Hospital Disclosure of Protected Health Information to Law Enforcement: Managing the Challenges

1. Hospital Disclosure of Protected Health Information to Law Enforcement: Managing the Challenges

2. Presenters Taya Briley Director, Legal Affairs and Clinical Policy WSHA Barbara Shickich Principal, Riddell Williams, P.S. WSHA General Counsel

3. Background • HIPAA privacy regulation effective April 2003 • Hospital and hospital association preparation • Preemption analysis • Toolkits • Media guide • Law enforcement problems not anticipated

4. A Local and National Problem • HIPAA-state law interaction results in less information for law enforcement • Washington state hospitals and hospitals nationally report problems • Moderate amount of media attention • WSHA approached for solution • Care Facility-Law Enforcement Work Group in King County

5. Challenging Scenarios • Long-term working practices and working relationships disrupted • Threatened arrest of nursing staff for obstruction of justice • Hospital questions about when law enforcement may be called • Confusion about HIPAA-state law interaction • HIPAA penalties

6. WSHA-Law Enforcement Work Group • Convened in August of 2003 • Statewide hospital and law enforcement participation • Hospitals’ Goal: To develop a hospital guide for disclosure of information to law enforcement • Finished September 2004, mailed to hospitals November 2004 • Similar guides are being drafted around the country

7. HIPAA-State Law Interaction Regarding Law Enforcement Disclosures • Follow HIPAA, except where state law is more protective of patient–then follow state law • State law permits some disclosures HIPAA does not permit, therefore no disclosure allowed • HIPAA permits some disclosures state law does not permit, therefore no disclosure allowed

8. Each slice represents a statutory scheme protecting the records. Et cetera Rape crisis center Substance abuse HIV and STD Mental health HIPAA Privacy You must find a way through each slice related to the type of record you are seeking in order to get to the record. RCW 70.02 “Swiss Cheese” Model of Confidentiality*

9. Controlling Law • HIPAA regulation: 45 CFR 164.512 • Must look elsewhere in the regulation for definitions and related issues • Washington state law: RCW 70.02.050 • Mental health (ch. 71.05 RCW) • HIV/STD (RCW 70.24.105) • Alcohol/substance abuse (ch. 70.96A)

10. Disclosures to Law Enforcement

11. Disclosure Categories • Patient authorized • “authorization cures all ills” • Without patient authorization • Disclosure must be allowed by BOTH • State law • HIPAA privacy regulation • Note: Washington state law generally allows less disclosure to law enforcement than HIPAA

12. Law Enforcement Official • Means an officer or employee of any agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to: • (1) Investigate or conduct an official inquiry into a potential violation of law; or • (2) Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

13. Directory Information • Disclose to persons who ask for the individual by name: • The individual’s name; • The individual’s location in the covered health care provider’s facility; • The individual’s condition described in general terms that does not communicate specific medical information about the individual

14. Directory Information (cont.) • Opportunity to object • Emergency circumstances • Other legal limitations

15. Disclosures Without Patient Consent

16. Minimizing an Imminent Danger • PHI may be released to law enforcement to reasonably avoid or minimize an imminent danger to the health or safety of a patient or other individual • Includes threats to hospital employees

17. Determining Imminent Danger • Imminent danger • Motive, means, and opportunity • Good faith belief • “credible representation by a person with apparent knowledge or authority” • Made to a person who is reasonably able to prevent or lessen the threat

18. Example • An ER patient describes to a nurse how he sustained an injury. In telling his story he reveals he was in a fight in an alley nearby and that the other person in the fight was not moving when the patient left the scene. • What can the hospital do?

19. Suspect, Fugitive, Material Witness, or Missing Person • HIPAA allows limited disclosure to respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness or missing person • Washington State has no similar provision, except with respect to Involuntary Treatment patients

20. Suspect, Fugitive, Material Witness, or Missing Person (cont.) • As a result of state law restrictions, disclosure may only be made under another exception • Imminent danger • Directory information • Case initially reported by authorities

21. Violent Crime or Escape • Apprehension of an individual who has allegedly committed a violent crime or escaped from a correctional institution • Limit disclosure to circumstances to • Imminent danger • Directory information • Case initially reported by authorities • PLUS minimum necessary information provided in the HIPAA list

22. Limited Information HIPAA limits information for suspects, fugitives, material witnesses, missing persons and violent crime or escape to: • Name and address • Date and place of birth • Social security number • ABO blood type and rh factor • Type of injury • Date and time of treatment • Date and time of death, if applicable, and • Description of distinguishing physical characteristics

23. Example • During the course of treatment a patient states that she was involved in a shooting. • Can the treatment provider contact law enforcement?

24. Providing Health Care in a Medical Emergency • Disclosure may be made only if it appears necessary to alert law enforcement to: • commission and nature of the crime • location of such crime or the victims • identity, description and location of the perpetrator AND • is necessary to avoid imminent danger • Minimum necessary information among the list may be disclosed

25. Example • An emergency physician treating a knife wound learns that the patient was likely the perpetrator of a stabbing and that victims of the stabbing may still be at the location of the crime. • Can the physician contact law enforcement?

