Hospital disclosure of protected health information to law enforcement managing the challenges
1 / 58

- PowerPoint PPT Presentation

  • Uploaded on

Hospital Disclosure of Protected Health Information to Law Enforcement: Managing the Challenges. Presenters. Taya Briley Director, Legal Affairs and Clinical Policy WSHA. Barbara Shickich Principal, Riddell Williams, P.S. WSHA General Counsel. Background.

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about '' - dolf

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Presenters l.jpg
Presenters Enforcement:

Taya Briley

Director, Legal Affairs and Clinical Policy


Barbara Shickich

Principal, Riddell Williams, P.S.

WSHA General Counsel

Background l.jpg
Background Enforcement:

  • HIPAA privacy regulation effective April 2003

  • Hospital and hospital association preparation

    • Preemption analysis

    • Toolkits

    • Media guide

  • Law enforcement problems not anticipated

A local and national problem l.jpg
A Local and National Problem Enforcement:

  • HIPAA-state law interaction results in less information for law enforcement

  • Washington state hospitals and hospitals nationally report problems

  • Moderate amount of media attention

  • WSHA approached for solution

  • Care Facility-Law Enforcement Work Group in King County

Challenging scenarios l.jpg
Challenging Scenarios Enforcement:

  • Long-term working practices and working relationships disrupted

  • Threatened arrest of nursing staff for obstruction of justice

  • Hospital questions about when law enforcement may be called

  • Confusion about HIPAA-state law interaction

  • HIPAA penalties

Wsha law enforcement work group l.jpg
WSHA-Law Enforcement Enforcement: Work Group

  • Convened in August of 2003

  • Statewide hospital and law enforcement participation

  • Hospitals’ Goal: To develop a hospital guide for disclosure of information to law enforcement

  • Finished September 2004, mailed to hospitals November 2004

  • Similar guides are being drafted around the country

Hipaa state law interaction regarding law enforcement disclosures l.jpg
HIPAA-State Law Interaction Enforcement: Regarding Law Enforcement Disclosures

  • Follow HIPAA, except where state law is more protective of patient–then follow state law

    • State law permits some disclosures HIPAA does not permit, therefore no disclosure allowed

    • HIPAA permits some disclosures state law does not permit, therefore no disclosure allowed

Swiss cheese model of confidentiality l.jpg

Each slice represents a statutory scheme protecting the records.

Et cetera

Rape crisis center

Substance abuse


Mental health

HIPAA Privacy

You must find a way through each slice related to the type of record you are seeking in order to get to the record.

RCW 70.02

“Swiss Cheese” Model of Confidentiality*

Controlling law l.jpg
Controlling Law records.

  • HIPAA regulation: 45 CFR 164.512

    • Must look elsewhere in the regulation for definitions and related issues

  • Washington state law: RCW 70.02.050

    • Mental health (ch. 71.05 RCW)

    • HIV/STD (RCW 70.24.105)

    • Alcohol/substance abuse (ch. 70.96A)

Disclosure categories l.jpg
Disclosure Categories records.

  • Patient authorized

    • “authorization cures all ills”

  • Without patient authorization

    • Disclosure must be allowed by BOTH

      • State law

      • HIPAA privacy regulation

  • Note: Washington state law generally allows less disclosure to law enforcement than HIPAA

Law enforcement official l.jpg
Law Enforcement Official records.

  • Means an officer or employee of any agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to:

    • (1) Investigate or conduct an official inquiry into a potential violation of law; or

    • (2) Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

Directory information l.jpg
Directory Information records.

  • Disclose to persons who ask for the individual by name:

    • The individual’s name;

    • The individual’s location in the covered health care provider’s facility;

    • The individual’s condition described in general terms that does not communicate specific medical information about the individual

Directory information cont l.jpg
Directory Information (cont.) records.

  • Opportunity to object

  • Emergency circumstances

  • Other legal limitations

Disclosures without patient consent l.jpg

Disclosures Without records.Patient Consent

Minimizing an imminent danger l.jpg
Minimizing an Imminent Danger records.

  • PHI may be released to law enforcement to reasonably avoid or minimize an imminent danger to the health or safety of a patient or other individual

  • Includes threats to hospital employees

Determining imminent danger l.jpg
Determining Imminent Danger records.

  • Imminent danger

    • Motive, means, and opportunity

  • Good faith belief

    • “credible representation by a person with apparent knowledge or authority”

  • Made to a person who is reasonably able to prevent or lessen the threat

Example l.jpg
Example records.

  • An ER patient describes to a nurse how he sustained an injury. In telling his story he reveals he was in a fight in an alley nearby and that the other person in the fight was not moving when the patient left the scene.

  • What can the hospital do?

Suspect fugitive material witness or missing person l.jpg
Suspect, Fugitive, Material Witness, records.or Missing Person

  • HIPAA allows limited disclosure to respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness or missing person

  • Washington State has no similar provision, except with respect to Involuntary Treatment patients

Suspect fugitive material witness or missing person cont l.jpg
Suspect, Fugitive, Material Witness, records.or Missing Person (cont.)

