PHI requests from law enforcement present vexing questions for healthcare providers. A new form helps staff document and respond appropriately to such requests.
HIPAA regulations are well known for being somewhat arcane. That is especially so in regard to a healthcare provider’s relationship with law enforcement. When the authorities request information about a patient, the provider often feels unsure how to proceed.
On the one hand, physicians, hospitals, and other providers have a duty to protect their patients’ privacy and to maintain confidentiality of any information obtained during the course of treatment. That is, after all, why the HIPAA regulations refer to such confidential information as protected health information (PHI). On the other hand, there is sometimes a responsibility to work for the common good and cooperate with law enforcement.
To help deal with these situations, Martin Health System (MHS) in Stuart, Fla., has prepared a form that staff can use to document and respond to law enforcement PHI requests. Approved by MHS’ legal and health information departments, the document has been in use for a number of months and has proven quite successful.
Access the form: Law Enforcement Request for Information Records Without Patient Authorization
The MHS form complies with HIPAA regulations, which permit disclosure of PHI without the patient’s consent under some circumstances:
- When required by law
- For public health activities
- To report instances of abuse, neglect, or domestic violence
- For health oversight activities
- For judicial and administrative proceedings
- To medical examiners and funeral directors regarding decedents
- For organ procurement or donation
- For medical research purposes
- For certain specialized government functions
- To avert serious threats to health or safety
- For law enforcement purposes
Establishing Consistent Policies
Most of these permitted HIPAA disclosures can be handled routinely by a hospital’s health information management, legal, or compliance departments. However, law enforcement issues and threats to health or safety can arise at any time, and authorities may need the information outside of “normal business hours.” The requests often come to clinical areas, such as the emergency department, where staff members may not be familiar with the obscure nuances of federal regulations. In addition, state laws must be considered in addition to the federal HIPAA regulations.
“This form really works,” says Linda Hake, MHS senior attorney. “It helps staff think through the issues and get the information they need for documentation purposes, and it makes life easier for both the hospital staff and the law enforcement personnel.”
MHS has promoted the form to local police and sheriff departments, the state department of law enforcement, and the FBI. “They are aware of the form and have even been known to ask for it if the emergency department staff member is unaware,” she says.
Accounting for Nuances
In some situations, law enforcement personnel are entitled to PHI without the individual’s authorization. For example, disclosure of some limited identifying information is permitted when necessary to locate a suspect, fugitive, material witness, or missing person. At other times, such as when the patient is a crime victim, the individual must be given the option to agree to the disclosure. The MHS form addresses these nuances and guides the staff to make a proper decision without consulting the esoteric and complex HIPAA regulations.
An occasional quandary relates to law enforcement requests made over the telephone. The legitimacy of such a request is obviously in question, yet there may be valid justification for it. Hake explains one such case in which a caller wanted information on a deceased patient who had been brought into the ED from another county. “I faxed the form to him, and he completed it and faxed it back. I verified the number and that he was, in fact, with the sheriff’s department, and I got him the information he needed.” She adds that this approach is much easier and quicker than having the officer write a request on official letterhead, which is the typical advice for handling such situations.
Building Rapport with Local Officials and Agencies
MHS modeled its form on one originally developed by Arizona attorney Kristen Rosati for the Arizona Hospital and Healthcare Association. Rosati says that developing this form and an associated FAQ have helped to reduce the tension between Arizona hospitals and law enforcement officials. “The documents were developed in collaboration with Arizona law enforcement, and they take into account HIPAA compliance and the practical needs of law enforcement," she says.
The MHS form also includes reference to the Florida Department of Children and Families, which often needs information for investigation of possible abuse/neglect cases. Facilities that adopt a form like this should include any state agency authorized by law to investigate alleged abuse of vulnerable individuals. Legal counsel should be asked to review for state law principles that may apply, and instructions can be printed on the reverse of the form, if necessary.
J. Stuart Showalter, JD, MFS, is a contributing editor to HFMA’s Legal & Regulatory Forum.
Quoted in this article:
Linda Hake, senior attorney, Martin Health System, Stuart, Fla. (Linda.Hake@martinhealth.org).
Kristen Rosati, partner, Coppersmith Schermer & Brockelman PLC, Phoenix, (firstname.lastname@example.org).
Forum members: Please add your insights, questions, and comments about this article on the Legal & Regulatory Forum’s LinkedIn discussion board.
- What obstacles have you encountered when handling the nuances of sharing protected health information?
- What other awkward requests have you received for protected health information? How have you handled these?
Or perhaps you have another discussion starter?