Arrested And Your Health: Hipaa Law Protection?

The Health Insurance Portability and Accountability Act (HIPAA) is a US law that protects the privacy of patients' health information. HIPAA rules allow for certain disclosures of patient health information (PHI) for specific law enforcement purposes. For example, PHI can be disclosed to comply with a court order, to identify or locate a suspect, or to provide information about a crime victim. In some states, such as North Carolina, a nurse must comply with a law enforcement officer's directive to withdraw blood from an unconscious patient. However, in other states, a warrant or patient consent may be required. HIPAA regulations aim to strike a balance between protecting individual privacy and ensuring information can flow freely.

When can health workers disclose information to law enforcement?

The Health Insurance Portability and Accountability Act (HIPAA) is a US law that provides data privacy and security provisions for safeguarding medical information. The HIPAA Privacy Rule protects an individual's privacy while allowing important law enforcement functions to continue.

HIPAA permits health care providers to disclose protected health information (PHI) in the following situations:

• If there is a court order, warrant, subpoena, or other administrative request.
• To identify or locate a suspect, fugitive, material witness, or missing person. In this case, the PHI is limited to the individual's name, address, date and place of birth, Social Security number, ABO blood type and Rh factor, injury type, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics.
• To provide PHI about a crime victim, with the victim's consent. If it is an emergency or the individual lacks the capacity to consent, physicians can disclose PHI if it is in the best interest of the patient.
• Child abuse or neglect can be reported without the patient's agreement.
• Adult abuse, neglect, or domestic violence may be reported if the patient agrees, if the report is required by law, or if a report is necessary to prevent serious harm (based on the professional judgment of the clinician).
• If there is evidence of a crime on the provider's premises or evidence of criminal activity at an off-site medical emergency.
• To avert harm, to identify an individual who has escaped from lawful custody, and for certain other specialized governmental law enforcement purposes.
• To prevent or lessen a serious and imminent threat to the health or safety of an individual or the public.
• If the individual is in lawful custody, and the official PHI is needed to provide health care to the individual or to provide for the health and safety of the individual or the officers.

It is important to note that HIPAA does not restrict the ability of law enforcement officials to use or disclose data they maintain on health or mental health indicators to help inform incident responses. Most state and local police or other law enforcement agencies are not covered by HIPAA and are therefore not subject to its use and disclosure rules. However, HIPAA does apply to the disclosure of health information by most health providers to law enforcement.

What happens if health workers disclose too much information?

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) sets out regulations for the disclosure of protected health information (PHI). While HIPAA permits the disclosure of PHI to law enforcement in certain circumstances, health workers must be careful not to disclose too much information.

HIPAA privacy rules permit certain disclosures of PHI for specific law enforcement purposes. For example, health workers can disclose PHI to law enforcement if there is a court order, warrant, subpoena, or other administrative request, or to identify or locate a suspect, fugitive, material witness, or missing person. However, in such cases, health workers should only release the minimum amount of information necessary and should consult legal counsel if possible.

If health workers disclose too much information, they may be in breach of HIPAA regulations and face legal consequences. Individuals whose PHI has been disclosed without their authorization may seek legal advice and file a civil lawsuit to seek compensation for damages. Additionally, employers who disclose employees' medical conditions in violation of state privacy laws may be held liable in many states.

To avoid disclosing too much information, health workers should consult legal counsel if possible and document the incident, especially in emergency situations. It is important to remember that HIPAA does not limit the types of data that providers may seek or obtain about individual patients for treatment purposes. Treatment includes "the provision, coordination, or management of health care and related services." Once a covered entity obtains criminal justice data about an individual, it is considered PHI, and HIPAA Rules apply to protect that data.

What are the consequences of breaking HIPAA rules?

The consequences of breaking HIPAA rules depend on the nature and consequences of the violation, the motive for the violation, and whether the individual knew or should have known that the violation was a breach of HIPAA rules.

