Responding to Subpoenas and Law Enforcement Demands for PHI: An Overview Janet A. Newberg Chair, Health Law Section Felhaber Larson Fenlon & Vogt, P.A.

HIPAA In A Nutshell 1.Covered entities may use or disclose health information for treatment, payment and health care operations; 2. Covered entities need patient authorization to use or disclose health information for other purposes; 3. Patients can access and request amendments to health information; and 4. Covered entities face civil and criminal penalties for violations

Uses and Disclosures Allowed Without Patient Consent or Authorization Title 45 C.F.R. § A covered entity may use or disclose protected health information without the written consent or authorization of the individual …, or the opportunity for the individual to agree or object … in the situations covered by this section, subject to the applicable requirements of this section

As Required By Law Title 45 C.F.R. § (a) Standard: Uses and disclosures required by law. A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. Example: Gunshot wound in the emergency room

Public Health Activities Title 45 C.F.R. § (b) Standard: uses and disclosures for public health activities. Permitted disclosures. A covered entity may disclose protected health information for the public health activities and purposes described in this paragraph… Example: Vital statistics reports (e.g., births and deaths)

Victims of Abuse, Neglect or Domestic Violence Title 45 C.F.R. § (c) Permitted disclosures. Except for reports of child abuse or neglect permitted by paragraph (b)(1)(ii) of this section, a covered entity may disclose protected health information about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence… BUT – see numerous qualifications on this standard

Health Oversight Activities Title 45 C.F.R. § (d) A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil administrative, or criminal proceedings or actions… Must be related to enforcement efforts involving the health care system, government benefit programs, or civil rights laws

Judicial and Administrative Proceedings Title 45 C.F.R. § (e) A covered entity may disclose protected health information in the course of any judicial or administrative proceeding: – (i) In response to an order of a court or administrative tribunal … or – (ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, BUT ONLY IF…(Pay attention to the next four slides!)

Judicial and Administrative Proceedings: Court Orders A court order means an order issued by a judge or judicial officer A court order DOES NOT mean a simple subpoena A search warrant is signed by a judge and therefore qualifies as a court order

Judicial and Administrative Proceedings: Subpoenas and Discovery Requests May disclose if: – Satisfactory assurance that requester engaged in reasonable efforts to notify patient; or – Satisfactory assurance that requester engaged in reasonable efforts to obtain protective order

Judicial and Administrative Proceedings: Subpoenas and Discovery Requests Satisfactory assurance that requester tried to notify patient means: – Written statement and accompanying documentation that: Attempted to give or mail notice to patient Notice included information about litigation or proceeding Time to object has expired Patient didnt object or all objections resolved by court

Judicial and Administrative Proceedings: Subpoenas and Discovery Requests Satisfactory assurance that requester engaged in reasonable efforts to obtain protective order means: – Written statement and accompanying documentation that Requester and patient agreed to terms of protective order, or Requester has sought protective order from the court

Disclosures for Law Enforcement Purposes Title 45 C.F.R. § (f) A covered entity may disclose protected health information for a law enforcement purpose to a law enforcement official if the conditions in paragraphs (f)(1) through (f)(6) of this section are met, as applicable.

Law Enforcement Purposes: Pursuant to Process and Required by Law Title 45 C.F.R. § (f)(1) Laws requiring reporting of certain types of wounds and injuries Court orders, search warrants, subpoenas or summons issued by judicial officer Administrative requests, subpoenas, summons, and AIDs, but only if requests are relevant, material, limited, and deidentified information could not be used

Law Enforcement Purposes: Identification and Location Title 45 C.F.R. § (f)(2) Law enforcement requests for information to locate a suspect, fugitive, material witness, or missing person May only disclose name and address, date and place of birth, social security number, ABO blood type and Rh factor, type of injury, date and time of treatment, date and time of death, if applicable, and a description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.

Law Enforcement Purposes: Crime Victims Title 45 C.F.R. § (f)(3) May disclose information to a law enforcement official if: – Patient agrees, or – Patient unable to consent due to incapacitation or emergency and: Police need information to determine if someone other than patient committed a crime Immediate need for law enforcement action Disclosure is in best interest of the patient

Law Enforcement Purposes: Decedents Title 45 C.F.R. § (f)(4) A covered entity may disclose protected health information about an individual who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the individual if the covered entity has a suspicion that such death may have resulted from criminal conduct

Law Enforcement Purposes: Crime on Premises Title 45 C.F.R. § (f)(5) A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity Example: Patient charges services on a stolen credit card

Law Enforcement Purposes: Reporting Crime in Emergencies Title 45 C.F.R. § (f)(6) A covered health care provider providing emergency health care in response to a medical emergency, other than such emergency on the premises of the covered health care provider, may disclose protected health information to a law enforcement official if such disclosure appears necessary to alert law enforcement to the commission and nature of a crime, the location of such crime or of the victim(s) of such crime and the identity, description, and location of the perpetrator of such crime

A Final Note: Watch Those State Laws! Title 45 C.F.R. § A standard, requirement or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law … except … if … the provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement or implementation specification adopted under (HIPAA)…