Hipaa guide 2010
1 like343 views
This document provides a guide for hospitals and law enforcement regarding the disclosure of protected health information. It discusses federal and state privacy laws governing when protected health information can be disclosed to law enforcement without patient authorization. The guide addresses common situations that may arise, such as disclosing information to help locate suspects or report child abuse. It also covers responding to subpoenas, access to hospital facilities, and a sample disclosure form.
Hipaa guide 2010
- 2. TABLE OF CONTENTS Page INTRODUCTION ................................................................................................................................... 1 SCOPE AND FOCUS OF THE GUIDE................................................................................................ 1 FREQUENTLY USED TERMS .............................................................................................................. 2 ACCESSING INFORMATION ............................................................................................................. 4 TOPICS COVERED................................................................................................................................. 4 I. Disclosing protected health information..................................................................... 4 II. Patient authorization to access protected health information.................................. 6 III. Patients with specific injuries........................................................................................ 7 IV. Minimizing an imminent danger.................................................................................. 9 V. Identifying or locating a suspect, fugitive, material witness, or missing person............................................................................................................... 12 VI. Follow‐up to patients brought to the hospital by authorities................................. 15 VII. Notification on release of a patient............................................................................. 18 VIII. Request for a patient’s physical items or samples as evidence.............................. 19 IX. Release of mental health, substance abuse treatment, or HIV information .................................................................................................................... 20 X. Responding to a court order, warrant or subpoena................................................. 23 XI. Release of information on crime victims ................................................................... 25 XII. Reporting information regarding crimes on hospital property ............................. 27 XIII. Disclosure of protected health information concerning minors ............................ 27 XIV. Reporting child or vulnerable adult abuse or neglect ............................................. 30 XV. Special considerations for homeland and national security................................... 33 XVI. Law enforcement’s access to hospital facilities......................................................... 35 SAMPLE DISCLOSURE FORM.......................................................................................................... 36 REQUEST FOR MENTAL HEALTH SERVICE INFORMATION FORM.................................... 38 ‐i‐
- 4. health information to state or federal correctional institutions or release of protected health information concerning offenders who are also subject to court ordered treatment. Throughout the Guide, references are made to “protected health information” or PHI. In simple terms, protected health information is the patient information hospitals must protect by law. When the Guide refers to “protected health information,” it generally has the same meaning provided under HIPAA.2 The Guide is separated into sections covering a variety of situations likely to arise for hospitals and law enforcement concerning disclosure of protected health information. It focuses on exceptions under HIPAA and state law that permit disclosure of protected health information to law enforcement without patient authorization. The last section in the Guide is slightly different and addresses law enforcement officer presence in treatment areas of the hospital. At the end of the Guide a model form is provided that authorizes release of PHI for law enforcement officials seeking access to patient records. Frequently Used Terms The following terms are used frequently in this guide and definitions are set out here for easy reference. However, no attempt has been made to define every technical term in the Guide. In general, individual sections of the Guide refer to any definitions necessary to understand the particular section. Directory information: Directory information means the following information maintained regarding individuals in a facility: the individual’s name, location in the facility, and a description of the individual’s condition that does not communicate specific medical information. Where an admitted patient is listed in the facility directory and is asked for by name, a one‐word condition and general location may be released unless the patient has opted out of the directory.3 The disclosure of directory information is made in response to a call or inquiry to the facility. A facility may not affirmatively contact a person to disclose directory information. The Washington State Hospital Association Media Guide to Cooperation recognizes the following conditions and locations that may be provided when a patient is listed in the facility directory and is asked for by name: A. Undetermined: The patient is awaiting a physician and assessment. B. Treated and Released: The patient has been treated by the hospital, and has been released. In this instance, “treated” is the condition and “released” is the location. Generally, this indicates the patient’s condition was satisfactory upon release. C. Stabilized and Transferred: The patient was stabilized at the hospital, and has been transferred to another facility for further care. In this instance, “stabilized” is the 2 See Frequently Used Terms for a description of ‘protected health information.’ 3 45 CFR 164.510, RCW 70.02.050. 2
