Practicing In Harmony with HIPAA The views and opinions expressed in the presentation are those of the presenter, and not necessarily official positions of the United States Department of Justice.

Purpose Underscore the commitment of DOJ to facilitate covered entity compliance with HIPAA while pursuing its legitimate governmental functions Discuss the different functions of DOJ with reference to HIPAA disclosures

The Multiple Hats of DOJ Health Oversight Law Enforcement Representing Government Entities –VA Hospital, Rural Health Clinic, Government Employees Prosecuting Criminal Violations of 42 USC 1320d-6 The activity will dictate the applicable HIPAA provision which permits disclosure DOJ is NOT a covered entity

Which HIPAA Exception Permits Disclosure to DOJ? Least restrictive exception applies: Health Oversight (45 CFR § (d)) –(Essentially preserved the pre-HIPAA landscape on disclosures) Law enforcement (45 CFR § (f) Representing a government agency (45 CFR § )

Informing the Covered Entity Informing the covered entity which provision of HIPAA permits the requested disclosure May be written, may be oral

Permitted Disclosures to Law Enforcement Pursuant to Process and Required by law (f)(1) –Court Orders, Warrants, Judicial Subpoenas –Grand Jury Subpoenas –Administrative Request/Demand/Subpoena, provided that Relevant and material to legitimate L.E. inquiry Specific & limited in scope to extent reasonably practicable in light of the purpose De-identified information could not reasonably be used Covered entity can rely on representations on the face of the administrative subpoena ( (h)(2)(A))

Permitted Disclosures to Law Enforcement Other Provisions of § (f) –8 items for Identification and Location of suspects, material witness, missing person –Victims of crime, but unless required by law or process, certain limitations for victims of abuse, neglect or domestic violence –Decedents, if under suspicious circumstances –Crime on premises –Reporting crime in an emergency

One Health Oversight Note Health oversight has been discussed by Anne MacArthur of the OIG Special Note About Administrative Subpoenas used in furtherance of health oversight activity When a health oversight activity, § (d) governs – the limitations in (f)(a) are irrelevant (including restrictions on L.E. administrative subpoenas) – only apply to law enforcement activity

Some Other Special Circumstances Avert serious threat to health or safety – § (j) Specialized government functions - § (k) –National Security and Intelligence –Protective Services for President and others –Correctional institutions and other law enforcement custodial situations

Suspension of Audit Trail Disclosure A covered entity must suspend an individual’s right to an account when an oral or written request is made by a health oversight or law enforcement official for the length of time requested by the official. 45 CFR § (a)(2) Oral request (good for up to 30 days) followed by written request Document the request. “Reasonably likely to impede the agency’s activities”

Preemption of State Privacy Law A HIPAA standard, requirement or implementation specification, preempts a state law concerning the privacy of protected health information, unless the state law: –Is contrary to HIPAA, and –Relates to the privacy of Individually Identifiable Health Information, and –Is more stringent than a provision of the HIPAA medical privacy rules U.S. Constitution supremacy clause

Criminal Violations of HIPAA Privacy Rules HIPAA create a criminal violation for improper disclosure or receipt of protected health information – 42 U.S.C. 1320d-6 DOJ investigates and prosecutes criminal violations of this statute; primarily investigated by FBI 3-levels of escalating penalties keyed to egregiousness of the offense conduct Direct complaints, or referrals from HHS-OCR

Conclusion We are committed to facilitating the disclosure of protected health information for health oversight and law enforcement purposes in compliance with HIPAA We will firmly resist efforts by covered entities to constrict the exceptions which HIPAA permits We will investigate complaints of criminal HIPAA violations and prosecute where appropriate. Ian DeWaal, Senior Counsel Department of Justice, Criminal Division, Fraud Section