By: Warren Diepraam
Prosecutor Fellow
National Association of Prosecutor Coordinators
Imagine being asleep on a Saturday morning at 2:30 a.m. A call comes to your home regarding a multiple fatality crash that just occurred. The first responders state that a family of three died in a vehicle that was struck by another car going the wrong way on the highway. They further state that the driver of the at-fault vehicle was found moderately injured about 15 feet away from the at-fault vehicle, smelled strongly of alcohol, and was transported to the local hospital with some injuries requiring prompt examination or treatment. The officer conducting the investigation meets you at the hospital and informs you that the suspect is a habitual drunk driver with a history of fleeing from the police. Knowing that the suspect is a flight risk, you need to find evidence fast and turn to the hospital staff for assistance with the toxicological findings and medical records to support your suspicion that the suspect is impaired. From having worked these cases before, you realize that you will need to find the suspect’s blood alcohol results, driving related admissions, and documentation relating to driver related injuries. The hospital staff in this hypothetical situation kindly responds by referring you to HIPAA and opining that they are not allowed to release private medical information because the federal statute trumps your state laws. Fortunately, this hurdle should not be an impediment to your investigation or the exigent filing of charges. It is simply a matter of being prepared and of making the request by using the benefits of HIPAA to your advantage.
In response to concerns over privacy, health, and insurance related concerns, the Health Insurance Portability and Accountability Act, more commonly known by the acronym HIPAA, was enacted in 1996. A cursory reading of the statute reveals that its goals are meritorious and not intended to prohibit legitimate law enforcement inquiries into the commission of crimes. In general terms, HIPAA contains seven sections that cover anything from applicability and definitions, uses and disclosures of protected health information, to transmission requirements and compliance dates. However, the section that will be applicable, and the section covered by this article that many in the healthcare industry are unfamiliar with, is the section relating to uses and disclosures for which individual authorization or an opportunity to object are not required. This disclosure section should be thoroughly analyzed and followed to avoid any trial or appellate entanglements that may result in an unnecessarily granted defense motion to suppress.
In the above case, the police and the prosecutor feel that there is a potential danger to the suspect and the public due to the intoxicated state of the individual and the risk associated with the subject’s potential for flight. Additionally, they have a reasonable belief that significant evidence will be found that will establish probable cause for an arrest. Fortunately, a hospital, emergency room, or paramedic may provide relevant medical information to law enforcement personnel without the written authorization of the suspect or target facing a criminal investigation. Any of these groups may disclose medical information as required by law and the disclosure is limited to the relevant requirements of the law. What is significant in this opening preamble of sorts is that the wording does not specifically define what law. Therefore, as long as the requirements of HIPAA are met, it appears that the word “law” does not preclude state law as authorizing release of information. This article does not cover relevant state laws. However, some states provide greater privacy protections in individual medical records than others. Many states have evidentiary rules that eradicate or curtail a suspect’s ability to claim a privacy interest in medical records or communications between a patient and a doctor. In these states, obtaining medical records and information is a relatively simple affair requiring only the hospital’s familiarity with HIPAA requirements. In other states, statutes provide greater protections of this information. Therefore, it would be wise to research your state’s laws to ensure that they don’t become your hurdle to this information.
The most common exception to non-disclosure is the law enforcement exception. This section lists six exceptions to non-disclosure. However, two exceptions to non-disclosure will most likely apply in the majority of these cases, namely those disclosures that are required pursuant to process / required by law in the jurisdiction or administrative requests. While there are some limitations in this section, they are not intended to be seen as a hindrance to police officers or prosecutors. A hospital or other covered provider may reveal protected information to a law enforcement investigator pursuant to process or as otherwise required by law. The section does not distinguish between federal or state law; therefore the wording implies that disclosure should be covered under the act even when mandated only by state law.
