Disclosing PHI to Law Enforcement

Disclosures to Law Enforcement

A law enforcement officer may come into your office and request that you give him information on one of your patients.  He may have some legal documents with him to prove his request is valid, or he may just want to know if the patient is on the premises. What do you do?  It can be confusing if you do not know the HIPAA Privacy Rule governing releasing PHI to law enforcement. Following are the basic guidelines your staff should know.

The Privacy Rule established procedures and safeguards to restrict the circumstances under which you may give such information to law enforcement officers.  If the law enforcement officer does not have a warrant and has not made any prior process, you are limited in the information you may disclose.  The Privacy Rule specifically prohibits disclosure of DNA.  Similarly, under most circumstances, the Privacy Rule requires you to obtain permission from persons who have been the victim of domestic violence or abuse before disclosing information about them to law enforcement.  Some other federal or state law may require a disclosure, and the Privacy Rule does not interfere with the operation of these other laws.  However, if the disclosure is required by some other law, HHS has said that you should use your professional judgment to decide whether to disclose information, reflecting your own policies and ethical principles.  In other words, HHS is allowing healthcare providers to continue to follow their own policies to protect privacy in such instances. 

Disclosures Allowed Without an Authorization

The Privacy Rule is balanced to protect an individual’s privacy while allowing important law enforcement functions to continue.  The Rule permits covered entities to disclose protected health information (PHI) to law enforcement officials, without the individual’s written authorization, under specific circumstances summarized below:

• Court-Ordered Warrant or Subpoena
• To comply with a court order or court-ordered warrant, a subpoena, or summons issued by a judicial officer or a grand jury subpoena – The Rule recognizes that the legal process in obtaining a court order and the secrecy of the grand jury process provides protections for the individual’s private information.
• Administrative Request or Subpoena
• To respond to an administrative request such as an administrative subpoena or investigative demand or other written request from a law enforcement official – Because an administrative request may be made without judicial involvement, the Rule requires all administrative requests to include or be accompanied by a written statement that the information requested is relevant and material, specific and limited in scope, and de-identified information cannot be used.
• Applicable Law and Ethical Standard
• To a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public; or to identify or apprehend an individual who appears to have escaped from lawful custody.
• Averting a Serious Threat to Health and Safety
• If you believe that your practice, a workforce member, a patient, or the public is in danger of a threat to health and safety, your disclosure of PHI for that purpose is protected under HIPAA.  You may, consistent with law and ethical conduct, use or disclose PHI if you believe in good faith that:
• It is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public;

And

• It is reported to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat

Or

• It is necessary for law enforcement authorities to identify and apprehend an individual:
•  
• Because of a statement by an individual admitting participation in a violent crime that you reasonably believe may have caused serious physical harm to the victim;

Or

• Where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody. 

Identifying an Individual

To respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness or missing person; but you must limit disclosures of PHI to name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics.  Other information related to the individual’s DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision, but may be disclosed in response to a court order, warrant, or written administrative request.

This same limited information may be reported to law enforcement:

• About a suspected perpetrator of a crime when the report is made by the victim who is a member of your workforce;
• To identify or apprehend an individual who has admitted participation in a violent crime that you reasonably believe may have caused serious physical harm to a victim, provided that the admission was not made in the course of or based on the individual’s request for therapy, counseling, or treatment related to the propensity to commit this type of violent act. 

Victim of a Crime

To respond to a request for PHI about a victim of a crime, and the victim agrees – If, because of an emergency or the person ‘s incapacity, the individual cannot agree, you may disclose the PHI if law enforcement officials represent that the PHI is not intended to be used against the victim, is needed to determine whether another person broke the law, the investigation would be materially and adversely affected by waiting until the victim could agree, and you believe in your professional judgment that doing so is in the best interests of the individual whose information is requested.

Safety in Oral Exchange of PHI

HIPAA Reminder – Privacy and Oral Communications

Oral communications at your practice are extremely important but are often overlooked and forgotten.  They can be a confusing issue but need serious attention.

The Privacy Rule applies to individually identifiable health information in all forms. Coverage of oral or spoken information ensures that information retains protections when discussed. If oral communications were not covered, any health information could be disclosed to any person, so long as the disclosure was spoken.

Providers and health plans understand the sensitivity of oral information. For example, many hospitals already have confidentiality policies and concrete procedures for addressing privacy, such as posting signs in elevators that remind employees to protect patient confidentiality.

Reasonable safeguards for orally exchanging PHI include:

• keeping a distance between the public and the people you’re speaking to
• stepping into a room with a door
• lowering your voice
• using the handset instead of the speakerphone

The Privacy Rule is not intended to prohibit providers from talking to each other and to their patients. It is understood that overheard communications are unavoidable. These are considered to be incidental disclosures.

For example, in a busy emergency room, it might be necessary for providers to speak loudly in order to ensure appropriate treatment. The Privacy Rule is not intended to prevent this appropriate behavior. The following practices are permissible, if reasonable precautions are taken to minimize the chance of inadvertent disclosures to others who might be nearby such as using lowered voices:

• healthcare staff may orally coordinate services at hospital nursing stations
• nurses and other healthcare professionals may discuss a patient’s condition over the phone with the patient or a provider
• staff may call outpatient’s names in waiting areas
• healthcare professionals may discuss a patient’s condition during training rounds in an academic or training institution

These are all considered to be incidental disclosures under HIPAA. HIPAA is not meant to impede the quality of our healthcare. Its intent is to improve our quality of care.

#HIPAA