The HIPAA regulation found at 45 C.F.R. § 164.512 allows for uses and disclosures of protected health information (PHI) that do not require individual consent, authorization, or an opportunity to agree or consent. HIPAA and law enforcement are mentioned frequently in this provision. Individual privacy rights under HIPAA and law enforcement needs to keep the public safe, are both important. 45 C.F.R. § 164.512 attempts to honor both. The provisions of 45 CFR § 164.512 that relevant to HIPAA and law enforcement are discussed below.
HIPAA and Law Enforcement Activities
Under the HIPAA Privacy Rule, a number of law enforcement activities involving law enforcement’s use, receipt, or disclosure of PHI, may be conducted. Covered entities may disclose protected health information to allow law enforcement to conduct those activities, as follows:
Uses and disclosures to avert a serious threat to health or safety:
A covered entity may, consistent with the Privacy Rule, use or disclose PHI if the covered entity believes, in good faith, that the use or disclosure is necessary in either of the following situations:
- To prevent or lessen a serious and imminent threat to the health or safety of a person or of the public, and the disclosure is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat, OR:
- For law enforcement authorities to identify or apprehend an individual in either of the following cases:
- Because of a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes caused serious physical harm to the victim, OR
- Where it appears from all of the circumstances that the individual has escaped from a correctional institution or from lawful custody.
A disclosure to prevent such a serious and imminent threat may contain only the information in 45 § 164.512(j)(1)(ii)(A) (the statement of an individual admitting participation in a violent crime), and (f)(2)(i) (limited information for identification and location purposes; this is discussed below).
Under the law, the covered entity is presumed to have acted in good faith with regard to the sincerity of its belief justifying use or disclosure, so long as:
- The belief is based upon the covered entity’s actual knowledge, or
- In reliance on a credible representation by a person with apparent knowledge or authority.
Identification and Location Purposes:
45 C.F.R. § 164.512 (f)(2)(i) permits a covered entity to disclose PHI (except for disclosures required by law; see below), in response to:
- A law enforcement official’s request for such information, for
- The purpose of identifying and finding a suspect, fugitive, material witness, or missing person.
In response to the request for the identification and location purpose, the covered entity may only disclose the following information:
- Name and address.
- Date and place of birth.
- Social Security number.
- ABO blood type (i.e., A, B, O, AB) and Rh factor.
- Rh stands for Rhesus (Rh) factor. Rhesus factor is an inherited protein found on the surface of red blood cells. If an individual’s blood contains the protein, that person is “Rh positive.” Individuals whose blood lacks the protein are “Rh negative.”
- Type of injury.
- Date and time of treatment.
- Date and time of death, if applicable.
- Description of distinguishing physical characteristics, including:
- Height
- Weight
- Gender
- Race
- Hair and eye color
- Presence or absence of facial hair
- Tattoos
The covered entity may not, except as permitted by 45 C.F.R. § 164.512 (f)(2)(i), disclose for the purposes of identification or location, any PHI related to:
- The individual’s DNA or DNA analysis
- Dental records
- Typing, samples, or analysis of bodily fluids or tissue.
Disclosures about victims of abuse, neglect, or domestic violence:
With respect to victims of abuse or of a crime, except for reports of child abuse (which are required by law), a covered entity may disclose PHI about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence. The PHI may be disclosed to a government authority, including a social service or protective services agency that are authorized to receive the disclosure.