HIPAA and Law Enforcement

When can you share protected health information with law enforcement? There are certain circumstances when you can share PHI with the law.  You should always keep the “minimum necessary” rule in mind whenever you are giving out information.

Coroners/Medical Examiners Information needed to identify a body or determine cause of death can be sent to the coroner or medical examiner on request.  We recommend that you get the request in writing on their letterhead.  You can send the information in any secured manner such as fax, encrypted email, hand-delivery, or pick up by a representative from the coroner’s office or by a law enforcement officer.  You cannot send it via a family member of the deceased as this destroys the chain of custody for the data.  US mail, while considered secure, is usually not fast enough for the coroner’s needs.

Subpoenas  There are several different kinds of subpoenas.  They all have one thing in common. You must respond.  You need to be sure that your patient has been informed and had time to get the subpoena blocked through the courts if they want.  You can verify this with a judge-signed subpoena, an authorization signed by the patient or an attorney signed document that states this process has already happened.  You can even call and talk to your patient and document this.  If your patient doesn’t want you to respond to the subpoena the patient has to provide a letter from their attorney or a court order to block the subpoena.

Active Investigation If the police have an active investigation they can request information from you.  They are NOT allowed to search your records to find information to open an investigation.  You can verify this by asking them to sign a request that they give the following information:

• The case number
• The specific kind of information they want (DNA information requires a court order.)
• The officer’s signature, name, rank and badge number

• Whether the disclosure needs to be withheld from the patient. (In order to protect the integrity of an active investigation, law enforcement can request that patients are not notified of a PHI disclosure until a specified end date or event such as the case is closed.) Otherwise it goes on an accounting of disclosures log in the patient’s file.

Crime on Premises If a crime has occurred on your premises you are allowed to report it the police and give them information to confirm the crime.

Avert a Serious and Imminent Threat to Health and Safety of an Individual or the Public   You can report to the police if you believe that someone poses a serious and immediate threat.  This includes reporting someone who you know has escaped from lawful custody.  You cannot report someone who you just believe has the capacity of causing harm based on counseling.

Correctional Institutes You can provide information to the correctional institute that is necessary for health and safety of the inmate as well as the prison’s personnel.

As with all disclosures, the doctor can make a determination to not release information if they feel it would endanger the health and safety of an individual. Only the doctor can make this determination and they may be required to appear before a judge to defend that decision.