Police And Hipaa: Understanding Legal Boundaries And Applicability

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule is designed to protect an individual's privacy while also allowing law enforcement to carry out their duties. This means that in certain circumstances, law enforcement officials are allowed to request and obtain protected health information (PHI) without a patient's authorization. For example, when there is a court order, subpoena, or administrative request, or when it is necessary to identify or locate a suspect, witness, or missing person. However, healthcare organizations must also be careful to avoid HIPAA breaches and associated fines by ensuring they have a proper process for handling medical record requests from law enforcement and only disclosing the minimum necessary information.

Law enforcement officials can request medical records without patient authorisation

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule is balanced to protect an individual's privacy while allowing important law enforcement functions to continue. While doctors owe a duty of confidentiality to their patients, there are exceptions to this rule. In rare cases, law enforcement officials can request medical records without patient authorisation.

In the US, doctors may disclose Protected Health Information (PHI) if they believe in good faith that doing so is necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public. For example, if a patient confesses to a serious crime such as child abuse, disclosure is likely to be appropriate. In such cases, doctors must judge whether failure to disclose information may expose others to a risk of death or serious harm.

Other circumstances in which it is acceptable for physicians to release PHI to law enforcement include:

• Complying with a court order, subpoena, or summons issued by a judicial officer, or a grand jury subpoena
• Responding to an administrative request, which must include a written statement that the information requested is relevant, material, specific, and limited in scope
• Identifying or locating a suspect, fugitive, material witness, or missing person
• Reporting incidents of gunshot, stab wounds, or other violent injuries
• Alerting law enforcement when there is a suspicion that a death resulted from criminal conduct

In the UK, police officers can request access to patient records without patient consent in certain situations. For example, if there has been a violent crime in the area and the assailant has certain features that may be identifiable from a medical record. In such cases, doctors must weigh their duty of confidentiality against their obligation to assist in the prosecution of a serious crime.

In other cases, doctors will need to balance the potential harm to the patient and their professional relationship against the benefits of releasing the information without patient consent.

Circumstances where physicians can release PHI to law enforcement

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule is designed to protect an individual's privacy while also allowing law enforcement activities to continue. In certain circumstances, physicians are permitted to disclose Protected Health Information (PHI) to law enforcement without violating HIPAA rules. Here are some scenarios where physicians can release PHI to law enforcement:

Compliance with Court Orders and Administrative Requests

Physicians can disclose PHI to law enforcement if they are presented with a valid court order, court-ordered warrant, subpoena, or summons issued by a judicial officer. Additionally, they can respond to administrative requests, but these requests must include a written statement specifying the relevance and limited scope of the information requested.

Identifying or Locating Individuals

PHI disclosures are allowed to identify or locate a suspect, fugitive, material witness, or missing person. However, the information disclosed must be limited to the individual's name, address, date and place of birth, Social Security number, ABO blood type and Rh factor, injury type, date and time of treatment, date and time of death, and distinguishing physical characteristics.

Crimes Involving the Physician's Premises or Off-Site Medical Emergencies

If there is evidence of a crime that occurred on the physician's premises, they can disclose PHI to law enforcement. Similarly, if the physician responds to an off-site medical emergency, they can share PHI with law enforcement if it is necessary to alert them about criminal activity (excluding cases involving abuse, neglect, or domestic violence).

Child Abuse or Neglect

Physicians are mandated to report any suspected cases of child abuse or neglect to authorized law enforcement officials. The agreement of the child is not required in these situations.

Adult Abuse, Neglect, or Domestic Violence

In cases of adult abuse, neglect, or domestic violence, physicians may disclose PHI to law enforcement if the patient consents, if the report is required by law, or if the report is deemed necessary by the clinician to prevent serious harm.

Crime Victim with the Victim's Consent

Physicians can provide PHI about a crime victim if the victim gives their consent. In cases where the victim is incapacitated or unable to provide consent due to an emergency, physicians can disclose PHI if it aligns with the best interests of the patient and certain conditions are met, such as confirming that the information will not be used against the victim.

It is important to note that these are just a few examples of circumstances where physicians can release PHI to law enforcement without violating HIPAA. Each situation may have specific nuances, and physicians should exercise their professional judgment and consult legal counsel when in doubt.

