NRPM: Standards for Privacy of Individually Identifiable Health Information. iii. Additional considerations.

11/03/1999

This section is not intended to limit or preclude a covered entity from asserting any lawful defense or otherwise contesting the nature or scope of the process when the procedural rules governing the proceeding so allow, although it is not intended to create a basis for appealing to federal court concerning a request by state law enforcement officials. Each covered entity would continue to have available legal procedures applicable in the appropriate jurisdiction to contest such requests where warranted. This proposed rule would not create any new affirmative requirement for disclosure of protected health information. Similarly, this section is not intended to limit a covered entity from disclosing protected health information for law enforcement purposes where other sections of the rule permit such disclosure, e.g., as permitted by § 164.510 under emergency circumstances, for oversight or public health activities, to coroners or medical examiners, and in other circumstances permitted by the rule.

In obtaining protected health information, law enforcement officials would have to comply with whatever other law was applicable. In certain circumstances, while this subsection could authorize a covered entity to disclose protected health information to law enforcement officials, there could be additional applicable statutes that further govern the specific disclosure. If the preemption provisions of this regulation do not apply, the covered entity must comply with the requirements or limitations established by such other law, regulation or judicial precedent. See proposed §§ 160.201 through 160.204. For example, if State law would permit disclosure only after compulsory process with court review, a provider or payer would not be allowed to disclose information to state law enforcement officials unless the officials had complied with that requirement. Similarly, disclosure of substance abuse patient records subject to, 42 U.S.C. 290dd-2, and the implementing regulations, 42 CFR part 2, would continue to be governed by those provisions.

In some instances, disclosure of protected health information to law enforcement officials would be compelled by other law, for example, by compulsory judicial process or compulsory reporting laws (such as laws requiring reporting of wounds from violent crimes, suspected child abuse, or suspected theft of prescription controlled substances). Disclosure of protected health information under such other mandatory law would be permitted under proposed § 164.510(n).

In developing our proposal, we considered permitting covered entities to disclose protected health information pursuant to any request made by a law enforcement official, rather than requiring some form of legal process or narrowly defined other circumstances. We rejected this option because we believe that in most instances some form of review should be required. Individuals’ expectation of privacy with respect to their health information is sufficiently strong to require some form of process prior to disclosure to the government. At the same time, we recognize that the public interest would not be served by requiring such formal process in every instance. Under our proposal, therefore, law enforcement could obtain certain identifying information in order to identify suspects and witnesses, and could obtain information for national security or protective services activities or in emergency circumstances. Similarly, we would not require process before a law enforcement official could obtain information about the victim of a crime, where the information is necessary as the basis for immediate action. In addition, in seeking an appropriate balance between public safety and individuals' expectation of privacy, we are proposing that covered entities not be subject to enforcement under this regulation if they disclose protected health information to law enforcement officials in a good faith belief that the disclosure was permitted under this title.

We solicit comment on what additional steps, if any, are appropriate for allowing law enforcement access to protected health information. We are interested in comments concerning situations where needed access to protected health information would not be available under these or other provisions of this proposed rule. We also seek comment on specific privacy or other concerns that would apply if the final regulation included provision for law enforcement access to protected health information without requiring a judicial order, grand jury subpoena, or administrative request, under such additional defined circumstances

In some of these instances, release of protected health information would be authorized under the proposed regulation pursuant to provisions for patient consent, health oversight, emergency circumstances, or under mandatory reporting laws for gunshot wounds or abuse cases. We are interested in comments concerning situations where needed access to protected health information would not be available under these or other provisions of this proposed rule. We also seek comment on specific privacy or other concerns that would apply if the final regulation included provision for law enforcement access to protected health information without requiring a judicial order, grand jury subpoena, or administrative request, under such additional defined circumstances

Our proposal with respect to law enforcement has been shaped by the limited scope of our regulatory authority under HIPAA, which applies only to the covered entities and not to law enforcement officials. We believe the proposed rule sets the correct standards for when an exception to the rule of non-disclosure is appropriate for law enforcement purposes. There may be advantages, however, to legislation that applies the appropriate standards directly to judicial officers, prosecutors in grand juries, and to those making administrative or other requests for protected health information, rather than to covered entities as in the proposed regulation. These advantages could include measures to hold officials accountable if they seek or receive protected health information contrary to the legal standard. In Congressional consideration of law enforcement access, there have also been useful discussions of other topics, such as limits on re-use of protected health information gathered in the court of oversight activities. These limitations on our regulatory authority provide additional reason to support comprehensive medical privacy legislation.