  • As a result of state law restrictions, disclosure may only be made under another exception

    • Imminent danger

    • Directory information

    • Case initially reported by authorities

Violent crime or escape l.jpg
Violent Crime or Escape records.

  • Apprehension of an individual who has allegedly committed a violent crime or escaped from a correctional institution

  • Limit disclosure to circumstances to

    • Imminent danger

    • Directory information

    • Case initially reported by authorities

  • PLUS minimum necessary information provided in the HIPAA list

Limited information l.jpg
Limited Information records.

HIPAA limits information for suspects, fugitives, material witnesses, missing persons and violent crime or escape to:

  • Name and address

  • Date and place of birth

  • Social security number

  • ABO blood type and rh factor

  • Type of injury

  • Date and time of treatment

  • Date and time of death, if applicable, and

  • Description of distinguishing physical characteristics

Example23 l.jpg
Example records.

  • During the course of treatment a patient states that she was involved in a shooting.

  • Can the treatment provider contact law enforcement?

Providing health care in a medical emergency l.jpg
Providing Health Care in a Medical Emergency records.

  • Disclosure may be made only if it appears necessary to alert law enforcement to:

    • commission and nature of the crime

    • location of such crime or the victims

    • identity, description and location of the perpetrator AND

    • is necessary to avoid imminent danger

  • Minimum necessary information among the list may be disclosed

Example25 l.jpg
Example records.

  • An emergency physician treating a knife wound learns that the patient was likely the perpetrator of a stabbing and that victims of the stabbing may still be at the location of the crime.

  • Can the physician contact law enforcement?

Cases reported by authorities l.jpg
Cases Reported by Authorities records.

  • Hospitals may provide certain information in response to cases reported by fire, police, sheriff or other public authority

  • Disclosure is appropriate in situations where the authorities were involved in arranging the care

Cases reported by authorities cont l.jpg
Cases Reported by Authorities (cont.) records.

  • Where a case is reported by authorities, hospitals may disclose

    • Name

    • Address

    • Age

    • Gender

    • Type of injury

  • Other exceptions must be met if additional information is released

Example28 l.jpg
Example records.

  • Police respond to a car accident. Aid units also respond. The police direct the aid units to take injured individuals to the hospital.

  • Police investigating subsequently contact the hospital for information regarding individuals brought to the hospital by the aid unit.

  • What can the hospital disclose to police?

Notification of release of a patient l.jpg
Notification of Release of a Patient records.

  • Permitted for patients under arrest who are brought for ITA evaluation (RCW 71.05.190)

  • No Specific Provision for non-custodial patients, but consider whether another category applies:

    • Authorization?

    • Imminent danger?

    • Facility directory?

    • Cases “reported by” police?

Example30 l.jpg
Example records.

  • Police officers pick up a suspect at the scene of a crime. The suspect has a broken arm and they drop the suspect off for treatment and then leave telling the hospital to call when the suspect/patient is ready to be discharged.

  • How should the hospital respond to the request?

Court ordered requests l.jpg
Court Ordered Requests records.

  • May disclose without prior authorization if the information is requested pursuant to:

    • court order

    • court-ordered warrant

    • subpoena or summons issued by judicial officer

    • grand jury subpoena

    • administrative request

  • Only information expressly authorized may be disclosed

  • Special rules for drug and alcohol treatment

Court ordered requests cont l.jpg
Court Ordered Requests (cont.) records.

  • Administrative order requirements

  • Bottom line: Promptly disclose when the requesting document has been issued by a court or is accompanied by a court order, but consider special circumstances

Requests not ordered by a court l.jpg
Requests Not Ordered a Court

  • PHI disclosed only when requirements of RCW 70.02.060 are met

  • Notice requirements for health care provider and patient

  • Opportunity to seek a protective order

Process and patient requested accounting of disclosures l.jpg
Process and Patient Requested Accounting of Disclosures records.

  • Patients have a right to an accounting of disclosures

  • Accounting must be suspended in some cases

    • Written statement that suspension is necessary for law enforcement and length of time for suspension

    • Federal grand jury or special inquiry judge procedures

    • Oral requests

Serving a patient with process l.jpg
Serving a Patient With Process records.

  • Disclosure of patient’s location is disclosure of PHI and subject to these guidelines

  • Consult with counsel if it is unclear how to respond to court order, warrant or subpoena or other process

Example36 l.jpg
Example records.

  • A person arrives at the hospital information desk with a subpoena. The person says the hospital must provide the information requested in the subpoena right away.

  • How should the hospital respond?

Crime victims l.jpg
Crime Victims records.

  • State law does not expressly allow disclosures regarding crime victims

  • Disclosure must fit in an existing exception

    • Authorization

    • Imminent danger

    • Directory information

    • Report initially made by authorities

    • Child/vulnerable adult abuse suspect

Example38 l.jpg
Example records.