- 5. condition and “transferred” is the location. Hospitals should not release where the patient was transferred. This classification does not imply a patient condition, but simply that the patient is at another facility. D. Satisfactory: Vital signs (heartbeat, breathing, blood pressure, temperature) are stable and within normal limits. The patient is conscious and comfortable. Indicators are good. E. Serious: Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable. F. Critical: Vital signs are unstable or not within normal limits. The patient may be unconscious. There is some doubt the patient will recover. Death could be imminent. G. Deceased: The death of a patient may be reported to the authorities by the hospital, as required by law. Typically, a report will be made after efforts have been made to notify the next‐of‐kin. The death of a patient may also be reported to the media after the next‐ of‐kin has been notified, as long as the patient’s body is still in the hospital. H. Released: If a patient has been released, and the hospital receives an inquiry about the patient by name, the hospital may confirm that the patient is no longer in the hospital, but cannot give the release date, admission date, length of stay, or any other information. Law enforcement: Under HIPAA and Washington State law, law enforcement officials include an officer or employee of any agency or authority of the United States, a state, a territory, a political subdivision of a state or territory, or an Indian tribe who is empowered by law to: (1) investigate or conduct an official inquiry into a potential violation of law; or (2) prosecute or otherwise conduct a criminal proceeding arising from an alleged violation of law.4 Patient: Under Washington State law and for purposes of this Guide, patient is defined as “an individual who receives or has received health care.” The term includes a deceased individual who has received health care.5 HIPAA does not define the term patient. Protected health information or “PHI”: Individually identifiable health information that is a subset of health information, including demographic information collected from an individual and: (1) is created or received by a health care provider, health plan, employer, or health care clearing house and (2) relates to the past, present, or future physical or mental health condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) that identifies the individual; or (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the 4 45 CFR 164.501 and RCW 70.02.010(3). Note that the HIPAA definition also includes those individuals empowered by law to prosecute or conduct civil and administrative proceedings. 5 RCW 70.02.010(10). 3
- 7. • The officer provides a HIPAA compliant authorization signed by the patient or patient’s representative. See Section II for information on patient authorization to access PHI. See page 36 of this Guide for a model authorization form. • The disclosure to law enforcement is required for patients with specific injuries as described in Section III. • The release of information is necessary to minimize an imminent danger as described in Section IV. • The information is necessary to identify or locate a suspect, fugitive, material witness or missing person and the disclosure will avoid or minimize an imminent danger as described in Section V. • The information is provided as follow up to certain authorities that brought or caused the patient to be brought to the hospital as described in Section VI. • The information relates to the discharge of a patient and law enforcement requested notification of release of the patient and the requirements for the disclosure of the information meet those described in Section VII. • The information relates to a patient’s physical items or samples to be used as evidence as described in Section VIII. • The information relates to the fact of admission for mental health, alcohol or drug abuse treatment, or HIV status and may be released as described in Section IX. • The officer produces a court order, warrant, or subpoena that meets the requirements described in Section X. • The information relates to a victim of a crime and involves minimization of an imminent danger and is released as described in Section XI. • The information relates to a crime that occurred on hospital property and is released as described in Section XII. • The information relates to a minor and is released as described in Section XIII. • The information must be reported under mandatory child or vulnerable adult abuse and neglect reporting statutes described in Section XIV. • The information is released for homeland security or national security purposes as described in Section XV. 5
- 8. The Guide is not exhaustive in its coverage and hospitals may be able to release PHI to law enforcement under other circumstances. However, the Guide does attempt to address the most common situations concerning release of PHI to law enforcement. II. Patient authorization to access protected health information Most of the subjects covered in this Guide pertain to circumstances where law enforcement wants access to PHI and the patient would likely refuse to provide it to law enforcement. However, if a patient completes a valid authorization to disclose the PHI to law enforcement, then the information identified in the authorization must be disclosed. A sample authorization form is provided on page 36 of this Guide. If a patient is incapacitated or otherwise unable to execute an authorization, a personal representative of the patient may execute an authorization allowing disclosure of the patient’s PHI to law enforcement. HIPAA recognizes the state law hierarchy of persons who may consent to care and authorize disclosure of PHI in place of the patient.8 The state law hierarchy, set forth in RCW 7.70.065 for adult patients, is as follows:9 1) The appointed guardian of the patient, if any; 2) The individual, if any, to whom the patient has given a durable power of attorney that encompasses the authority to make health care decisions; 3) The patient’s spouse or state registered domestic partner; 4) Children of the patient who are at least eighteen years of age; 5) Parents of the patient; and 6) Adult brothers and sisters of the patient. It is important to note that no person may consent to health care on behalf of the patient or authorize disclosure of the patient’s PHI: • if a person of higher priority has refused to give such authorization; or • if there are two or more individuals in the same class and the decision is not unanimous among all available members of that class. 8 Under the HIPAA regulation, a person authorized under state or other applicable law to act on behalf of the individual in making health care decisions is the individual’s personal representative and can also authorize disclosure of protected health information. 45 CFR 164.501(g). In addition to exercising the individual’s rights under the HIPAA regulation, a personal representative may also authorize disclosures of the individual’s protected health information. Office of Civil Rights HIPAA Privacy Guidance, December 2, 2002. 9 Note that while RCW 7.70.065 refers to persons who may provide consent to care for medical treatment, the authority to authorize disclosure of protected health information is encompassed within the authority to consent to medical care. See Section XIII regarding the disclosure of protected health information concerning minors. 6
