Health Information Compliance Alert

Question: Here's a hypothetical situation, but one that happens all too often: A traffic accident sends several people to the hospital. A state trooper arrives at the emergency room and asks for information on the victims brought in, explaining that they are believed to be involved in a hit-and-run. What's the minimum amount of info we can give the trooper and still be in compliance with the privacy rule?

Answer: Take a look at section 164.512 of the final privacy rule; that's where the law enforcement provisions are located. Section 512 (F)(3) pertains to this question and reads, "except for disclosures required by law as permitted by paragraph (F)(1), a covered entity may disclose protected health information in response to a law enforcement official's request for such information about an individual who is or is suspected to be a victim of a crime."

So, if someone was in a hit-and-run accident and a law enforcement officer asked for info about the individual, you may hand over PHI if the individual agrees to a disclosure.

If the individual is incapacitated, then you'd want to speak with someone there who had the legal standing to represent that individual in that context, says Brian Gradle, an attorney with the Washington office of Hogan & Hartson.  "And a lot of that is going to be determined by state law, so wherever the CE is located, it needs to look at state law to see what the law says in terms of incapacitation," he adds. "It could very well be that the incapacitated victim's spouse says that under no circumstances is the entity to provide that information to anyone.