|
Balancing "Competing and Legitimate Interests":
HIPAA and Law Enforcement
by Connie Crawford, El Paso County Hospital District Legal Unit, El Paso, TX
The permissive nature of responses by covered entities to law enforcement requests for disclosure of protected health information ("PHI"), and the responsibility of entities to exercise professional judgment can be misinterpreted by law enforcement officials. This article will provide a brief recap of that responsibility, examples of misunderstanding and some resources that may facilitate cooperation. The laundry list of circumstances in which protected health information may be disclosed to law enforcement without consent, authorization or opportunity to agree or object is familiar to health law attorneys. The HIPAA regulations, however, specifically require the exercise of professional judgment in disclosing directory information and crime victims’ information. The exercise of that discretion may result in conflicts between the “competing and legitimate interests” of patient privacy and law enforcement.
In the event of incapacity or emergency treatment, disclosure of directory information to law enforcement (or to any other person) is contingent upon a determination by the health care provider, in the exercise of professional judgment, that the disclosure is in “the individual’s best interest.” That determination requires balancing the patient’s privacy rights with law enforcement interests. Administrators and legal counsel should work with physicians and others to provide guidelines for making that decision.
Patients who are or are suspected to be victims of crime may consent to the disclosure of information to law enforcement. However, if emergent circumstances or the patient’s incapacity preclude consent, the provision of PHI to law enforcement must meet a three-prong test: (1) the necessity of obtaining the information to determine if a law has been violated by a person other than the patient/victim and the requestor’s intent is not to use the information against the patient/victim; (2) the information is necessary for immediate law enforcement activity and waiting for consent would be materially and adversely affect such activity; and (3) disclosure of the requested information is “in the best interests of the individual as determined . . .in the exercise of professional
judgment.” As with directory information, there should be a documented process for making that determination and communicating the decision to law enforcement.
The exercise of professional judgment in these contexts can produce contentious situations. An informal survey identified
areas where law enforcement officials often question health care professionals: (1) demands for records, specimens, etc. without legal process; (2) requests to be notified of date and time of discharge in order to serve legal process; (3) child abuse investigations; and (4) requests to photograph patients. Some arrests in this milieu have been reported, including a physician who was arrested for refusing to draw
blood and
a nurse who disagreed with law enforcement regarding service of a restraining
order. There
are also anecdotal reports of health care providers and their attorneys being threatened with arrest on obstruction of justice or similar
charges.
Disagreement in the first situation may generally be resolved by reference to state-specific requirements. In all of the situations identified, however, non-clinical employees as well as physicians and other health care providers must be able to refer to written policies, receive adequate training and have authority to refer difficult situations to administration or legal counsel. Administration and legal counsel must also communicate that individuals are not expected to place themselves in harm’s way. However, having the best-written policies, which take state preemption issues into account, does not always prevent disagreement with law enforcement.
Cooperation, rather than confrontation, among health care providers, health law attorneys and law enforcement agencies can minimize such disagreements. Understanding law enforcement hierarchies and developing lines of communication with law enforcement agencies is essential. A conflict between a patrol officer and an emergency department employee can often be resolved with a phone call to the officer’s supervisor. A medical records employee faced with an investigator’s demand for records may be defused by a discussion between hospital counsel and the local prosecutor.
Preventing such confrontations is a role that should be undertaken by legal counsel. While this can be accomplished on an institution-by-institution basis, health law attorneys and law enforcement officials in some jurisdictions have worked together at a state level to publish information to be used by both law enforcement and healthcare providers. Examples include: a law enforcement grid, to be published by the HIPAA Coalition of
Wisconsin, “Hospital
and Law Enforcement – Guide to Disclosure of Protected Health Information” published by the Washington State Hospital Association, and “HIPAA and Law Enforcement” available from the Arizona Hospital and Healthcare Association; and a discussion of related issues on the website of the Federal Office for Civil Rights.
These and other resources can assist health law attorneys in the balancing act required by HIPAA in dealing with law enforcement.
65 Fed. Reg. 82,678 (Dec. 28, 2000).
45 C.F.R § 164.512(f)(1)-(6) (2003).
45 C.F.R. § 164.510(a)(3)(B) (2003).
45 C.F.R. § 164.512(f)(3)(iii)(A)-(C) (2003).
Query posted to in-house counsel list serve of the American Health Lawyers Association (January 12, 2005).
www.startribune.com/stories/462/4933399
www.gmtoday.com (March 22, 2004).
Id. at 5, responses and interview with Christina Ford, Assistant County Attorney, El Paso County Hospital District (January 12, 2005).
www.HIPAACOW.org, (forthcoming 2005).
www.wsha.org.
2003 Coopersmith Gordon Schermer Owns & Nelson PLC; available at www.azhha.org.
www.hhs.gov/ocr/hipaa/
|
Feb
2005 Volume 1 Number 6