  • A 45 year-old woman is being treated for bruising and contusions. The woman says she fell down the stairs, but the health care provider suspects she may be experiencing physical abuse at home. The woman plans to return home after treatment.

  • What can the hospital do?

Crimes on hospital property l.jpg
Crimes on Hospital Property records.

  • Crime may be reported

  • PHI regarding the patient-suspect may not be reported

  • Disclosure can be made on the basis of another exception

  • Disclosure can be made by a third party

Example40 l.jpg
Example records.

  • A hospital employee discovers evidence that a patient is committing identity theft

  • What can the hospital do?

Patient s physical items as evidence l.jpg
Patient’s Physical Items as Evidence records.

  • Evaluate evidence transfer policies in light of HIPAA and state law

  • Physical items that are identified with a patient are PHI: tissue, cells, clothing, weapons

  • They cannot be disclosed without patient authorization unless another exception is met

Evidence continued l.jpg
Evidence Continued records.

  • Items removed or identified while the patient is under the physical control of a police officer may be taken by the police officer as evidence

  • Hospitals should consider limiting the chain of custody

Example43 l.jpg
Example records.

  • Police arrive with a patient suspected of a shooting. They physically remain with the suspect while the suspect is being treated. The police want the suspect’s sweatshirt as evidence.

  • Can the hospital give the sweatshirt to law enforcement?

  • What if the item in question is a bullet that was removed from the suspect during surgery?

Disclosures of minors phi l.jpg
Disclosures of Minors’ PHI records.

  • Minor is a person under age 18

  • Emancipated minors treated as adults

  • Parents authorize disclosure for un-emancipated minors except

    • Mature minor

    • Marriage to a person 18 or over

    • Certain medical treatments

Mental health treatment and minors l.jpg
Mental Health Treatment records.and Minors

  • Certain information regarding a minor’s treatment in a mental health facility may be disclosed to law enforcement or public health as necessary for the responsibilities of their offices

  • Minimum information must be disclosed

  • Disclosure may be made only on escape or disappearance, violation of conditions of a court treatment order or failure to return from leave

Abuse or neglect l.jpg
Abuse or Neglect records.

  • Nothing in HIPAA or Washington state law interferes with the ability of health care providers to comply with statutes that require a provider to report abuse or neglect of a child or vulnerable adult

Children l.jpg
Children records.

  • Applies to health care workers, law enforcement personnel and other mandated reporters

  • Must report within 48 hours on reasonable cause to believe a child has suffered abuse or neglect

Definition of vulnerable adult l.jpg
Definition of Vulnerable Adult records.

  • 60 years or older and cannot care for him or herself

  • Adult living in a long-term care facility

  • Adult of any age living with a developmental disability

  • Adult with a legal guardian

  • Adult receiving home health care or other services in his or her own family’s home

Vulnerable adults l.jpg
Vulnerable Adults records.

  • Health care workers, law enforcement personnel and other mandated reports must immediately report when there is reasonable cause to believe a vulnerable adult has been subject to

    • Abandonment

    • Abuse

    • Financial exploitation

    • Neglect

Vulnerable adults cont l.jpg
Vulnerable Adults (cont.) records.

  • Report to:

    • For long term care, Complaint Resolution Unit

    • For all others, Department of Social and Health Services

  • On suspicion of sexual or physical assault, ALSO report to local law enforcement

What s next l.jpg

What’s Next records.

State legislation l.jpg
State Legislation records.

  • Washington Association of Prosecuting Attorneys

  • Senate Bill 6162

  • Legislation would require more disclosures of information to law enforcement than previously permitted or required under state law

2005 legislative session l.jpg
2005 Legislative Session records.

  • Prosecuting attorney’s legislation will probably be re-introduced

  • WSHA plans to request changes to state privacy laws that include allowing hospitals to report a crime on the premises

Hospital and law enforcement guide to disclosure l.jpg
Hospital and Law Enforcement Guide to Disclosure records.

  • Has been sent to law enforcement representatives and hospitals around the state

  • Will be maintained and updated on the WSHA website:

Hospital action l.jpg
Hospital Action records.

  • This is a complicated area of the law

  • Education of hospital staff, especially emergency department staff is important

    • Educate staff about the permitted disclosures outlined in this guide

    • Emphasize that patient authorization “cures all ills”

  • Maintain open communication with law enforcement

Press release l.jpg
Press Release records.

  • WSHA will release Guide to the press

  • Press has been interested in HIPAA in the past

  • Scheduled for Wednesday, December 15

  • You may get calls about your experiences

  • More information: contact Cassie Sauer, 206/216-2538 or [email protected]

Questions comments l.jpg

Questions? records.Comments?

Thank your for participating please complete the evaluation l.jpg

Thank your for participating! records.Please complete the evaluation.