Additionally, there is not any significant requirement for how the law enforcement request is to be made. While there is no overt requirement that the request be made in writing, the permitted disclosures all refer to some form of legal document requiring disclosure. Although, an oral request by a police officer for toxicology results does not, on its face, appear to be prohibited by this section of HIPAA, there is another section that may allow for release of information pursuant to an oral request. This section provides that a hospital may disclose to a law enforcement official information that the hospital believes in good faith constitutes evidence of a crime that occurred on the premises of the hospital. Most states presumably have some form of a crime prohibiting appearances in a public place while intoxicated to the degree that the subject is a danger to themselves of others. In this fact pattern, the suspect is most likely intoxicated and, as a flight risk, a danger to others.
Therefore, the subject is committing a crime while on the hospital’s premises thereby triggering this HIPAA exception authorizing release of medical information. Although some hospitals are willing to cooperate with police officers under this exception, others will not. Therefore, the better practice is to make the demand in writing with some form of state authorized process, including court orders, warrants, grand jury subpoenas, regular subpoenas, a summons issued by a judicial officer, or an administrative request where authorized by law. This section will cover most of the law enforcement requests for information regarding crashes that occur on our roads.
There are helpful approaches to make disclosure more likely rather than referring to a contempt action. If making the request for health information in state mandated written form, the hospital will appreciate a HIPAA letter and, if authorized by state law, a general court order. The letter should cover the requirements contained in the relevant section of HIPAA. For example, a HIPAA letter should state that the request is relevant and material to a legitimate law enforcement inquiry, is specific and limited in its scope to the extent reasonably practicable in light of the purpose for which the information is sought, and that de-identified information could not reasonably be used. Providing a citation to the hospital in the HIPAA letter will also assist their attorneys in reviewing and approving the request. A court order, although not necessary when a subpoena or warrant is issued, will also help to alleviate the hospital’s reluctance to comply. Any prosecutor or police officer that regularly responds to the scene of this type of case should keep a standard court order and subpoena handy. In many jurisdictions, judges who are familiar with the objectives of law enforcement and the requirements of HIPAA are willing to sign a general court order backing up a subpoena for emergency use. Maintaining blank or general subpoenas, HIPAA letters, and court orders for emergencies such as the above factual pattern, should make it practical for a law enforcement agent to expediently obtain the needed information.
There are other exceptions in HIPAA that allow for quick and easy access to information to police or prosecutors investigating this sort of a case. The first of these exceptions authorizes disclosure of limited identifying information (name, address, social security number, type of injury, and a few other distinguishing characteristics) to law enforcement for the purpose of identifying or locating a suspect. While this specific exception does not allow for release of toxicology results and may not reveal all evidence needed, it will be helpful in locating suspects. The next section authorizes release of victim information. If your jurisdiction requires proof of serious bodily injury or death to compel a suspect’s blood sample or obtain a search warrant, this section should be used. The next section applies to somebody who has died as a result of criminal conduct. Again, this information may be important to show that an individual has died as a result of a traffic crash thereby triggering statutory evidence collection techniques. The last section will generally not apply in the majority of vehicular homicide cases, although they should be reviewed depending on the circumstances of your case.
In conclusion, the expedient discovery of narrowly tailored information in a criminal investigation relating to impairment or traffic injuries should not be slowed down by HIPAA. The goals of HIPAA are to facilitate better privacy protections and management of patient information as it relates to medical staff and the health industry. The federal government recognized that there would be many situations when law enforcement will legitimately require quick and prompt access to medical information and created several exceptions to the HIPAA rules. By being prepared and having the appropriate documents available for quick use, police and prosecutors will be able to perform their duties promptly. In the above scenario, the discovery of a blood alcohol content of 0.18, statements by the suspect to a nurse that he was the driver of the motor vehicle involved in the head-on crash, and seat-belt injuries consistent with having recently driven a motor vehicle will allow for the quick apprehension and prosecution of the suspect.
Editor’s Note: Warren Diepraam is the Prosecutor Fellow for the National Association of Prosecutor Coordinators (NAPC). The Prosecutor Fellow functions as an active liaison between the NAPC, the National Highway Traffic Safety Administration, and vehicular crimes prosecutors around the nation in an effort to promote understanding, communication, cooperation, education, and collegiality between the above entities.
