Health Information Compliance Alert

Don't use HIPAA to hinder the police investigation.

Scenario: A law enforcement agent asks you for a patient's health information. You should respond by telling her that the requested information is protected by HIPAA, right? Not necessarily, experts warn.

"You have to walk the tightrope between the government's need for PHI and your obligations under HIPAA to protect it," says Bill Mandell, head of the health law practice at Boston-based Pierce & Mandell.

Strategy: Develop a policy about disclosing PHI to law enforcement, explains attorney Mark Schreiber, chair of the Privacy Group at Palmer & Dodge in Boston. You need to decide what your staff "will do and can do voluntarily and under what circumstances," he maintains.

This type of policy doesn't have to be a headache, Schreiber says. Best practice: Call a meeting with your local law enforcement agency to create a disclosure policy and procedure for both police officers and your staff. That will help officers know how to ask for confidential information and your employees know how to respond to their requests, he suggests.

You never want to hand out PHI without first verifying that the request -- and the requester -- is legitimate, Mandell reminds. Tip: Ask for the request in writing, he suggests. That will give you time both to check that you should be making the disclosure and, if you've verified the request, to prepare the information for the proper authorities.

If the investigator needs the information immediately, ask for a name and number at which you can verify the official, Mandell suggests. Remember: Nine times out of 10 the request is not imminent. Rather, police officers are usually developing a body of evidence against a patient, or if officers buck against your demand for a request in writing, have them prove the urgency of their demand.

If the request did come in writing, make sure you run it by your attorney before you grant access, Mandell advises. That includes requests in the form of a subpoena, investigative demand, warrant or any other legal process document, he says.

Remember: Your disclosures to law enforcement must follow the minimum necessary rules, reminds William Hubbartt, consultant at Hubbartt & Associates in St. Charles, IL.

If a law enforcement agent presents you with a request for disclosure in accordance with the National Security Act, a presidential order or for any other intelligence purpose, you should immediately contact your legal counsel, experts advise.

These requests are so complex, only a legal expert will have a sensible answer as to what should be disclosed, under what authority and what record should be made of the disclosure, Schreiber clarifies. If your counsel gives the request a nod as a legitimate gathering of intelligence, you must still balance your obligations under HIPAA with your state's mandates, Mandell cautions. You  may need to negotiate a more limited scope of disclosure or file a motion to protect the information, he says. Lesson Learned "Law enforcement officials encounter lots of dilemmas because medical workers won't give information to them,"

Schreiber says. Tip: If there is an accident, police must know who was involved and what the injuries are. "If they couldn't determine whether an accident victim died, they wouldn't know whether to charge an individual with homicide," Schreiber explains.

Yet, no matter how seemingly urgent an officer's need for PHI, "you are at the forefront of the effort to protect your patient's private health information," Mandell stresses. You must think through the request and make the best decision for all involved, he notes.