Responding to Law Enforcement Demands for HIPAA Protected Information

Medical providers are often asked, or feel obligated, to disclose confidential information about patients.  This blog post discusses when disclosures of confidential medical information involve law enforcement, but the general principles discussed herein are instructive in any scenario.  To protect patient confidentiality and avoid costly civil liability arising from improper disclosures, it is imperative that providers ask questions to assess the urgency of any request and to understand for what purpose the information is sought by authorities.  Knowing what questions to ask at the outset prepares providers to make informed decisions about disclosing confidential information in a manner that balances the obligation to maintain patient confidentiality and trust with legitimate law enforcement requests for information aimed at protecting the public.

The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) generally prohibits medical providers from disclosing “protected health information” (PHI) to anyone, including even the police, unless certain conditions are satisfied.  PHI is any information related to a past, present or future physical or mental health condition or treatment of an individual that identifies the individual or can be used to identify the individual.

Properly responding to police requests for confidential PHI depends on the individual facts and circumstances of each request.  To keep things in perspective, it’s important to appreciate that health care providers providing emergency health care in response to a medical emergency are always permitted to disclose any PHI to law enforcement if the disclosure appears necessary to:  alert to the commission, nature or location of a crime or victim; or, the identity, description or location of a perpetrator of such crime.  Absent the foregoing exigent circumstances when asked to provide confidential information by anyone, including authorities:

1. Take a breath. This is possibly an important matter or law enforcement wouldn’t have arrived, but it’s probably not something so important that it has to be done in the next two minutes.
2. Ask questions to understand the nature of the request. Consider referring to this chart to help understand the type of request and what information is sought.  Generally, absent an explicit Court Order or Grand Jury subpoena, a party seeking PHI about another person is obliged to provide context and any request for PHI is reviewable by federal, and most state, courts.
3. Contact your organization’s compliance and/or legal counsel and discuss what you’ve learned prior to providing any confidential information.

Understanding the basic framework of when PHI can, and should, be disclosed enables practitioners to be both professionally ethical and morally responsible citizens.

For additional information about this issue, including establishing a government investigations response plan, contact the author of this post, Clay Lee, or the Epstein Becker Green attorney who regularly assists you.