The trusted source for
healthcare information and
HIPAA Regulatory Alert: HIPAA affects ability to help law enforcement
Specific HIPAA provisions still must be followed
When two police officers arrived at a hospital emergency department asking to be informed if the facility had treated an elderly woman reported missing by her family, hospital staff contacted their outside legal counsel for advice because of wariness about HIPAA privacy regulations. And it’s good they did.
Nixon, Peabody attorney Claudia Hinrichsen, who is leading the Garden City, NY, firm’s HIPAA practice, says there are specific HIPAA provisions relating to release of information to law enforcement officials that must be followed, no matter how much staff may want to help the police do their job.
In the instance cited above, the woman had been treated at the hospital and specifically informed the hospital staff that she was planning to enter a particular nursing home but that her family was not to be informed of her location.
While the staff were eager to allay the family’s fears and assist the police, they were faced with HIPAA restrictions on the information they could disclose. HIPAA describes the types of information that can be provided to law enforcement officials who are looking for a fugitive, a suspect, a material witness, or a missing person.
Competing restraints in state law
Complicating the issue in this instance was the fact that New York State has its own laws on cooperating with law enforcement, so that there were competing restraints. Generally in the past, it has taken a court order to free a hospital to disclose information.
Hinrichsen says she advised the hospital to indicate that staff were not at liberty to disclose the woman’s location. The most the hospital could have released, she said, was information such as name and address, Social Security number, and date of treatment at the hospital.
"My general guidance to facilities is to have a policy in place about disclosure of protected information to law enforcement officials," Hinrichsen says. "The policy should deal with the specific requirements in Section 164.512(f). It also should consider any more restrictive state laws for the particular state in question."
She tells of a hospital that traditionally notified the local police automatically whenever someone was treated for injuries resulting from a traffic accident. However, it was determined that there is no specific authorization for releasing such information and the hospital was advised to change its practice.
Hinrichsen says that hospital staff members accustomed to cooperating with the police may feel uncomfortable in saying that they cannot give out information any longer, but that still may be the only correct response and the one that should be used. She said they can always offer to pass the issue on to the hospital attorney or to an administrator to handle.
For more information, contact Hinrichsen at (516) 832-7532.