Because it’s the trauma center for northeast Kansas, Stormont Vail Health in Topeka is no stranger to police officers, who follow up reports of car accidents with suspected drunk driving, gunshot wounds, people found unresponsive at home, and all manner of human drama and trauma that bring together law enforcement and health care providers. There have been tensions, because sometimes police officers want more protected health information (PHI) than hospital employees are permitted to share under HIPAA, and because sometimes hospital employees hold back information unnecessarily. That was the backdrop for the Topeka Police Department’s invitation to Stormont Vail Health to teach its police officers about the privacy regulation.

Barbara Duncan, Stormont Vail Health’s HIPAA privacy officer, gave talks at six meetings with police officers and eventually developed a tip sheet on release of PHI to law enforcement for the health system’s staff that she shared with the police department.^[1]

“They don’t want to cause us problems and we don’t want to cause them problems, but we have to follow the HIPAA regulations,” Duncan says. “From the information they understood about HIPAA, it was more they felt we were not giving them information we were allowed to.” She explained the minimum necessary standard to the police officers because they were unfamiliar with the concept. “They started understanding a little more why we may be reluctant to give them information when they came in,” she says. But education also was necessary at the hospital. “We had staff who wanted to be very helpful and we had staff that said, ‘No way would you get anything out of me’—both spectrums,” Duncan says. So the discussions and the tip sheet were a big step toward clarifying what information could be shared and how police officers should request it.

“We are trying to make a friendly collaboration on both sides,” she says. “If we are not answering, it’s because of a HIPAA concern. And we want staff to feel more comfortable when we are answering questions.” For example, when a patient is brought to the emergency room after a motorcycle accident, the police will come to the emergency room and ask the location where the patient was brought in from so they can investigate the accident. Hospital employees may decline to give that information, citing HIPAA. “That wouldn’t necessarily be PHI,” Duncan says, and can be shared with the police.