Police, Providers, Patients and HIPAA

Recent cases have highlighted the conflict that may occur when police seek access to patients or patient information. Here are some general guidelines for physicians and other healthcare providers when facing demands from police or other law enforcement officials.

Disclosing Patient Information. The HIPAA privacy rules (45 CFR § 164.501 et seq.) generally prohibit healthcare providers from disclosing protected health information to law enforcement officials without the patient's written authorization unless certain conditions are met. HIPAA allows disclosures for law enforcement purposes in the following cases:

1. Court Order, Warrant, Subpoena, or Administrative Process. A provider may disclose information in response to a court order, warrant, subpoena or other administrative process if certain conditions are satisfied. (45 CFR § 164.512(f)(1)(ii)). These situations are discussed more fully in our separate client alert here.
2. Avert Harm. A provider may disclose information to law enforcement to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public. (45 CFR § 164.512(j)(1)(i)). Many states have specific statutes authorizing or requiring providers to make disclosures when credible threats are made against third parties.
3. Required by Law. A provider may disclose information to law enforcement when a law requires the disclosure, e.g., to report child or adult abuse or neglect, injuries from gunshots or criminal activity, etc. Providers should comply with the strict terms of the law, and not disclose more than is required by the law. (45 CFR § 164.512(a), (f)(1)(i); see also § 164.512(b)(1)(ii) (child abuse) and § 164.512(c) (adult abuse)).
4. Facility Directory. HIPAA generally allows, but does not require, providers to disclose limited information to persons who ask for a patient by name unless the patient has objected to such disclosures or the provider believes that the disclosure is not in the patient’s best interests. (See 45 CFR § 164.510). The provider may only disclose the patient’s name, general condition, and location in the facility. (Id.).
5. Identify Person. If law enforcement requests information to help identify or locate a suspect, fugitive, material witness or missing person, a provider may disclose the following limited information: name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics. Other information related to the individual's DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision, but may be disclosed in response to a court order, warrant, or written administrative request. (45 CFR § 164.512(f)(2)). The disclosure must be in response to a request from law enforcement, which may include a response to a "wanted" poster or bulletin.
6. Victim of a Crime. If law enforcement requests information about a person who is suspected of being a victim of a crime, a provider may disclose information if: (a) the individual agrees to the disclosure, or (b) the officer represents that the information is necessary to determine whether someone other than the victim has committed a crime, the information will not be used against the victim, the information is needed immediately and the law enforcement activity would be adversely affected by waiting to obtain the victim's agreement, and the provider determines it is in the victim's best interest to disclose the information. (45 CFR § 164.512(f)(3)).
7. Death. A provider may disclose information to notify law enforcement about the death of an individual if the provider believes the death may have resulted from a crime.
8. Crime on Premises. A provider may disclose information to law enforcement if the provider believes the information evidences criminal conduct on the provider's premises. (45 CFR § 164.512(f)(5)).
9. Crime Away from Premises. If, in the course of responding to an off-site medical emergency, providers become aware of criminal activity, they may disclose certain information to police as necessary to alert law enforcement to the criminal activity, including information about the commission and nature of the crime, the location of the crime or any victims, and the identity, description, and location of the perpetrator of the crime. (45 CFR § 164.512(f)(6)).
10. Report by Victim. If a person affiliated with the provider is the victim of a crime, the person may disclose information necessary to report the crime to law enforcement; however, the person may only disclose the limited information listed in 45 CFR § 164.512(f)(2)(i). (45 CFR § 164.502(j)(2)).
11. Admission of Violent Crime. If a person has admitted participation in a violent crime that a provider reasonably believes may have caused serious physical harm to a victim, a provider may disclose information to law enforcement necessary to identify or apprehend the person, provided that the admission was not made in the course of or based on the individual's request for therapy, counseling, or treatment related to the propensity to commit this type of violent act. (45 CFR § 164.512(j)(1)(ii)(A), (j)(2)-(3)).
12. Fugitive. A provider may disclose information to law enforcement to identify or apprehend an individual who appears to have escaped from lawful custody. (45 CFR § 164.512(j)(1)(ii)(B)).
13. Prisoners. If law enforcement or a correctional institution requests protected health information about an inmate or person in lawful custody, a provider may disclose information if police represents such information is needed to provide health care to the individual; for the health and safety of the individual, other inmates, officers or employees of or others at a correctional institution or responsible for the transporting or transferring inmates; or for the administration and maintenance of the safety, security, and good order of the correctional facility, including police on the premises of the facility. (45 CFR § 164.512(k)(5)).
14. Medical Examiners and Coroners. A provider may disclose information about a decedent to medical examiners or coroners to assist them in identifying the decedent, determining the cause of death, or to carry out their other authorized duties. (45 CFR § 164.512(g)(1)).

