HIPAA’s Privacy Rule allows for disclosure of PHI to law enforcement under specific circumstances. Any time a law enforcement official contacts your organization or shows up in person, the Privacy Officer should be alerted so that they may perform identity verification and determine whether any requested disclosures are permitted.
The Privacy Rule was written so that its standards balance the need to protect an individual’s privacy while allowing important law enforcement functions to continue. The Rule permits covered entities to disclose protected health information (PHI) to law enforcement officials, without the individual’s written authorization, under specific circumstances summarized below.
To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena. The Rule recognizes that the legal process in obtaining a court order and the secrecy of the grand jury process provides protections for the individual’s private information.
To respond to an administrative request, such as an administrative subpoena or investigative demand or other written request from a law enforcement official. Because an administrative request may be made without judicial involvement, the Rule requires all administrative requests to include or be accompanied
by a written statement that the information requested is relevant and material, specific and limited in scope, and de-identified information cannot be used.
To respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness or missing person; but the covered entity must limit disclosures of PHI to name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics. Other information related to the individual’s DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision, but may be disclosed in response to a court order, warrant, or written administrative request.
Many questions arise with regard to potential visits from immigration enforcement agents (Immigration and Customs Enforcement-ICE). ICE agents may not enter private areas of your facility without a judicial warrant signed by a judge or magistrate. However, under the current administration, ICE agents may enter public areas of your facility and ask questions about patients.
Be sure that everyone knows to direct agents to your Privacy Officer, who will be prepared to respond with identity verification and other measures. ICE agents are permitted to question people in your waiting room or other public area or look at any information “in plain view,” but patients have the right to remain
silent. You are only required to disclose PHI if there is a judicial warrant signed by a judge or magistrate. General questioning or requests do not require your response if you do not wish to do so. Maintain a calm and courteous manner with agents, and inform them that you must comply with HIPAA privacy laws. Explain the requirement to verify whether disclosures are permitted/necessary.
This same limited information outlined above may be reported to law enforcement:
About a suspected perpetrator of a crime when the report is made by the victim who is a member of the covered entity’s workforce;
To identify or apprehend an individual who has admitted participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to a victim, provided that the admission was not made in the course of or based on the individual’s request for therapy, counseling, or treatment related to the propensity to commit this type of violent act.
To respond to a request for PHI about a victim of a crime, and the victim agrees. If, becauseof an emergency or the person’s incapacity,the individual cannot agree, the coveredentity may disclose the PHI if law enforcementofficials represent that the PHI is not intendedto be used against the victim, is needed to determine whether another person broke thelaw, the investigation would be materially and
adversely affected by waiting until the victim could agree, and the covered entity believes in its professional judgment that doing so is in the best interests of the individual whose information is requested.
Where child abuse victims or adult victims of abuse, neglect or domestic violence are concerned, other provisions of the Rule apply:
Child abuse or neglect may be reported to any law enforcement official authorized by law to receive such reports, and the agreement of the individual is not required.
Adult abuse, neglect, or domestic violence may be reported to a law enforcement official authorized by law to receive such reports:
- If the individual agrees;
- If the report is required by law; or
- If expressly authorized by law, and based on the exercise of professional judgment, the report is necessary to prevent serious harm to the individual or others, or in certain other emergency situations.
Notice to the individual of the report may be required.
To report PHI to law enforcement when required by law to do so. For example, state laws commonly require health care providers to report incidents of gunshot or stab wounds, or other violent injuries; and the Rule permits disclosures of PHI as necessary to comply with these laws.
To alert law enforcement to the death of the individual, when there is a suspicion that death resulted from criminal conduct.
Information about a decedent may also be shared with medical examiners or coroners to assist them in identifying the decedent, determining the cause of death, or to carry out their other authorized duties.
To report PHI that the covered entity in good faith believes to be evidence of a crime that occurred on the covered entity’s premises.
When responding to an off-site medical emergency, as necessary to alert law enforcement about criminal activity, specifically, the commission and nature of the crime, the location of the crime or any victims, and the identity, description, and location of the perpetrator of the crime. This provision does not apply if the covered health care provider believes that the individual in need of the emergency medical care is the victim of abuse, neglect or domestic violence; see above Adult abuse, neglect, or domestic violence for when reports to law enforcement are allowed.
When consistent with applicable law and ethical standards:
To a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public; or
To identify or apprehend an individual who appears to have escaped from lawful custody.
For certain other specialized governmental law enforcement purposes, such as:
To federal officials authorized to conduct intelligence, counter-intelligence, and other national security activities under the National Security Act or to provide protective services to the President and others and conduct related investigations;
To respond to a request for PHI by a correctional institution or a law enforcement official having lawful custody of an inmate or others if they represent such PHI is needed to provide health care to the individual; for the health and safety of the individual, other inmates, officers or employees of or others at a correctional institution or responsible for the transporting or transferring inmates; or for the administration and maintenance of the safety, security, and good order of the correctional facility, including law enforcement on the premises of the facility.
Minimum Necessary Standard
Except when required by law, the disclosures to law enforcement summarized above are subject to a minimum necessary determination by the covered entity. When reasonable to do so, the covered entity may rely upon the representations of the law enforcement official (as a public officer) as to what information is the minimum necessary for a disclosure you’ve determined is permitted. It is advisable to
obtain regulatory references and review them if a law enforcement official is stating that the disclosure is permitted without a warrant or subpoena.
