Police And Hipaa: What's The Deal?

The Health Insurance Portability and Accountability Act (HIPAA) establishes the baseline for medical privacy standards in the US. While the law doesn't apply directly to police officers, it does govern how health providers and other 'covered entities' can disclose patient information to law enforcement. HIPAA permits covered entities to disclose patient information to police in certain circumstances, such as when disclosure is ordered by a court, or when it is required to identify or locate a suspect, or in the case of a medical emergency. However, HIPAA also includes strict privacy rules, and covered entities must ensure they are complying with the law when disclosing patient information.

Law enforcement investigations

The Health Insurance Portability and Accountability Act (HIPAA) is a US law that protects the privacy of individuals' health information and sets rules and limits on who can access and receive this information. While HIPAA generally does not apply to law enforcement agencies, there are certain situations in which HIPAA-regulated entities may be required to disclose protected health information to law enforcement as part of an investigation.

The HIPAA Privacy Rule permits covered entities to disclose protected health information to law enforcement officials in response to a court order, subpoena, warrant, or other legal process. This process must be initiated by a law enforcement official and must specifically request the protected health information. In such cases, covered entities must provide the minimum amount of information necessary to satisfy the request.

Additionally, covered entities may disclose protected health information to law enforcement in emergency situations. For example, if a patient presents a danger to themselves or others, or if there is a public health emergency, such as a bioterrorism threat, covered entities may disclose relevant health information to law enforcement without the individual's authorization.

It's important to note that law enforcement agencies themselves are generally not considered "covered entities" under HIPAA. However, if they obtain protected health information through one of the disclosure methods mentioned above, they become bound by HIPAA regulations and must ensure the information is protected and used only for the purposes authorized.

Overall, while HIPAA does not directly apply to law enforcement investigations, it provides a framework for disclosing protected health information to law enforcement under specific circumstances, balancing an individual's privacy rights with the important functions of law enforcement.

PHI disclosure to police

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rules are designed to protect an individual's privacy while also allowing law enforcement to carry out their functions. HIPAA rules permit covered entities to disclose Protected Health Information (PHI) to law enforcement officials under specific circumstances without the individual's written authorization.

Covered entities may disclose PHI to law enforcement when required by law, such as in the following situations:

• To comply with a court order, court-ordered warrant, subpoena, or summons issued by a judicial officer.
• To respond to an administrative request, including an administrative subpoena or summons, a civil demand, or a similar lawful process.
• To identify or locate a suspect, fugitive, material witness, or missing person. In this case, PHI disclosure is limited to the individual's name, address, date and place of birth, Social Security number, ABO blood type and Rh factor, injury type, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics.
• To provide PHI about a crime victim when the victim consents. In an emergency or when the victim is unable to consent, physicians can disclose PHI if it is deemed to be in the best interest of the patient.
• To report child abuse or neglect to authorized law enforcement officials, without requiring the patient's agreement.
• To report adult abuse, neglect, or domestic violence to law enforcement if the patient agrees, if the report is required by law, or if the report is necessary to prevent serious harm, based on the professional judgment of the clinician.
• To report PHI that is believed to be evidence of a crime that occurred on the covered entity's premises.
• To alert law enforcement about criminal activity when responding to an off-site medical emergency, including the nature and location of the crime, the identity and location of the perpetrator, and any victims.
• To avert harm, to identify an individual who has escaped lawful custody, or for other specialized governmental law enforcement purposes.

It is important to note that covered entities must ensure that only the minimum amount of information necessary is released to law enforcement and that the incident is properly documented, especially in emergency situations. Additionally, state laws and regulations should be considered when determining policies and procedures for PHI disclosure.

Police access to PHI without a warrant

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes the baseline for medical privacy standards. The HIPAA Privacy Rule applies to covered entities, including providers (such as doctors, psychologists, and pharmacies), health insurance plans, and other entities like billing services. It also applies to business associates that perform special functions involving PHI on behalf of a covered entity.