How to respond to a law enforcement request for PHI

The HIPAA Privacy Rule contains an exception for law enforcement purposes, allowing healthcare providers to disclose protected health information (PHI) to law enforcement officials without patient authorization under certain circumstances. Here are some guidelines on how to respond to a law enforcement request for PHI:

Understand the Law Enforcement Exception:

Know the circumstances under which you can disclose PHI without patient authorization. These circumstances include:

• Complying with a court order, court-ordered warrant, subpoena, or administrative request
• Identifying or locating a suspect, fugitive, material witness, or missing person
• Responding to requests for information about a victim or suspected victim of a crime
• Alerting law enforcement of a suspicious death that may be due to criminal activity
• Reporting PHI that is believed to be evidence of a crime occurring on the entity's premises
• Responding to an off-site medical emergency and informing law enforcement about criminal activity

Train Your Staff:

Conduct annual HIPAA training for all staff members, ensuring they understand the HIPAA Privacy Rule exceptions. Implement a consistent process for handling medical record requests from law enforcement, and use a checklist to ensure consistent responses.

Verify the Request:

If a law enforcement official visits your office in person, ask for proper identification, such as a business card, law enforcement ID, or badge. For phone requests, ask for further verification, such as a formal written request with a citation to the requester's source of statutory authority. Ensure that the law enforcement official's identity and authority are confirmed before disclosing any information.

Authorisation:

You generally do not need the patient's written authorisation before disclosing PHI to law enforcement officials under the law enforcement exception. However, there is a special case for adult patients who are victims of abuse. In these situations, you must obtain the patient's written authorisation before disclosing PHI.

Disclose Only Necessary Information:

Disclosures to law enforcement are subject to a minimum necessary determination. Share only the specific information requested and nothing more. Ensure that the information disclosed is relevant and material to the law enforcement inquiry.

Transmit Records Securely:

When transmitting medical records, ensure that your office delivers them in a HIPAA-compliant manner to protect patient privacy.

When a law enforcement request for PHI is considered low risk

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule contains an exception for law enforcement purposes, permitting covered entities to disclose PHI to law enforcement officials without patient authorization under certain circumstances. These circumstances include:

• A court order, court-ordered warrant, subpoena, or administrative request
• Identifying or locating a suspect, fugitive, material witness, or missing person
• Answering a law enforcement official's request for information about a victim or suspected victim of a crime
• Alerting law enforcement of a person's death if criminal activity is suspected to have caused it
• When an organization believes that PHI is evidence of a crime that occurred on its premises
• In a medical emergency not occurring on its premises, when it's necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime

The HIPAA Privacy Rule is balanced to protect an individual's privacy while allowing important law enforcement functions to continue. When a law enforcement request for PHI falls under one of the permitted circumstances, it is considered low risk for healthcare organizations to comply with the request.

It is important to note that healthcare providers should ensure that they are sharing only the patient records requested and that the transmission of medical records is done in a HIPAA-compliant manner. Additionally, in the case of adult patients who are victims of abuse, healthcare providers should generally obtain authorization from the patient before disclosing their PHI to law enforcement.

HIPAA Privacy Rule exceptions

The HIPAA Privacy Rule is balanced to protect an individual's privacy while allowing important law enforcement functions to continue. In limited circumstances, the HIPAA Privacy Rule permits covered entities to use and disclose health information without individual authorization.

Exceptions to the HIPAA Privacy Rule:

• Covered entities may use and disclose protected health information without authorization for their own treatment, payment, and healthcare operations. This includes quality assurance, utilization review, credentialing, and other activities that are part of ensuring appropriate treatment and payment.
• Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following circumstances, subject to specified conditions:
• As required by law, including court orders, court-ordered warrants, subpoenas, and administrative requests.
• To identify or locate a suspect, fugitive, material witness, or missing person.
• In response to a law enforcement official's request for information about a victim or suspected victim of a crime.
• To alert law enforcement of a person's death if the covered entity suspects that criminal activity caused the death.
• When a covered entity believes that protected health information is evidence of a crime that occurred on its premises.
• By a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.
• Covered entities may use and disclose protected health information without individual authorization for certain public interest-related activities, including:
• Oversight of the healthcare system, including licensing and regulation.
• Public health, and in emergencies affecting life or safety.
• Judicial and administrative proceedings.
• Informing next of kin.
• Body identification of the deceased person or investigation of the cause of death.
• Workers' compensation.
• In other situations where the use or disclosure is mandated by other laws (e.g., state and local laws).
• In emergency situations, the HIPAA Privacy Rule allows disclosures as follows:
• As necessary to treat patients.
• To public health authorities to prevent or control disease, disability, or injury.
• To foreign government agencies upon the direction of a public health authority.
• To individuals who may be at risk of disease.
• To family or others caring for an individual, including notifying the public.
• To persons in imminent danger.
• To release general directory-level information about an individual who is hospitalized.

Frequently asked questions