Contacting the police

Q: I work in a hospital emergency department and frequently treat patients who are brought in for evaluation by emergency medical services personnel, presumably at the direction of the police, who don't as a rule accompany the patient. Is it a violation of HIPAA for the ED to contact the police before discharging the patient?

A: Yes. Without patient authorization, nothing in HIPAA under these circumstances would allow ED staff to contact the police. The privacy rule does permit certain disclosures of protected health information to the police, but they generally require a specific law-enforcement request-or specific legal authorization-before any information can be released. Among permitted disclosures of information are those that (1) help to identify or locate a suspect, fugitive, material witness, or missing person; (2) comply with an administrative or another legal process, if the material requested is relevant to a law-enforcement inquiry and it's limited to whatever's necessary to fulfill the purpose of the request; (3) are authorized by laws that require doctors to report certain wounds and physical injuries; (4) involve a crime victim or victims of abuse, neglect, or domestic violence, under certain circumstances.

You may disclose protected health information to the police without a specific request or the patient's authorization to alert them to an apparent crime, including the identity and location of the victims and the suspected perpetrator; the death of an individual, when there's evidence of criminal conduct; and an apparent crime on the premises of a healthcare facility.