HIPAA regulations are designed to protect patient information, but there are exceptions where police can access PHI without a warrant. Under HIPAA, covered entities may disclose PHI under the following circumstances in relation to law enforcement investigations:

• As required by law, including court orders, court-ordered warrants, subpoenas, and administrative requests.
• To identify or locate a suspect, fugitive, material witness, or missing person.
• In response to a law enforcement official's request for information about a victim or suspected victim of a crime.
• To alert law enforcement of a person's death if the covered entity suspects criminal activity caused it.
• When a covered entity believes that PHI is evidence of a crime that occurred on its premises.
• By a covered healthcare provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the crime, location, or perpetrator.

In these instances, HIPAA only permits the disclosure of specific information, including the individual's name, address, date and place of birth, social security number, ABO blood type, and rh factor, type of injury, date and time of treatment or death, and a description of distinguishing physical characteristics.

Additionally, state laws may have different requirements for law enforcement access to medical information. For example, North Carolina law requires nurses to comply with law enforcement directives to withdraw blood from an unconscious patient, without requiring a warrant. However, if the withdrawal is later deemed unjustified or illegal, the results may be excluded from evidence.

It is important for healthcare organizations to understand how to respond appropriately to law enforcement requests for PHI to avoid HIPAA breaches and associated fines. Annual HIPAA training for staff members and consistent processes for handling medical record requests from law enforcement are crucial.

Circumstances when PHI can be disclosed to police

While HIPAA rules are meant to protect patient information, there are certain circumstances in which PHI can be disclosed to law enforcement without patient authorization. These circumstances are as follows:

In Response to a Court Order, Warrant, Subpoena, or Administrative Request

PHI can be disclosed when there is a court order, court-ordered warrant, subpoena, or other administrative requests, such as those from a grand jury.

To Identify or Locate a Suspect, Fugitive, Material Witness, or Missing Person

PHI can be disclosed to identify or locate relevant individuals. However, the information provided is limited to the individual's name, address, date and place of birth, Social Security number, ABO blood type and Rh factor, injury type, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics.

To Provide PHI About a Crime Victim

PHI about a crime victim can be disclosed with the victim's consent. In cases where the victim is unable to provide consent due to incapacity or emergency circumstances, physicians can disclose PHI if it is deemed to be in the victim's best interests.

To Report Child Abuse or Neglect

Child abuse or neglect does not require the patient's agreement or consent and can be reported without these.

To Report Adult Abuse, Neglect, or Domestic Violence

Adult abuse, neglect, or domestic violence may be reported to law enforcement if the patient agrees, if the report is required by law, or if a report is necessary to prevent serious harm, as determined by the professional judgment of the clinician.

To Provide Evidence of a Crime

PHI can be disclosed if there is evidence of a crime on the provider's premises or if there is evidence of criminal activity at an off-site medical emergency.

To Avert Harm or Identify an Escapee

PHI can be disclosed to avert harm or to identify an individual who has escaped from lawful custody.

HIPAA rules for police disclosure of PHI

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (HHS) issued the Privacy Rule to implement the requirement of HIPAA. The Privacy Rule standards address the use and disclosure of individuals' health information—called "protected health information" (PHI) by organizations subject to the Privacy Rule—called "covered entities".

Covered entities may disclose PHI under the following circumstances in relation to law enforcement investigations:

• As required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests
• To identify or locate a suspect, fugitive, material witness, or missing person
• In response to a law enforcement official’s request for information about a victim or suspected victim of a crime
• To alert law enforcement of a person’s death if the covered entity suspects that criminal activity caused the death
• When a covered entity believes that protected health information is evidence of a crime that occurred on its premises
• By a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime

In addition, covered entities may disclose PHI to law enforcement officials for law enforcement purposes under the following circumstances:

• Child abuse or neglect does not require the patient’s agreement
• Adult abuse, neglect, or domestic violence may be reported to law enforcement if the patient agrees, if the report is required by law, or if a report is necessary to prevent serious harm (based on the professional judgment of the clinician)
• To avert harm, to identify an individual who has escaped from lawful custody, and for certain other specialized governmental law enforcement purposes

It is important to note that covered entities must ensure that employees at all levels are trained on the specific requirements regarding PHI disclosure. They must review federal and state regulations governing permissible PHI disclosure and when patient information can be shared with other entities.

Frequently asked questions