- 9. Also, state law requires that before any person may provide consent to care or authorize disclosure of PHI on behalf of a patient not competent to do so, the person must first determine in good faith that the patient, if competent, would consent to the proposed health care or authorize the disclosure of PHI. If such a determination cannot be made, the decision may be made only after determining that the proposed health care or disclosure of PHI is in the patient’s best interests. If law enforcement officials want access to PHI regarding a law enforcement officer who is being treated at a hospital for an injury not likely suffered as a result of criminal conduct10and want more information than a location and one‐word condition (directory information), the law enforcement officials must have a valid authorization from the patient/officer or his or her personal representative. One way to address this issue is to obtain authorizations in advance from all officers.11 III. Patients with Specific Injuries Under HIPAA, hospitals may disclose PHI for a law enforcement purpose to a law enforcement official if the disclosure is required by law “including laws that require the reporting of certain types of wounds and other physical injuries.”12 Washington State law requires hospitals to disclose certain health care information to law enforcement authorities when the patient is being treated for injuries likely suffered as a result of criminal conduct.13 Disclosure Upon Request: Hospitals are required to disclose certain PHI when federal, state, or local law enforcement authorities make a written or oral request to a nursing supervisor, administrator, or designated privacy official and the request involves a patient who is being treated or has been treated for: • a bullet wound14; • a gunshot wound14 ; • a powder burn; • other injury arising from or caused by the discharge of a firearm; or • an injury caused by a knife, an ice pick, or any other sharp or pointed instrument which the law enforcement authority making the request states is reasonably believed to have been intentionally inflicted. 10 RCW 70.02.050(2)(c). See the specific injuries and the information that may be described in Section III. 11 RCW 70.02.030. Note the authorization must have an expiration date or event. In this case the authorization could expire upon the individual’s termination of employment as a law enforcement officer. 12 45 CFR §164.512(f)(1)(i). 13 RCW 70.02.050(2)(c). 14 Note that if the patient is unconscious and suffering from a bullet wound, gunshot wound, or stab wound the hospital may be required to make a report. For more information see “Make Affirmative Report” on page 9. 7
- 10. • a blunt force injury that the law enforcement authority making the request states is reasonably believed to have resulted from a criminal act Unless an exception applies, a hospital is permitted to disclose information to law enforcement authorities about patients being treated for these injuries only if a request is made. One important exception is for unconscious persons with a bullet wound, gunshot wound, or stab wound. 15 For more information see “Make Affirmative Report” on page 9. Where a request is properly made, the following information must be disclosed, if known, to the federal, state, or local law enforcement authorities making the request16: • name of the patient; • patient’s residence; • patient’s sex; • patient’s age; • patient’s condition; • patient’s diagnosis or extent and location of injuries as determined by a health care provider; • whether the patient was conscious when admitted; • name of the health care provider making the determination with respect to the patient’s condition, diagnosis and extent and location of injuries and whether or not the patient was conscious when admitted; • whether the patient has been transferred to another facility; and • patient’s discharge date and time. Example: A hospital nursing supervisor receives a telephone call from a local police department stating: “I am Detective Smith with the city police department. I would like information regarding any patient who has been admitted with a blunt force injury in the last twenty‐four hours. The police department believes that someone was intentionally hit with a hard object and may seek medical care.” 15 Additional considerations regarding exceptions: WAC 246‐101‐301 requires monthly reporting of gunshot wounds to the Department of Health. Except in the case of an unconscious person with a bullet wound or gunshot wound, there is no statewide requirement to report gunshot wounds to law enforcement authorities without a request. However, additional jurisdictional requirements may exist. Other exceptions that may allow a hospital to report include situations involving minimizing imminent danger, locating a fugitive and reporting child or vulnerable adult abuse or neglect. 16 RCW 70.02.050(2)(c)(i)‐(x). 8
- 11. The hospital nursing supervisor should verify the identity of the officer, and if the person is confirmed to be a police officer, must release the PHI described above for any patient admitted with a blunt force injury. Make Affirmative Report: If an unconscious patient is treated for a bullet wound, gunshot wound or stab wound, hospitals are required to report to a local law enforcement authority as soon as is reasonably possible. 17 The report must include: • name of the patient; • patient’s residence; • patient’s sex; • patient’s age; • whether the patient received a bullet wound, gunshot wound, or stab wound; and • the name of the health care provider providing treatment for the injury. If patients subject to a request for information from law enforcement authorities are treated for or discharged to obtain mental health treatment, other laws may apply. The required disclosure to law enforcement does not supersede the laws that apply to information relating to treatment for mental illness or substance abuse. Such information generally cannot be accessed by law enforcement without the patient’s authorization or a court order.18 For example, the fact of mental health treatment generally cannot be disclosed. However, existing exceptions still apply as well. Requests involving patients receiving mental health or substance abuse treatment must be evaluated based upon all of the facts and circumstances and applicable laws before a disclosure is made. IV. Minimizing an imminent danger In instances where release of PHI may reasonably avoid or minimize an imminent danger to the health or safety of a patient or other individual, a provider may release PHI to law enforcement without a patient’s authorization. State law and the HIPAA privacy regulation must be read together to provide the parameters for disclosure in this instance.19 17 RCW 70.41.440 18 See Section VIII. 19 RCW 70.02.050(1)(d) and 45 CFR 164.512(j)(1). 9
