Tread carefully when police ask for patient info
It's a common scenario in any health care facility, especially hospital emergency rooms: The local police ask the nurse or doctor for information about a patient who is either a suspect, a victim, or a witness to a crime. Or perhaps the risk manager receives a more formal request for records. How much can you tell them without violating the Health Insurance Portability and Accountability Act (HIPAA)?
Health care providers must be careful not to react too quickly to such requests with either a positive or negative response, cautions Patrick Hurd, JD, senior counsel and leader of the health care industry group with the law firm of LeClair Ryan in Norfolk, VA. Hurd also is a former hospital risk manager.
HIPAA compliance has been drilled into everyone working in health care so much that the initial response to a police request might be an automatic no, but that would be a mistake, Hurd says.
"We sometimes overreact and say we can't disclose anything. That's not the case," he says. "When I was risk manager in a hospital, I made sure we trained our people in what you can disclose without the consent of the patient, the things you must disclose by state law, and the things you can disclose only if you [receive] permission of the patient or guardian."
HIPAA allows disclosures
HIPAA was never intended to prevent necessary communication with law enforcement and allows certain disclosures to police, but the details of day-to-day compliance can be tricky, says Gerry Hinkley, JD, co-chair of the health care industry team with the law firm of Pillsbury Winthrop in San Francisco, who regularly counsels clients on HIPAA-related issues.
"HIPAA provides a clear road map without requiring a subpoena for disclosure to law enforcement of protected health information by HIPAA-covered entities," he says. "However, HIPAA does not pre-empt more restrictive state laws, so HIPAA-covered entities are cautioned to confirm what the laws of their state require for such disclosures to police investigations."
Providers should obtain a declaration in writing that the information is needed for a legitimate law enforcement purpose, Hinkley says. That can be accomplished in a couple of ways. The hospital can provide a checklist form that you ask the officer to complete for each request, or you can ask the local law enforcement to provide a blanket form for all requests.
"You can ask that the district attorney or police chief provide you a simple letter each year that states that when a police officer in uniform or displaying proper credentials asks for information that may be released, the hospital may have confidence that they are doing so for a legitimate law enforcement purpose," Hinkley says. "Then you can just keep that on file."
Lourdes Martinez, JD, an attorney with the law firm of Garfunkel Wild in Great Neck, NY, cautions that HIPAA is not the only concern. State laws can be more restrictive, as in New York state.
"By HIPAA it might not be a violation, but it still could be a violation of state law," she says. "That's the situation with a lot of requests in New York state that might be granted more easily in other states."
Policies and procedure must cover both HIPAA and state laws, Martinez says. Training of front-line staff also is crucial, she says.
"I used to be a prosecutor, so I know that sometimes when the police or a prosecutor come asking for information, it can be a little intimidating," she says. "If the people on the front line don't know what they can and can't say, they might be intimidated into saying something that perhaps they shouldn't."
Consider the situation
Each situation must be carefully assessed, the attorneys say. For instance, if a police officer inquires about a crime victim, usually the victim must agree to the release if he or she is capable, Hurd explains. But if the victim is not capable of consent, the provider can release the information as long as the authorities stipulate that it is not to be used against the victim.
"If the police say they are hunting for the perpetrator and the investigation will be hindered if they wait until the victim wakes up or is out of surgery, the health care provider is allowed to use their professional judgment to release information," Hurd says. "Obviously, you need to verify the credentials of the law enforcement person before you release anything. It's always a good idea to document the officer's name and badge number in the chart and what reason the officer stated for needing the information."
Health care providers must be careful not to go too far and become actively involved in a criminal investigation, Hurd says. HIPAA allows the release of certain data, but staff should simply provide that information to the officer without editorializing.
State laws can supersede some HIPAA privacy concerns, such as when laws require the reporting of gunshot wounds, Hurd says. The issue can be more difficult when there are allegations of child, spousal, or elder abuse, Hurd says. State laws will vary on what must be reported, but in Virginia, for instance, health providers are required to report child and elder abuse. Information about abuse related to an adult, however, cannot be provided without the patient's consent, Hurd says.
The health care provider also may receive subpoenas and search warrants involving patient records. The legal order provides solid legal backing for the release of information, but that release still should be handled carefully, Hurd says. The goal is to make sure you release only the information covered in the subpoena or search warrant.
"Once you've verified that the search warrant is proper, I would gather the appropriate parties to oversee this release the risk manager, your in-house counsel, the compliance director, and health information management," Hurd says. "The police officers are going to be a little perturbed that they have to wait, but it's a good idea to have all those people involved and verifying the proper release of the information. Then you should make a copy for the hospital of all the information released to the officers, document how and to who it was released, and risk management should hold on to that, along with a copy of the search warrant."
Layna Cook, JD, an attorney with the law firm of McGlinchey Stafford in Baton Rouge, LA, notes that HIPAA does not prevent health care providers from notifying law enforcement that there is a fugitive on the premises or that they suspect a crime has been committed. The key, she says, is to limit the information you provide to law enforcement.
"The goal is to provide the minimally necessary, pertinent, factual information and then allow law enforcement to take it from there," Cook says. "You don't call the police and just tell them everything you know about this person. If there is a specific reason for bringing this person to their attention, that's what you do and then let the police investigate as necessary. From that point, each request for more information has to be considered in light of the allowable exceptions under HIPAA."
Sources
For more information on HIPAA compliance and police inquiries, contact:
Layna Cook, JD, Attorney, McGlinchey Stafford, Baton Rouge, LA. Telephone: (225) 382-3635. E-mail: [email protected].
Gerry Hinkley, JD, Co-Chair, Health Care Industry Team, Pillsbury Winthrop Shaw Pittman, San Francisco. Telephone: (415) 983-1135. E-mail: [email protected].
Patrick Hurd, JD, Senior Counsel, LeClair Ryan, Norfolk, VA. Telephone: (757) 441-8931. E-mail: [email protected].
Lourdes Martinez, JD, Attorney, Garfunkel Wild, Great Neck, NY. Telephone: (516) 393-2221. E-mail: [email protected].
It's a common scenario in any health care facility, especially hospital emergency rooms: The local police ask the nurse or doctor for information about a patient who is either a suspect, a victim, or a witness to a crime. Or perhaps the risk manager receives a more formal request for records. How much can you tell them without violating the Health Insurance Portability and Accountability Act (HIPAA)?You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content