26. Cases Reported by Authorities • Hospitals may provide certain information in response to cases reported by fire, police, sheriff or other public authority • Disclosure is appropriate in situations where the authorities were involved in arranging the care

27. Cases Reported by Authorities (cont.) • Where a case is reported by authorities, hospitals may disclose • Name • Address • Age • Gender • Type of injury • Other exceptions must be met if additional information is released

28. Example • Police respond to a car accident. Aid units also respond. The police direct the aid units to take injured individuals to the hospital. • Police investigating subsequently contact the hospital for information regarding individuals brought to the hospital by the aid unit. • What can the hospital disclose to police?

29. Notification of Release of a Patient • Permitted for patients under arrest who are brought for ITA evaluation (RCW 71.05.190) • No Specific Provision for non-custodial patients, but consider whether another category applies: • Authorization? • Imminent danger? • Facility directory? • Cases “reported by” police?

30. Example • Police officers pick up a suspect at the scene of a crime. The suspect has a broken arm and they drop the suspect off for treatment and then leave telling the hospital to call when the suspect/patient is ready to be discharged. • How should the hospital respond to the request?

31. Court Ordered Requests • May disclose without prior authorization if the information is requested pursuant to: • court order • court-ordered warrant • subpoena or summons issued by judicial officer • grand jury subpoena • administrative request • Only information expressly authorized may be disclosed • Special rules for drug and alcohol treatment

32. Court Ordered Requests (cont.) • Administrative order requirements • Bottom line: Promptly disclose when the requesting document has been issued by a court or is accompanied by a court order, but consider special circumstances

33. Requests Not Ordered by a Court • PHI disclosed only when requirements of RCW 70.02.060 are met • Notice requirements for health care provider and patient • Opportunity to seek a protective order

34. Process and Patient Requested Accounting of Disclosures • Patients have a right to an accounting of disclosures • Accounting must be suspended in some cases • Written statement that suspension is necessary for law enforcement and length of time for suspension • Federal grand jury or special inquiry judge procedures • Oral requests

35. Serving a Patient With Process • Disclosure of patient’s location is disclosure of PHI and subject to these guidelines • Consult with counsel if it is unclear how to respond to court order, warrant or subpoena or other process

36. Example • A person arrives at the hospital information desk with a subpoena. The person says the hospital must provide the information requested in the subpoena right away. • How should the hospital respond?

37. Crime Victims • State law does not expressly allow disclosures regarding crime victims • Disclosure must fit in an existing exception • Authorization • Imminent danger • Directory information • Report initially made by authorities • Child/vulnerable adult abuse suspect

38. Example • A 45 year-old woman is being treated for bruising and contusions. The woman says she fell down the stairs, but the health care provider suspects she may be experiencing physical abuse at home. The woman plans to return home after treatment. • What can the hospital do?

39. Crimes on Hospital Property • Crime may be reported • PHI regarding the patient-suspect may not be reported • Disclosure can be made on the basis of another exception • Disclosure can be made by a third party

40. Example • A hospital employee discovers evidence that a patient is committing identity theft • What can the hospital do?

41. Patient’s Physical Items as Evidence • Evaluate evidence transfer policies in light of HIPAA and state law • Physical items that are identified with a patient are PHI: tissue, cells, clothing, weapons • They cannot be disclosed without patient authorization unless another exception is met

42. Evidence Continued • Items removed or identified while the patient is under the physical control of a police officer may be taken by the police officer as evidence • Hospitals should consider limiting the chain of custody

43. Example • Police arrive with a patient suspected of a shooting. They physically remain with the suspect while the suspect is being treated. The police want the suspect’s sweatshirt as evidence. • Can the hospital give the sweatshirt to law enforcement? • What if the item in question is a bullet that was removed from the suspect during surgery?

44. Disclosures of Minors’ PHI • Minor is a person under age 18 • Emancipated minors treated as adults • Parents authorize disclosure for un-emancipated minors except • Mature minor • Marriage to a person 18 or over • Certain medical treatments

45. Mental Health Treatment and Minors • Certain information regarding a minor’s treatment in a mental health facility may be disclosed to law enforcement or public health as necessary for the responsibilities of their offices • Minimum information must be disclosed • Disclosure may be made only on escape or disappearance, violation of conditions of a court treatment order or failure to return from leave

46. Abuse or Neglect • Nothing in HIPAA or Washington state law interferes with the ability of health care providers to comply with statutes that require a provider to report abuse or neglect of a child or vulnerable adult

47. Children • Applies to health care workers, law enforcement personnel and other mandated reporters • Must report within 48 hours on reasonable cause to believe a child has suffered abuse or neglect

48. Definition of Vulnerable Adult • 60 years or older and cannot care for him or herself • Adult living in a long-term care facility • Adult of any age living with a developmental disability • Adult with a legal guardian • Adult receiving home health care or other services in his or her own family’s home

49. Vulnerable Adults • Health care workers, law enforcement personnel and other mandated reports must immediately report when there is reasonable cause to believe a vulnerable adult has been subject to • Abandonment • Abuse • Financial exploitation • Neglect

50. Vulnerable Adults (cont.) • Report to: • For long term care, Complaint Resolution Unit • For all others, Department of Social and Health Services • On suspicion of sexual or physical assault, ALSO report to local law enforcement