- 15. necessary for law enforcement authorities to identify or apprehend an individual, either because of a statement made by the patient admitting to participating in a violent crime or where it appears the patient has escaped from a correctional institution, a disclosure is allowed.30 However, disclosure is limited to the circumstances and the information listed in items (1) through (4) in the paragraph above. Additionally, if the disclosure is required under item (1) in the paragraph above (patients with specific injuries), then the information disclosed is limited to the following: • name of the patient; • patientʹs residence; • patientʹs sex; • patientʹs age; • patientʹs condition; • patientʹs diagnosis or extent and location of injuries as determined by a health care provider; • whether the patient was conscious when admitted; • the name of the health care provider making those determinations; • whether the patient has been transferred to another facility; and • the patientʹs discharge date and time. If the disclosure is permitted under item (2) in the paragraph above (imminent danger), then the HIPAA Privacy Regulations limit the disclosure to the following minimum necessary information listed below:31 A. Name and address; B. Date and place of birth; C. Social security number; D. ABO blood type and rh factor; E. Type of injury; F. Date and time of treatment; 30 45 CFR 164.512(j)(1)(ii). 31 45 CFR 164.512(j)(3). 13
- 18. state36 and federal law37 have limitations on what may be disclosed, the two provisions must be read together to establish what the hospital can provide to law enforcement when releasing information as a follow‐up to patients brought or caused to be brought to the hospital by authorities. Reading the provisions together, the following may be disclosed by hospitals: name, address, age, gender, and type of injury. The hospital may release additional information only if another exception applies, such as: • A patient or legally authorized surrogate has authorized the release by signing a valid authorization.38 See Section II for information on patient or surrogate authorization. See page 36 of this Guide for a model authorization form. • A law enforcement authority requests information about a patient with specific injuries.39 See Section III regarding disclosures in response to a request for information about patients with specific injuries. • A patient poses an imminent danger and the release of the information will avoid or minimize this imminent threat posed by the patient.40 See Section IV regarding disclosure to minimize an imminent threat. • An admitted patient is listed in the facility directory and is asked for by name. In this case, unless the patient has opted out of the directory, a one‐word condition and general location may be released.41 • The patient is the subject of suspected child42 or vulnerable adult abuse.43 36 RCW 70.02.050(l)(k) permits disclosure of certain information regarding patients who were brought or caused to be brought to the hospital by certain authorities, including name, residence, sex, age, occupation, condition, diagnosis, estimated or actual discharge date, extent and location of injuries determined by a physician, and whether the patient was conscious when admitted. 37 The HIPAA privacy regulation at 45 CFR 164.512(f) permits disclosure of a minimum amount of information: (A) Name and address; (B) Date and place of birth; (C) Social security number; (D) ABO blood type and rh factor; (E) Type of injury; (F) Date and time of treatment; (G) Date and time of death, if applicable; and (H) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos. 38 See RCW 70.02.030. 39 RCW 70.02.050(2)(c). 40 RCW 70.02.050(1)(d). 41 45 CFR 164.510, RCW 70.02.050(1)(j). See Frequently Used Terms for a description of “directory information.” 42 45 CFR 164.512(b)(1)(ii) 43 45 CFR 164.512(a); RCW 26.44.030; RCW 26.44.040; RCW 74.34.035. See Section XIV. 16
- 20. location of injuries, whether the patient has been transferred to another facility (unless the other facility is a mental health facility); and the date and time of the patientʹs discharge. The hospital may provide additional information only if another exception applies. VII. Notification on release of a patient Sometimes a person is arrested and in lieu of booking at the jail, is taken to the emergency room or health care facility because the person is injured or complaining of symptoms that require medical attention. In such cases, the law enforcement officer frequently leaves the patient at the emergency room or facility to receive care. Often, a law enforcement officer asks the hospital to notify him or her upon the patient’s release and to receive information on the patient’s condition. In general, without a guard or police officer supervising the patient’s whereabouts, a hospital cannot consider a patient left by police at a hospital to be in the custody of a law enforcement agency. Except as otherwise described elsewhere in this Guide, hospitals generally have no legal authority under the HIPAA privacy regulation or state law to release information to law enforcement if the patient is not in the custody of law enforcement. However, there are exceptions to this general rule: RCW 71.05.180 allows for patients who are arrested and brought to a health care facility to be evaluated for a 72‐hour psychiatric detention excluding Saturdays, Sundays and Holidays. If it is determined the patient is not appropriate for such an admission, at the request of law enforcement, the patient can be held for up to 8 hours in order for law enforcement to return to take the patient back into custody.46 There are also exceptions for minors who are receiving mental health treatment. See Section XIII for more information. Other exceptions that would enable the hospital to release the fact that a patient has been discharged are: • A patient or legally authorized surrogate has authorized the release by signing a valid authorization.47 See Section II for information on patient or surrogate authorization. See page 36 of this Guide for a model authorization form. • A law enforcement authority requests a patientʹs discharge date and time for a patient who was treated for a specific injury.48 See Section III for information regarding patients with specific injuries. 46 RCW 71.05.190 47 See RCW 70.02.030. 48 RCW 70.02.050(2)(c). Note that the hospital is required to respond to a request regarding the patientʹs discharge date and time. A hospital is not required to notify law enforcement when a patient is discharged. 18
