The Privacy Rule is balanced to protect an individual’s privacy while allowing important law enforcement functions to continue. The Rule permits covered entities to disclose protected health information (PHI) to law enforcement officials, without the individual’s written authorization, under specific circumstances summarized below. For a complete understanding of the conditions and requirements for these disclosures, please review the exact regulatory text at the citations provided. Disclosures for law enforcement purposes are permitted as follows:
•To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena (45 CFR 164.512(f)(1)(ii)(A)-(B)).
•To respond to an administrative request, such as an administrative subpoena or investigative demand or other written request from a law enforcement official. All administrative requests must include or be accompanied by a written statement that the information requested is relevant and material, specific and limited in scope, and that de-identified information cannot be used (45 CFR 164.512(f)(1)(ii)(C)).
•To respond to a request for PHI for purposes of identifying or locating a
suspect, fugitive, material witness, or missing person. However, the covered
entity must limit disclosures of PHI to name and address, date and place of
birth, social security number, ABO blood type and rh factor, type of injury,
date and time of treatment, date and time of death, and a description of
distinguishing physical characteristics. Other information related to the
individual’s DNA, dental records, body fluid or tissue typing, samples, or
analysis cannot be disclosed under this provision but may be disclosed in
response to a court order, warrant, or written administrative request (45 CFR
164.512(f)(2)).
This same limited information may be reported to law
enforcement:
•About a suspected perpetrator of a crime when the report is made by the victim who is a member of the covered entity’s workforce (45 CFR 164.502(j)(2));
•To identify or apprehend an individual who has admitted participation in a violent crime (45 CFR 164.512(j)(1)(ii)(A), (j)(2)-(3)).
•To respond to a request for PHI about a victim of a crime, and the victim
agrees (45 CFR 164.512(f)(3)).
Where child abuse victims or adult victims
of abuse, neglect, or domestic violence are concerned, other provisions of the
Privacy Rule apply:
•Child abuse or neglect may be reported to any law enforcement official authorized by law to receive such reports, and the agreement of the individual is not required (45 CFR 164.512(b)(1)(ii)).
•Adult abuse, neglect, or domestic violence may be reported to a law enforcement official authorized by law to receive such reports (45 CFR 164.512(c)):
•If the individual agrees.
•If expressly authorized by law, and based on the exercise of professional judgment, the report is necessary to prevent serious harm to the individual or others, or in certain other emergency situations (see 45 CFR 164.512(c)(1)(iii)(B)).
Note Notice to the individual of the report may be required (see 45 CFR 164.512(c)(2)).
•To report PHI to law enforcement when required by law to do so (45 CFR 164.512(f)(1)(i)). For example, state laws commonly require physicians to report incidents of gunshot, stab wounds, or other violent injuries, and the Privacy Rule permits disclosures of PHI as necessary to comply with these laws.
•To alert law enforcement to the death of the individual, when there is a suspicion that death resulted from criminal conduct (45 CFR 164.512(f)(4)).
•To provide information about a decedent with medical examiners or coroners to assist them in identifying the decedent, determining the cause of death, or to carry out their other authorized duties (45 CFR 164.512(g)(1)).
•To report PHI that the covered entity in good faith believes to be evidence of a crime that occurred on the covered entity’s premises (45 CFR 164.512(f)(5)).
•When responding to an off-site medical emergency, as necessary to alert law enforcement about criminal activity, specifically, the commission and nature of the crime, the location of the crime or any victims, and the identity, description, and location of the perpetrator of the crime (45 CFR 164.512(f)(6)). This provision does not apply if the covered physician believes that the individual in need of the emergency medical care is the victim of abuse, neglect, or domestic violence. See information above regarding when reporting adult abuse, neglect, or domestic violence to law enforcement is allowed under 45 CFR 164.512(c).
•When consistent with applicable law and ethical standards:
•To a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public (45 CFR 164.512(j)(1)(i)).
•To identify or apprehend an individual who appears to have escaped from lawful custody (45 CFR 164.512(j)(1)(ii)(B)).
•For certain other specialized governmental law enforcement purposes, such as:
•To federal officials authorized to conduct intelligence, counter-intelligence, and other national security activities under the National Security Act (45 CFR 164.512(k)(2)) or to provide protective services to the President and others and conduct related investigations (45 CFR 164.512(k)(3));
•To respond to a request for PHI by a correctional institution or a law enforcement official having lawful custody of an inmate or others:
•If they represent such PHI is needed to provide health care to the individual.
•For the health and safety of the individual, other inmates, officers, or employees of others at a correctional institution or responsible for the transporting or transferring of inmates.
•For the administration and maintenance of the safety, security, and good order of the correctional facility, including law enforcement on the premises of the facility (45 CFR 164.512(k)(5)).
Note Except when required by law, the disclosures to law enforcement summarized above are subject to a minimum necessary determination by the covered entity (45 CFR 164.502(b), 164.514(d)). When reasonable to do so, the covered entity may rely upon the representations of the law enforcement official (as a public officer) as to what information is the minimum necessary for their lawful purpose (45 CFR 164.514(d)(3)(iii)(A)). Moreover, if the law enforcement official making the request for information is not known to the covered entity, the covered entity must verify the identity and authority of such person prior to disclosing the information (45 CFR 164.514(h)).