NRPM: Standards for Privacy of Individually Identifiable Health Information. i. Law enforcement need for protected health information


Law enforcement officials need protected health information for their investigations in a variety of circumstances. Health information about a victim of a crime may be needed to investigate the crime, or to allow prosecutors to determine the proper charge. For some crimes, the severity of the victim's injuries will determine what charge should be brought against a suspect. The medical condition of a defendant could also be relevant to whether a crime was committed, or to the seriousness of a crime. The medical condition of a witness could be relevant to the reliability of that witness. Medical, billing, accounting or other documentary records in the possession of a covered entity can be important evidence relevant to criminal fraud or conspiracy investigations. Nor is this list of important uses by law enforcement exhaustive.

In many cases, the law enforcement official will obtain such evidence through legal process, such as judicially executed warrant, an administrative subpoena, or a grand jury subpoena. In other circumstances, time constraints preclude use of such process. For example, health information may be needed when a law enforcement official is attempting to apprehend an armed suspect who is rapidly fleeing. Health information may be needed from emergency rooms to locate a fleeing prison escapee or criminal suspect who was injured and is believed to have stopped to seek medical care.

Protected health information could be sought as part of a law enforcement investigation, to determine whether and who committed a crime, or it could be sought in conjunction with the trial to be presented as evidence. These uses of medical information are clearly in the public interest. Requiring the authorization of the subject prior to disclosure could impede important law enforcement activities by making apprehension and conviction of some criminals difficult or impossible.

As described above, this proposed rule seeks to respond appropriately to new risks to privacy that could emerge as the form of medical records changes in coming years. The administrative simplification mandated by HIPAA will lead to far greater exchanges of individually identifiable health information among covered entities in the future, increasingly in electronic form. If a misperception were to develop that law enforcement had instant and pervasive access to medical records, the goals of this proposed regulation could be undermined. For instance, individuals might become reluctant to seek needed care or might report inaccurately to providers to avoid revealing potentially embarrassing or incriminating information. In addition, popular concerns about government access to sensitive medical records might impede otherwise achievable progress toward administrative simplification. We believe that the proposed prophylactic and administrative rules governing disclosure to law enforcement officials, as described below, are justified in order to avoid these harms in the future.