- 21. • A patient poses an imminent danger and the release of the information will avoid or minimize this imminent threat posed by the patient49. See Section IV for information regarding disclosure to minimize an imminent threat. • An admitted patient is listed in the facility directory and is asked for by name. In this case, unless the patient has opted out of the directory, a one‐word condition and general location may be released.50 • The patient is the subject of suspected child or vulnerable adult abuse. VIII. Request for a patient’s physical items or samples as evidence Health care providers and law enforcement officials need to carefully evaluate their evidence transfer procedures in light of HIPAA. Certain transfers that in the past may not have been considered to involve PHI now may contain PHI. Patient authorization or a court order will be required in order for providers to release such information, samples, or records. The following is a quote from the preamble to the HIPAA regulation: ... if a person provides a bullet to law enforcement, and tells law enforcement that the bullet was extracted from an identified individual, the person has disclosed the fact that the individual was treated for a wound, and the additional statement is a disclosure of protected health information. The same analysis applies to cells, tissues, and physical items “such as clothing, weapons, or a bloody knife.” In order to make statements to law enforcement about these items, the disclosure must fall within one of the exceptions for disclosure to law enforcement discussed elsewhere in this Guide, and may only contain the limited information allowed by the particular exception. If no exception applies or if more extensive information is sought, patient authorization or a warrant must be obtained. See Sections II and X. Patient authorization or a court order is necessary in the case of mental health, substance abuse, or HIV information or treatment records. Note that items removed or identified while the patient is under the physical control of a police officer may be taken by the police officer as evidence. Additional considerations for hospitals in this area include minimizing the number of people who have custody of the physical item in order to reduce the number of people who must testify in court as to the chain of custody of the piece of evidence. In order to further minimize the chain of custody problem, hospitals also may consider providing the evidence directly to law enforcement authorities even if the identity of the person who possessed the evidence cannot be disclosed. In such cases, the items can be tracked by a number. Hospitals also should cross‐reference such items with any pending search warrants to determine whether not only the 49 RCW 71.02.050(1)(d) 50 45 CFR 164.510, RCW 70.02.050(1)(j). See Frequently Used Terms for a description of “directory information.” 19
- 23. C. The officer has reasonable grounds to believe that the person is under the influence of a drug; D. The person is under arrest for: i. vehicular homicide; ii. vehicular assault; or iii. DUI and the arrest results from an accident in which there was serious bodily injury to another person. If a person is dead, unconscious, or otherwise incapable of refusal, the person is deemed to have consented to the test.52 Disclosure of blood and alcohol levels to law enforcement is permitted under HIPAA because the reporting is required by law.53 Blood must be drawn and provided to law enforcement authorities in response to a search warrant that states that blood be withdrawn from an individual suspected of driving while under the influence, having physical control of a vehicle while under the influence, or driving while under twenty‐one and consuming alcohol.54 Substance abuse treatment records: Under state and federal law, records of substance abuse treatment programs may only be released: A. In accordance with the prior authorization of the patient; B. If authorized by an appropriate court order; C. To comply with state laws mandating the reporting of suspected child abuse or neglect; or D. When a patient commits a crime on program premises or against program personnel, or threatens to do so.55 This means that unless one of the above circumstances apply, substance abuse treatment records may not be disclosed to law enforcement without the patient’s authorization. This is true even if one of the other exceptions described in this Guide is met. Additionally, when a patient receiving court ordered treatment is, or becomes, subject to supervision by the department of corrections,56 certain records may be released. Any other disclosure must be authorized by the patient. 52 RCW 46.20.308, RCW 46.61.506. 53 45 CFR 164.512(f)(1)(i). 54 RCW 46.20.308(1). See Section X, Court‐ordered requests. 55 42 CFR 2.12(c), RCW 70.96A.150. 21
