Question: Our physician reported to a government agency that her patient's use of pain medication should not deter him from operating vehicles. However, she has since learned that the patient is doctor shopping. Will she violate HIPAA if she reports her discovery to the agency? Answer: Your first step is to find out if "there is a state statute that mandates the reporting," says David Ermer, an attorney with Gordon & Barnett in Washington, DC. The Bottom Line: "You're much better off if there's a state-mandated rule," but this type of disclosure is allowable because the patient and those around him could be in danger, Ermer explains. After you've reviewed state law, use the HIPAA regulation as "the basis for making the disclosure," he suggests. Don't forget: This disclosure must be accounted for, he reminds.