[ Thursday, December 04, 2003 ]
Crime and Punishment, HIPAA-style: You might have heard some talk about the collision between HIPAA and law enforcement. If a provider wants to provide full privacy protection to a patient's information, it won't provide that information to police for the investigation of a crime, unless the patient consents. Of course, it is easy to envision scenarios where the patient is the victim of the crime (and logically would want the police involved), but is unable to provide the consent the provider wants. This Boston Globe
article highlights just that concern.
Of course, there are provisions in the allowed disclosures under HIPAA for law enforcement purposes. 45 CFR 164.512 (b) permits disclosures for public health activities, mainly reporting vital statistics or epidemic disease tracking; 164.512(c) permits disclosures about victims of abuse, neglect or domestic violence; 164.512(f) allows disclosures for law enforcement purposes;164.512(j) permist disclosures to avert a serious threat to health or safety; and 164.512(k) allows disclosures in particular situations, like disclosures involving the Secret Service, the military, and prisons.
In the case in the Globe story, is would seem that (c) or (f) would have been available. For the disclosure to be made under 164.512(c), the hospital would have to believe that the indivudual was a victim of abuse and would be allowed to report to a governmental authority authorized by law to receive reports of abuse, but the disclosure would have to be limited (i) to the extent the
individual agrees, (ii) to the extent specifically
required by law, or (iii) to the extent
allowed and authorized by law,
AND either the hospital reasonably believes, in the exercise of professional judgment, that the disclosure is necessary to prevent serious harm to the victim or other potential victims, or the individual is incapacitated and the cops say the report won't be used against the incapacitated individual and any delay would be harmful. In any event, if a covered entity makes a report under this provision, it must promptly notify the individual that the report has been or will be made, unless it determines using professional judgment that such a notification would be harmful for the individual, or the giving of such notification would actually be given to the individual's representative and that person is the abuser (i.e., to the parent who committed the abuse).
A disclosure under 164.512(f), for law enforcement purposes, could have been possible as well. There are six subsets of disclosured for law enforcement purposes: (i) subpoenas, search warrants and the like; (ii) disclosures limited to information needed to identify or locate a person; (iii) disclosures about a victim of a crime, provided the victim agrees or, if the victim is incapacitated, the cop says the information won't be used against the victim and delay would be harmful; (iv) disclosures about the death of the individual, if it seems like a crime was involved; (v) disclosures of evidence of a crime on the premises; or (vi) disclosures in an emergency situation alerting the cops to the commission of a crime (other than abuse, neglect, or domestic violence, which is covered in 164.512(c) described above), the location of the crime or its victims, and the identity and/or location of the perpetrator.
Jeff [10:53 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
