

To Report PHI That Is Evidence of a Crime

A healthcare organisation can disclose PHI to law enforcement without patient consent if it believes in good faith that the PHI is evidence of a crime, specifically a crime that occurred on its premises or at an off-site medical emergency.

To Avert Harm or Identify an Individual Who Has Escaped from Lawful Custody

A healthcare organisation can disclose PHI without patient consent to prevent or lessen a serious and imminent threat to an individual or the public. This includes identifying or apprehending an individual who has escaped from lawful custody or admitted participation in a violent crime that caused serious physical harm to a victim.

For Certain Specialised Governmental Law Enforcement Purposes

There are certain specialised governmental law enforcement purposes for which a healthcare organisation can disclose PHI without patient consent. These include:

• Responding to a request for PHI by a correctional institution or a law enforcement official having lawful custody of an inmate.
• Disclosing PHI to federal officials authorised to conduct intelligence, counter-intelligence, and other national security activities under the National Security Act.
• Disclosing PHI to federal officials providing protective services to the President or other individuals authorised by law.

Frequently asked questions