- 24. Mental health: If a patient is committed under the involuntary treatment act (Chapter 71.05 RCW) after dismissal of a sex, violent or felony harassment offense, police agencies must be notified upon that patient’s release, final discharge, transfer, authorized leave, or escape from involuntary treatment. 57 Upon request, a provider must also release the fact, place, and date of an involuntary commitment, the fact and date of discharge or release, and the last known address of patients committed under the involuntary treatment act. Providers must also release information related to mental health services for patients who: A. Are currently committed to the custody or supervision of the Department of Corrections or the Indeterminate Sentence Review Board; B. Have been convicted or found not guilty by reason of insanity of a serious violent offense; or C. Were charged with a serious violent offense and the charges were dropped when the patient was determined to be incompetent. However, this information may only be released when the requesting individual has a reasonable suspicion that the patient in question has engaged in behavior indicating a crime, a violation of community custody or a parole violation has been committed or is likely to be in the near future; or is exhibiting signs of mental deterioration and is likely to be civilly committed in the near future. These records may only be requested for the purposes of completing risk assessment reports, assessing a risk to the community, harm to self and others when in a city or county jail, planning for the supervision of an offender, and responding to an offender’s failure to report for department of corrections supervision. 58 For more detailed information on the release of mental health information, please review the Department of Social and Health Services official form “Request for Mental Health Service Information,” located at the end of this Guide. If a representative of a law enforcement or corrections agency requests that a provider commence an investigation or provide treatment to an offender, the provider shall provide the representative with written results of the investigation including the reasons for either detention or release. 59 The department of corrections must be notified by the provider if a patient receiving court ordered treatment is made subject to department of corrections supervision. The information shall include all relevant records and reports necessary for the Department of Corrections to carry out its duties. 60 56 RCW 71.05.445(1)(b) 57 RCW 71.05.425, 45 CFR 164.512(a). 58 RCW 71.05.385 59 RCW 71.05.390(7) 60 RCW 71.05.445(1)(b) 22
- 27. recipient may not disclose the receipt of the subpoena would constitute a written statement suspending the hospital’s obligation to account for that disclosure. If the official statement is made orally, the hospital must document the statement (include the identity of the official making the statement), temporarily suspend the right to an accounting of disclosures subject to the statement, and limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement is submitted during that time.75 It is important to note that revealing the location of a patient to law enforcement so that the patient can be served with an order, warrant or subpoena is, in itself, a release of PHI, and thus also subject to the guidelines above. Hospital personnel should consult with legal counsel if they have questions about what to do on receipt of a court order, warrant, or subpoena. XI. Release of information on crime victims Disclosures regarding crime victims generally may be made in the instances enumerated below. Washington State law does not expressly permit disclosures in response to a law enforcement officer’s request for information about an individual who is the victim of a crime. HIPAA does allow this type of disclosure.76 Because state law is more strict, a hospital generally may not give information about a crime victim directly to law enforcement unless another basis for disclosing the information applies. Disclosure of PHI of a crime victim is permitted where: A. The victim‐patient or legally authorized surrogate has authorized the release by signing a valid authorization.77 See Section II for information on patient or surrogate authorization. See page 36 of this Guide for a model authorization form. B. The victim‐patient is being treated for a specific injury. See Section III regarding disclosure of information in response to a request from a law enforcement authority. C. The victim‐patient poses an imminent danger and the release of the information will avoid or minimize the imminent threat posed by the patient.78 See also Section IV, disclosing to minimize an imminent threat. D. The victim‐patient is subject to an imminent threat or danger and the release of the information will avoid or minimize the threat to the patient. See Section IV, disclosing to minimize an imminent threat. 75 45 CFR 164.528(a)(2)(ii). 76 45 CFR 164.512(f)(3). 77 RCW 70.02.030. 78 RCW 70.02.050(1)(d). 25
- 28. E. An admitted victim‐patient is listed in the facility directory and is asked for by name. In this case, unless the patient has opted out of the directory, a one‐word condition and general location may be released.79 F. The victim‐patient was brought or caused to be brought to the hospital by fire, police, sheriff or other public authority. See Section VI for the information that may be disclosed in this circumstance. G. If the victim‐patient is the subject of suspected child or vulnerable adult abuse, a report must be made. See Section XIV. A law enforcement officer may accompany a victim while the victim receives treatment in the hospital if the patient consents and hospital staff determine that patient care will not be compromised. See Section XVI for more information on law enforcement presence in the hospital. If the patient verbally consents, the provider may respond to questions from the law enforcement officer regarding the patient. If the officer wants any written materials or substances, the patient must authorize the disclosure or another exception, such as those discussed above, must apply. Finally, all of the above applies even if the victim is a hospital employee, patient, or visitor. Example: A 45‐year‐old woman is being treated for bruising and contusions. The woman says she fell down the stairs, but the health care provider suspects she may be experiencing physical abuse at home. The woman plans to return home after treatment. If the woman meets the definition of a vulnerable adult, the provider must disclose PHI pursuant to state mandated reporting statutes. If the woman does not qualify as a vulnerable adult, the provider must determine whether another exception is met. For example, if the woman was brought to the hospital by a police officer, the police may be told the woman’s name, address, age, gender, and type of injury. Example: A person who is being treated for injuries sustained in a street fight says as soon as he gets out of the emergency department he is going to find the person who injured him and “teach him a lesson.” The health care provider will need to determine whether the person poses an imminent danger and the release of PHI to police would avoid or minimize the imminent threat posed by the patient. 79 45 CFR 164.510, RCW 70.02.050(1)(j). See Frequently Used Terms for a description of “directory information.” 26