Before disclosing information to police or other law enforcement officials, providers should also consider the following:

1. More Restrictive Laws. Are there other state or federal laws that limit disclosures? Montana, for example, places conditions on disclosures to police that are more restrictive than HIPAA. (See, e.g., Mont. Code Ann. § 60-16-805). Many states have specific laws concerning disclosure of drug or alcohol treatment records (See 42 CFR part 2); peer review documents, etc. Remember: to the extent another state or federal law is more restrictive than HIPAA, providers are generally required to comply with the more restrictive law.
2. Verify. If the law enforcement official making the request for information is not known to the provider, the provider must verify the identity and authority of such person prior to disclosing the information, e.g., by requesting identification. (45 CFR § 164.514(h)).
3. Minimum Necessary. A provider should limit disclosures to the minimum necessary. (45 CFR §§ 164.502(b), 164.514(d)). When reasonable to do so, the provider may rely upon the representations of the law enforcement official (as a public officer) as to what information is the minimum necessary for their lawful purpose. (45 CFR § 164.514(d)(3)(iii)(A)).
4. Explain Limits. If the situation does not fit within one of the exceptions allowing disclosures, the provider should explain the limits to the law enforcement official. The HHS Office for Civil Rights has published a helpful Guide for Law Enforcement, which may be accessed here. It is sometimes helpful to give a copy of the Guide to the officer or their supervisor so they understand the limits.
5. Do Not Physically Interfere or Misrepresent Facts. Although the provider may explain the limits, the provider should not lie or provide false information to the police or physically interfere if the officer insists on accessing information over the provider's objection. Instead, the provider should attempt to take the matter to the officer's supervisor. In appropriate cases, the provider may want to contact their own attorney.
6. Document. In all cases, a provider should document the circumstances surrounding the disclosure to police or other law enforcement officials. Such information must generally be reported in the log for accounting of disclosures as required by 45 CFR § 164.528. More importantly, documenting the provider’s reasonable objections and the police response will help protect the provider if there are allegations in the future.

Police Access to Patients. Absent a court order or warrant allowing access, the police generally do not have an absolute right to access patients or compel provider cooperation in interacting with patients, but the rules are somewhat ill-defined. Law enforcement officials likely have less authority to access privately-owned facilities without a warrant. Depending on the jurisdiction and circumstances, police may be entitled to access patients in areas that are open to the public; however, healthcare providers generally should not allow the police unrestricted access to treatment areas. Police access to such areas may interfere with patient care by, among other things, increasing the risk of infection; interfering with operations; and/or causing distress or anxiety to the patient or providers. HIPAA requires that providers implement appropriate safeguards to protect against unauthorized disclosure of confidential information; allowing unrestricted access may result in improper disclosures. (See 45 CFR § 164.530). Accordingly, when police request access to patients, it is appropriate to do the following:

