Barbara Duncan, HIPAA privacy officer at Stormont Vail Health in Topeka, Kansas, developed this tip sheet for employees to briefly explain what protected health information (PHI) disclosures HIPAA permits, and requires, to law enforcement officers. She met with the Topeka Police Department at its request to improve understanding of HIPAA, and later shared the tip sheet with police officers. Contact Duncan at bduncan@stormontvail.org.
Tip Sheet: Integrity & Compliance
Purpose
To help facilitate staff in providing appropriate information to Law Enforcement Officials while in the course of their work. This tip sheet does not apply to Mandatory Reporting requirements based on team member’s licensure. For Mandatory Reporting, follow policies in Policy Technology.
Disclaimer
If there are other more stringent laws—drug or alcohol treatment records or mental health records—the more stringent laws apply. If unsure, check with Release of Information.
Tips
Stormont Vail Health, to request and document disclosures made to Law Enforcement of non-mandatory PHI, has developed a Request from Law Enforcement for Release of Protected Health Information Form to be completed at the time of the request and of disclosure(s) and provided under the following designated circumstances:
-
Law Enforcement involvement with patient:
-
Patient in custody: Team members may disclose information if police represents such information is needed to provide health care to the individual; for the health and safety of the individual, other inmates, officers or employees of or others at a correctional institution or responsible for the transporting or transferring of inmates; or for the administration and maintenance of the safety, security, and good order of the correctional facility, including police on the premises of the facility. ( 45 C.F.R. § 164.512(k)(5) ).
-
Patient discharged to Law Enforcement: If the patient is being discharged to Law Enforcement custody, it is appropriate to provide a copy of the discharge instructions to the patient and Law Enforcement Official.
-
-
Law Enforcement is requested for an unruly/aggressive patient:
-
It is appropriate to explain extenuating circumstances, i.e., patient is non-English speaking, non-verbal, suspected to have an infectious condition (general information regarding condition and provide appropriate PPE), and/or confused. Information that will help support the Law Enforcement Officer’s engagement with the patient.
-
Under these circumstances, Law Enforcement Officers would be allowed to have body cameras activated while they are interacting with the patient and in the room with patient and healthcare team until patient is calm and responding appropriately.
-
-
Law Enforcement arrives with suspect:
-
Suspect is brought in and is cooperative or non-responsive. Law Enforcement should be in the vicinity of the patient, allowing enough distance for healthcare team to work.
-
Suspect is brought in and is not cooperative, is aggressive or unruly with staff. Staff may request Law Enforcement to remain in the room.
Law Enforcement Officers utilizing body cameras while on Stormont Vail Health property may be requested to minimize recording in accordance with their departmental policies and existing agreements with Stormont Vail Health in order to assist with maintaining patient privacy and the protection of patient information (Protected Health Information (PHI)) under the Health Insurance Portability and Accountability Act (HIPAA) and related federal and state laws.
-
-
Law Enforcement accompanies victim to the hospital: Information about a patient who is suspected to be a crime victim will be provided to a Law Enforcement Official only if:
-
The individual agrees to the disclosure; or
-
Stormont Vail Health is unable to obtain the individual’s agreement because of incapacity or other emergency circumstances; Stormont Vail Health determines that the disclosure is in the best interests of the individual; and/or the Law Enforcement Official represents that: (i) the information is needed to determine whether a violation of law by a person other than the victim has occurred; (ii) such information is not intended to be used against the victim; (iii) immediate Law Enforcement activity that depends upon the disclosure would be materially affected by waiting until the individual is able to agree.
-
-
Law Enforcement accompanies patient who requests that no information be given and/or they do not want to talk with Law Enforcement or Law Enforcement comes to the facility requesting communication with the patient and the patient refuses:
-
Law Enforcement will be informed that the patient has requested no information be given or requested no contact by Law Enforcement. Law Enforcement, if still requests information, will be referred to Security.
-
-
Law Enforcement requests information to identify or locate person of interest: The following information may be disclosed, if and when available, to a Law Enforcement Official in response to the Law Enforcement Official’s request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person:
-
Name and address;
-
Date and place of birth;
-
Social Security number;
-
ABO blood type and rh factor;
-
Type of injury;
-
Date and time of treatment;
-
Date and time of death, if applicable; and
-
A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or mustache), scars, and tattoos.
-
-
The hospital may not disclose any protected health information related to the individual’s DNA or DNA analysis; dental records; or typing, samples, or analysis of body fluids or tissue.
-
The Law Enforcement Official’s request for such information should be specific and narrow in scope. ( 45 C.F.R. §164.512(f) ).
-
Other Law Enforcement Official Inquiries
Private Patient and/or Patients not listed on our facility roster:
-
If you are asked to verify a patient is here and the patient is listed as (Private Patient), direct Law Enforcement to Security.
Missing persons: if patient has requested no information be provided to family members, and family member files the missing person report, team members need to provide this detail to Security. Security will take the initiative to notify Law Enforcement that the patient is safe and is requesting no contact with family, not confirming that the patient is still within our facility.
-
If Law Enforcement is responding to a call from the patient, staff will inquire of the patient if they want to speak with the Law Enforcement Officer.
As Required by Law Disclosure
-
As or if required by law, suspected child or adult abuse shall be reported to a Law Enforcement Officer when the Department of Children and Families (DCF) is not open to receive reports; if the individual agrees; if expressly authorized by law; or based on the exercise of professional judgment, the report is necessary to prevent serious harm to the individual or to others, or in certain other emergency situations. See policy: Identification and Reporting of Child Abuse, Neglect and/or Sexual Abuse, Adult Abuse and/or Victims of Violent Crimes. ( 45 C.F.R. § 164.512(a),(c) ).
-
A death that is believed to have been the result of criminal conduct shall be reported to Law Enforcement. Prior to any disclosure, the identity and authority of the Law Enforcement Officer, requestor or recipient of information will be verified and documented on the Request from Law Enforcement for Release of Protected Health Information Form.
-
Information that Stormont Vail Health believes to be criminal conduct on its premises may be reported to appropriate Law Enforcement if a Stormont Vail Health employee/volunteer is the victim and if appropriate. This contact will be made through Security.
-
Receipt of any legal documents should be forwarded immediately to Risk Management for appropriate disposition. Legal documents include court order or court-ordered warrant, subpoena or summons signed by a judge, Grand Jury subpoena, an administrative request or investigative demand. ( 45 C.F.R. §164.512(e) ).
Prior to any disclosure, the identity and authority of the Law Enforcement Officer, requestor or recipient of information will be verified and documented on the Request from Law Enforcement for Release of Protected Health Information Form.
Contact information
Questions about whether or not to disclose information to Law Enforcement should be referred to Risk Management or Security, depending on time of day. The Privacy Office staff are available Monday – Friday 0800 to 1630.
Cynthia Wickstrom, Administrative Director, Risk and Safety
Steve Taylor, Manager, Security
For general questions about disclosures to Law Enforcement Officers, please contact the Privacy Office at (785)354-6343 or bduncan@stormontvail.org.
References
45 C.F.R. § 164.512(f)(1)(ii)(A)-(B)
45 C.F.R. § 164.512(f)(1)(ii)(C)
45 C.F.R. § 164.512(f)(2)
45 C.F.R. § 164.502(j)(2)
45 C.F.R. § 164.512(j)(1)(ii)(A), (j)(2) -(3)
45 C.F.R. § 164.512(f)(3)
45 C.F.R. § 164.512(b)(1)(ii)
45 C.F.R. § 164.512(k)(5) )