- 31. information and documentation about the minor’s level of maturity and decision‐ making ability. 88 • If a person under 18 is married to a person 18 or older, the minor is deemed to be of full age.89 • Minors may also consent to certain medical treatments without parental consent.90 • Although state law does not specifically address it, in the context of minor consent to disclosure of PHI, presumably a parent in Washington State may agree to a confidential relationship between a minor and a treatment provider. Other areas of state law also address disclosure of minor’s PHI to law enforcement. For instance, health care providers are required to report instances of known or suspected child abuse. See Section XIV for more information. Mental health treatment for minors: The fact of admission and confidential information about the treatment of a minor in a mental health evaluation and treatment facility may be disclosed to law enforcement or public health officers as necessary for the responsibilities of their offices91, but the disclosure is restricted to the following information: A. The fact and date of admission; B. The date of discharge; C. The name and address of the treatment provider, if any; and, D. The last known address of the patient. Disclosures to law enforcement officers, public health officers, relatives, and other governmental law enforcement agencies, may be made if a minor has escaped from custody, disappeared from a mental health evaluation and treatment facility, violated conditions of a less restrictive treatment order, or failed to return from an authorized leave. Such disclosures must be limited to the minimum information necessary to provide for public safety or to assist in the 88 Under Smith v. Seibly, 70 Wn.2d 16, 431 P.2d 719 (1967), factors to be considered in determining whether a minor is emancipated for the purpose of making health care decisions include age, intelligence, maturity, training, experience, economic independence, and freedom from parental control. The physician must ask questions to determine capacity and whether the minor is capable of providing informed consent. 89 RCW 26.28.020. 90 STD testing and treatment, see RCW 70.24.110 (minor may consent absent parental consent at age 14); abortion, see RCW 9.02.110 and State v. Koome, 84 Wash. 2d 901, 530 P.2d 260 (1975) (a female patient may consent to or refuse termination of a pregnancy prior to viability of the fetus or to protect her life or health absent parental consent); voluntary mental health treatment, see RCW 71.34.530 (minor may consent absent parental consent at age 13); substance abuse treatment, see RCW 70.96A.095 (minor may consent to outpatient treatment absent parental consent at age 13). 91 RCW 71.34.340(8). 29
- 32. apprehension of the minor92 and, due to HIPAA, is restricted to the list found in 45 CFR 164.512(f).93 Disclosures of PHI maintained by mental health evaluation and treatment facilities regarding minors are subject to specific charting requirements. In the case of minors, in addition to charting according to the usual facility policies, the name or names of the persons or agencies to whom the disclosure was made and their relationship if any, to the minor, must also be charted.94 XIV. Reporting child or vulnerable adult abuse or neglect HIPAA permits the disclosure of PHI when required by law, and Washington State law mandates the reporting of suspected child or vulnerable adult abuse or neglect.95 Child abuse or neglect: Health care workers, law enforcement personnel, and other mandated reporters96 must report within 48 hours when they have reasonable cause to believe that a child has suffered abuse or neglect. A. A “child” is any person under the age of 18. B. “Abuse or neglect” means “injury, sexual abuse, sexual exploitation, negligent treatment, or maltreatment of a child by any person under circumstances which indicate that the child’s health, welfare, and safety is harmed.”97 A report of suspected child abuse or neglect must be made to the Department of Social and Health Services Child Protective Services or law enforcement. See http://www1.dshs.wa.gov/ca/safety/abuseReport.asp or call 1‐866‐363‐4276. Upon receiving a report, DSHS or law enforcement shall have access to all relevant records of the child in the possession of mandated reporters and their employees. 92 RCW 71.34.340(9). 93 The HIPAA privacy regulation at 45 CFR 164.512(f) permits disclosure of a minimum amount of information: (A) Name and address; (B) Date and place of birth; (C) Social security number; (D) ABO blood type and rh factor; (E) Type of injury; (F) Date and time of treatment; (G) Date and time of death, if applicable; and (H) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos. 94 RCW 71.34.350. 95 45 CFR 160.203(c); 45 CFR 164.512(a) and (c); and RCW 26.44; RCW 74.34. 96 See RCW 26.44.030(1)(a) for a list of mandated reporters. 97 RCW 26.44.020. 30
- 34. B. The name and address of the vulnerable adult and the name of the facility or agency providing care for the vulnerable adult; C. The name and address of the legal guardian or alternate decision maker; D. The nature and extent of the abandonment, abuse, financial exploitation, neglect, or self‐ neglect; E. Any history of previous abandonment, abuse, financial exploitation, neglect, or self‐ neglect; F. The identity of the alleged perpetrator, if known; and G. Other information that may be helpful in establishing the extent of abandonment, abuse, financial exploitation, neglect, or the cause of death of the deceased vulnerable adult. Additional access to PHI must be granted during the conduct of an investigation. The Department of Social and Health Services may interview the reporter, the vulnerable adult, and facility staff. In order to document evidence, the department may photograph a vulnerable adult or their environment. The patient’s or patient representative’s permission is required prior to photographing the vulnerable adult unless immediate photographing is necessary to preserve evidence. However, if the legal representative is alleged to have abused the vulnerable adult, consent from the legal representative is not necessary. It is not necessary to obtain consent to photograph the physical environment.104 If medical records concerning the vulnerable adult’s treatment are sought, a subpoena should be issued and processed through the hospital’s medical records or health information services department. Example: An elderly adult patient who receives home care arrives through the emergency department for treatment of pneumonia. In treating the patient, emergency department staff also discover multiple large bedsores. As mandated reporters, emergency department caregivers must immediately make a report if they have reasonable cause to believe this vulnerable adult has been subject to abandonment, abuse, or neglect. A report should be made to Adult Protective Services in the appropriate county. Adult Protective Services may request certain information from the mandated reporter at the time the report is made regarding the basis for the reporter’s claim. However, if medical records are sought, a subpoena should be issued and processed through the hospital’s medical records department. 104 RCW 74.34.067(7). 32