1. Do Not Misrepresent Facts. Never lie to the police. It is one thing to explain that the law prohibits you from disclosing information or declining to answer; it is another thing to lie or misrepresent facts to the police. Doing so may constitute obstruction of justice or a violation of other crimes.
2. Explain Limits. Providers should notify the police that, due to patient care and HIPAA concerns, police (like other members of the public) are generally not given unrestricted access to patient care areas.
3. Patient Consent. If the police request access to a patient, the provider should seek the patient’s consent unless the police prohibit it due, e.g., to the risk that the patient may elope. If the patient agrees and it does not interfere with the patient’s care, the police may be allowed access. If the patient refuses, the provider should explain the same to the police and ask the police to obtain a warrant or court order, or identify some other statutory provision or law that authorizes their access over the provider’s and patient’s objection.
4. Do Not Physically Interfere. If the police insist on accessing the patient despite the provider’s objections, the provider should not physically interfere with the police. Instead, the provider should document the situation (including the officer’s name, the provider’s discussions with the patient and police, and the officer’s response), and raise appropriate objections with the officer’s supervisor.

Police Requests for Tests. Absent a specific state law or court order to the contrary, competent patients (including persons in custody of the police) generally have the right to consent to or refuse their own health care, including tests. Accordingly, tests or other treatment generally should not be performed without the patient’s consent. In the case of minors or incompetent patients, the provider must generally obtain the consent of the minor’s guardian, parent, or other legally authorized surrogate decision-maker. State laws sometimes allow treatment or testing without the patient’s consent in the following cases:

1. Court Order or Warrant. Under some circumstances, a court may order that an individual undergo certain tests or procedures to obtain evidence, e.g., blood samples, urine samples, saliva samples, etc. The provider should comply with any court order unless doing so would jeopardize the patient, the provider, or others, in which case the provider should explain the same to the police and, if necessary, file an appropriate objection with the court.
2. DUI Tests. State laws often deem persons with drivers licenses to have consented to evidentiary testing (e.g., blood tests, urine tests, etc.); nevertheless, the laws generally allow the patient to refuse tests or authorize providers to decline to perform the test if doing so would jeopardize the patient, provider or others. Officers are less likely to insist on DUI testing without the patient’s consent in the wake of the United States Supreme Court’s decision in Missouri v. McNeely, 569 U.S. 141 (2013).
3. Other Tests. State laws often authorize providers to examine or test inmates or persons who may have committed certain other offenses such as sexual offenses, drug violations, or crimes involving the transmission of infected bodily diseases. Providers should know and understand the limits of such laws, including the patient’s right to object and the provider’s right to refuse.

Police Requests for Contact. Police sometimes request that a hospital or other providers contact them if a patient arrives under certain conditions, e.g., evidence of drug use; traffic injuries; or injuries consistent with the commission of a crime. Unless a specific law requires such disclosures or the disclosure would otherwise fit within one of the exceptions cited above, the provider should explain to the police that state and federal laws prohibit such disclosures. Similarly, police will sometimes ask that officers be notified when a patient is ready for discharge. Again, unless the disclosure would fit within one of the exceptions cited above, the provider should generally explain to the officer that the provider may not make such a disclosure without the patient’s authorization.

Conclusion. Although providers can and should cooperate with law enforcement as appropriate (especially when doing so is necessary to keep themselves or others safe), providers should remember that they are not agents of the police, and that they owe separate duties to their patients. Unless the disclosure or access is allowed as set forth above, providers should not disclose protected health information to the police and must carefully consider the situation before allowing police access to patients. If the police officer demands access anyway, the provider should not lie or physically interfere, but should assert appropriate objections and document the circumstances. The best course in avoiding such situations is to educate and work with police and other law enforcement officials in advance so all parties know and can agree on the limits and appropriate protocols for handling such situations.

For questions regarding this update, please contact:
Kim C. Stanger
Holland & Hart, 800 W Main Street, Suite 1750, Boise, ID 83702
email: kcstanger@hollandhart.com, phone: 208-383-3913

This news update is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This news update is not intended to create an attorney-client relationship between you and Holland & Hart LLP. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.