If you are a member of a covered entity's or business associate's workforce, there are four potential outcomes:

• The violation could be dealt with internally by an employer
• Your contract of employment could be terminated
• You could face sanctions from professional boards
• You could face criminal charges which include fines and imprisonment

The actions of employers, professional boards, federal regulators, and the Department of Justice will depend on several factors:

• The nature of the violation
• Whether there was knowledge that HIPAA Rules were being violated, or whether it should have been clear that HIPAA Rules were being violated
• Whether action was taken to correct the violation
• Whether there was malicious intent or HIPAA Rules were violated for personal gain
• The harm caused by the violation
• The number of people impacted by the violation
• Whether there was a violation of the criminal provision of HIPAA

Civil penalties for HIPAA violations can be imposed on covered entities or business associates by the HHS' Office for Civil Rights for any violations of HIPAA – not just those that result in a data breach or other impermissible disclosure of protected health information. Civil penalties for HIPAA violations start at $137 per violation (as of December 2023) and can rise to $2,067,813 when a violation is attributable to willful neglect and not corrected within 30 days. Covered entities and business associates may also be required to comply with a corrective action plan.

Criminal penalties for HIPAA violations can be brought against both individuals and organizations. The minimum fine for criminal violations of HIPAA is $50,000. The maximum criminal penalty for a HIPAA violation by an individual is $250,000, and restitution may also need to be paid to the victims. In addition to the financial penalty, a jail term is possible for a criminal violation of HIPAA Rules.

Criminal violations that occur as a result of negligence can result in a prison term of up to 1 year. Obtaining protected health information under false pretenses carries a maximum prison term of 5 years. Knowingly disclosing PHI with malicious intent or for personal/commercial gain can result in a prison term of up to 10 years in jail. There is also a mandatory two-year jail term for aggravated identity theft.

What are the criminal penalties for breaking HIPAA rules?

Criminal penalties for breaking HIPAA rules can be imposed on both individuals and organizations. The Department of Justice is responsible for prosecuting criminal HIPAA violations, and the severity of the penalty is determined by the motive for the offense.

According to §1177 of the Social Security Act, the criminal penalties for individuals who obtain, disclose, use, or cause to be used individually identifiable health information maintained by a covered entity include:

• A fine of up to $50,000 and/or imprisonment for up to a year for wrongful and knowing disclosure.
• A fine of up to $100,000 and imprisonment for up to five years if the offense is committed under false pretenses.
• A fine of up to $250,000 and imprisonment for up to ten years if the offense is committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm.

Additionally, there is a mandatory two-year jail term for aggravated identity theft.

The criminal penalties for organizations are the same as those for individuals. Organizations can also face exclusion from Medicare participation if they fail to comply with the transaction and code set standards by the specified deadline.

It is important to note that ignorance of HIPAA rules is not an excuse for non-compliance. Covered entities and individuals are responsible for ensuring they understand and follow the HIPAA rules.

What are the civil penalties for breaking HIPAA rules?

Civil penalties for breaking HIPAA rules can be imposed on covered entities or business associates by the Health and Human Services' (HHS) Office for Civil Rights (OCR). These civil penalties are separate from criminal penalties, which are handled by the Department of Justice (DOJ). Civil penalties for HIPAA violations start at \$137 per violation and can rise to \$2,067,813 when a violation is attributable to willful neglect and not corrected within 30 days. The penalty structure for a violation of HIPAA laws is tiered, based on the knowledge a covered entity had of the violation. The OCR sets the penalty based on a number of "general factors" and the seriousness of the violation.

The four tiers of civil penalties for HIPAA violations are:

• Tier 1: A violation that the covered entity was unaware of and could not have realistically avoided, with a reasonable amount of care taken to abide by HIPAA rules. The penalty range is \$100-\$50,000 per violation, with an annual maximum of \$25,000 for repeat violations.
• Tier 2: A violation that the covered entity should have been aware of but could not have avoided even with a reasonable amount of care. The penalty range is \$1,000-\$50,000 per violation, with an annual maximum of \$100,000 for repeat violations.
• Tier 3: A violation suffered as a direct result of "willful neglect" of HIPAA rules, in cases where an attempt has been made to correct the violation. The penalty range is \$10,000-\$50,000 per violation, with an annual maximum of \$250,000 for repeat violations.
• Tier 4: A violation of HIPAA rules constituting willful neglect, where no attempt has been made to correct the violation within 30 days. The penalty range is a minimum of \$50,000 per violation, with an annual maximum of \$1.5 million.

In addition to financial penalties, covered entities and business associates may be required to adopt a corrective action plan to address compliance deficiencies and bring policies and procedures up to the standards demanded by HIPAA. State attorneys general can also bring civil actions, resulting in monetary damages, and covered entities may be suspended from Medicare for civil violations.

Frequently asked questions