- 36. B. The Secret Service has requested information about a patient being treated for specific injuries.107 See Section III for information regarding disclosures in response to requests regarding patients treated for specific injuries. C. A patient poses an imminent danger and the release of the information will avoid or minimize this imminent threat posed by the patient. See Section III for information on disclosure to minimize an imminent threat. D. A report is initially made by certain authorities. See Section V for more information. E. An admitted patient is listed in the facility directory, has not opted out of the directory and is asked for by name. In this case a one‐word condition and general location may be released.108 National security issues: Disclosure of PHI to the Secret Service or other authorized federal officials relating to the conduct of lawful intelligence, counter‐intelligence and other national security activities conducted by the FBI and CIA may be made only if another exception permitting disclosure is also met. See A‐E immediately above for possible exceptions.109 It is important to note the FBI and the CIA are not a part of Homeland Security. Therefore, if an agent from Homeland Security requests records pursuant to National Security and the agent is not a member of the FBI or CIA, the agent should be directed to get a court order. USA PATRIOT Act court orders: USA PATRIOT Act110 court orders are often confused with Homeland Security issues. The USA PATRIOT Act, as it amends the Foreign Intelligence Surveillance Act, allows the FBI to obtain specialized court orders for “any tangible thing” that could relate to “international terrorism or clandestine intelligence activities.” The court order must be made by a qualified court and the court order itself cannot be disclosed to any persons other than those necessary to carry out the order.111 Although Washington State law generally requires notification of a patient of a health care provider’s disclosure of PHI, state law is preempted in this case. This means that the patient is not allowed to know that his or her PHI is being disclosed—this is the critical difference between a USA PATRIOT Act court order and any other court order presented to a hospital for the disclosure of PHI. Compare Section X to 107 RCW 70.02.050(2)(c). 108 45 CFR 164.510, RCW 70.02.050. See Frequently Used Terms for a description of “directory information.” 109 Under HIPAA, a hospital may disclose PHI to authorized federal officials for the conduct of lawful intelligence, counter‐intelligence, and other national security activities conducted by the FBI and the CIA. See the National Security Act (50 USC 401 et seq.) and 45 CFR 164.512(k)(2) for more information. However, Washington State law does not contain a similar exception, so Washington State law must be followed in this area. 110 Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of 2001. 111 50 USC 1861(d). 34
- 39. INCIDENT NUMBER AUTHORIZATION TO DISCLOSE PROTECTED HEALTH INFORMATION TO MENT AUTHORITY) ( LAW ENFORCE (Please print I, ______________________________________ as: ) ___________ _____ _ _ _ T) ED REPRESENTATIVE (PERSON AUTHORIZING CONSEN (ch ck one) ATIENT e P PATIENT’S PARENT/LEGAL GUARDIAN PATIENT’S AUTHORIZ hereby authorize elease the ________________________________________ to r (HOSPITAL / MEDICAL FACILITY) protected health information of: ____________________________________________, (PATIENT'S NAME) g (born____/____/____), for the time period beginning ____________________ and endin to assist in a (MO.) (DAY) (YR.) ____________________. I understan criminal investigation and/or pros d that the purpose of this disclosure is ecution. *********************************** INFORMATION TO BE RELEASED O ADVANCE NOTICE OF DISC NG / SOCIAL WORK NOTES (check a appropriate boxes) ll SUMMARY OF MEDICA LABORATORY / DIAGN STIC ESTS L HISTORY / TREATMENT T HARGE DATE / TIME ONLY NURSI RADIOLOGY RECORDS EMERGENCY ROOM RECORDS RADIOLOGY FILMS OTHER: ______________________ ___ _ ECORDS CONCERNING T E H.I.V./ AIDS TESTING/TREATMENT SEXUALL TRANSMITTED DISEASES ANY AND ALL R H SE SUBJECT AREAS: Y MENTAL ILLNESS / MENTAL HEALTH TREATMENT DRUG / ALCOHOL ABUSE TREATMENT Health information shall be released to the ( _____ ___ law enforcement authority). In addition, my care providers may discuss my medical condition and any treatment with the assigned detective or his/her designee. This authorization expires on ___/___/___ or when the following event occurs ________________, whichever occurs later. Once disclosed, the recipient may not be required to maintain the confidentiality of the health care information. However, I understand that certain health care information may be protected under State and Federal Law (42 CFR Part 2 and RCW 70.24). I reserve the right to revoke consent (in writing to the address below) at any time prior to its expiration, except to the extent that the facility which is to release information has already taken action in tha ment, or enrollment) is not utho accordance with it. I understand t my medical care (treatment, pay conditioned on my signing this a rization. ___________________________________ ___________________________________ Signature of Patient Signa Person Other Than Patient / Relationship to Patient ___________ ________________ _ ___________________ Signature of Witness / Inte _/_____/_____ ture of _____ ________ rpreter ent Officer Serial/Unit __________ Law Enforcem (Print name) ____ Date (Please send medical records to:) (FOR FOLLOWUP UNIT USE ONLY) ( _______ LAW ENFORCEMENT AUTHORITY) (ADDRESS OF LAW ENFORCEMENT AUTHORITY HERE) ATTN: (Person to _______________Unit be contacted)____________________________________________/_______________ Phone:____________________________ Fax#_______________________________