Part 2, Chapter 7: Manual Exhibit 2-7-T
Policy and Procedure for the Disclosure of Protected Health
Information to Law Enforcement Officials
- PURPOSE. To publish Indian Health Service (IHS) policy and procedure on the disclosure of protected health information (PHI) to law enforcement agencies. This policy is not applicable to disclosures governed by the Federal Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 Code of Federal Regulations (CFR) Part 2.
- 5 CFR § 164.512
- 5 United States Code (U.S.C.) § 552a(b)(7)
- 45 CFR § 5b.9(b)(7)
- POLICY. It is IHS policy to disclose PHI to law enforcement agencies in accordance with the requirements of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule; the Privacy Act of 1974 as amended; the Health and Human Service (HHS) Privacy Act regulations; and the IHS Medical, Health, and Billing Records System of Records, Privacy Act System Notice 09-17-0001. The IHS may disclose PHI to law enforcement agencies under certain conditions and certain situations as outlined below.
- Law Enforcement Requests. Indian Health Service facilities will from time to time receive requests from Federal, State or Tribal law enforcement officials to release PHI that is in the possession of the IHS to such law enforcement officials. These may arise in a number of circumstances, including but not limited to: child abuse and neglect; domestic violence; sexual assault; and criminal vehicular assault. The Privacy Act of 1974, as amended, 5 U.S.C. § 552a (b)(7); the HHS Privacy Act regulations, 45 CFR § 5b.9(b)(7); and the HIPAA Privacy Rule, 45 CFR § 164.512(f)(1), generally authorize the release of PHI to law enforcement officials if the activity is required or authorized by law and if the law enforcement request meets the following basic criteria:
- The request is in writing;
- the request identifies the specific nature of the law enforcement activity (for example: investigation of sexual assault, child abuse, etc.);
- the facility is able to determine that the information sought is relevant and material to the particular law enforcement inquiry;
- de-identified information could not be used;
- the request is specific and limited in scope to the extent possible; and
- the request is signed by the head of the law enforcement agency.
Note: This requirement has been interpreted to extend to the head of the local division of a law enforcement agency, for example the Chief of the Criminal Division of the local U.S. Attorney’s office or the head of the Tribal prosecutor’s office.
- Special Circumstances. While the appropriate personnel at an IHS facility may generally release PHI to law enforcement officials pursuant to a law enforcement request that meets the requirements set forth in section (A) (1)-(6)above, in some instances the law enforcement request will need to satisfy certain additional criteria set forth in the HIPAA Privacy Rule before PHI can be released to law enforcement officials. This section sets forth those instances where such additional requirements must be satisfied before the IHS facility may release PHI to law enforcement officials.
- Identifying or locating a suspect, fugitive, missing person. etc. The IHS facility may disclose PHI in response to an otherwise valid law enforcement request for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, provided that the facility may disclose only the following information:
- Name and address;
- date and place of birth;
- social security number;
- ABO blood type and rh factor;
- type of injury;
- date and time of treatment;
- date and time of death, if applicable; and
- a description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.
Except as permitted in subsections 4B(1)a-h above, an IHS facility may not disclose for the purposes of identification or location any PHI related to the individual's DNA or DNA analysis, dental records, or typing, samples, or analysis of body fluids or tissue.
- Victims of a crime. Except for disclosures required by law, an IHS facility may disclose PHI in response to a law enforcement official's request for such information about an individual who is or is suspected to be a victim of a crime, if:
- The individual agrees to the disclosure; or
- the IHS facility is unable to obtain the individual's agreement because of incapacity or other emergency, and:
- The law enforcement official represents that such information is needed to determine whether a violation of law by a person other than the victim has occurred, and such information is not intended to be used against the victim;
- The law enforcement official represents that current, ongoing law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure; and
- the disclosure is in the best interests of the individual as determined by the IHS facility, in the exercise of professional judgment.
- Disclosures of PHI to Law Enforcement Official that do not Require a Law Enforcement Request. The HIPAA Privacy Rule, 45 CFR 164.512(f)(4)-(6), provides several instances where an IHS facility may voluntarily disclose PHI to law enforcement officials even in the absence of a law enforcement request for such records. The IHS facility may proactively disclose PHI to law enforcement officials without first receiving a request from a law enforcement official if:
- Decedents. An IHS facility may disclose PHI on a deceased individual to law enforcement official for the purpose of alerting law enforcement of the death of the individual if the facility has a suspicion that such death may have resulted from criminal conduct.
- Crime on Premises. An IHS facility may disclose to a law enforcement official PHI that the facility believes in good faith constitutes evidence of criminal conduct that occurred on the facility's premises.
- Reporting a Crime in Emergencies. An IHS facility providing emergency health care in response to a medical emergency, other than such emergency on its own premises, may disclose PHI to a law enforcement official if such disclosure appears necessary to alert law enforcement to:
- The commission and nature of a crime;
- The location of such crime or of the victim(s) of such crime; and
- The identity, description, and location of the perpetrator of such crime.
- Members of the IHS Workforce Who Are Victims of Crime. Members of the IHS workforce who are victims of a crime may disclose PHI to law enforcement officials under certain conditions regardless of whether the crime has occurred at the IHS facility or off premises. The IHS is not in violation of the HIPAA Privacy Rule if its workforce members who are victims of a crime disclose PHI to law enforcement officials provided that:
- the PHI disclosed is about the suspected perpetrator of the criminal act; and
- the information provided is limited to the following information about the perpetrator:
- Name and address
- Date and place of birth
- Social security number
- ABO Blood type and rh factor
- type of injury
- date and time of treatment
- date and time of death, if applicable; and
- the description of distinguishing characteristics (height, weight, eye and hair color, etc.)
- Verification of Identity of Law Enforcement Official. A law enforcement official must verify his or her identity by producing a badge, official identification, or some other identification that shows that the law enforcement official has the authority to accept the PHI on behalf of the law enforcement agency. See Manual Exhibit 2-7-R, “Policy and Procedure for Verification of Identity Prior to Disclosure of Protected Health Information.”
- Temporary Suspensions of Accounting for Disclosures to Law Enforcement Officials.
- A law enforcement official may request IHS to suspend a patient’s right to receive an accounting of disclosures if the agency or official provides a written statement that such an accounting to the patient would be reasonable likely to impede the agency or official’s duties. The agency or official must specify how long to suspend the accounting. During the period of accounting, any disclosures requiring an accounting must still be accounted (documented). At the end of the suspension, a patient’s right to receive an accounting is reinstated.
- If the request for temporary suspension is made orally, the IHS must document the identify of the agency or official who made the request must exclude the disclosure(s) for no longer than 30 days from the date of the request, unless a written request is provided during that time. If the agency or official provides a written request that meets the requirement of 4D(1) above, IHS must temporarily suspend the patient’s right to an accounting for the time period specified in the written request.
Back To Top