Transcript Understanding HIPAA from a Law Enforcement Perspective

Understanding HIPAA from a
Law Enforcement Perspective
Presented by:
Dede Ford, Violence Against Women Project Training
Attorney, PAAM
and
Jan Walton, Director of Health Information Management,
Oaklawn Hospital
PAAM wishes to thank the MDVSAPTB for
their financial support of this project.
This project was supported by Grant No. 2011-WF-AX-0013
awarded by the Office on Violence Against Women, U.S.
Department of Justice to the Michigan Domestic Violence
Prevention and Treatment Board. The opinions, findings,
conclusions, and recommendations expressed in this
publication/program/exhibition) are those of the
author(s) and do not necessarily reflect the views of the
Department of Justice, Office on Violence Against Women or the
Michigan Domestic Violence Prevention and Treatment Board.
What is HIPAA?
 The Health Insurance Portability and Accountability Act of
1996 is a multifaceted piece of legislation covering 3 areas:
A. Insurance Portability
B. Fraud Enforcement (Accountability)
C. Administrative Simplification-Ensures
system-wide, technical and policy changes in
healthcare organizations in order to protect
patient’s privacy and the confidentiality of
identifiable protected health information (PHI).
Protected Health Information
What Information is Protected?
 Protected Health Information. The Privacy Rule protects all "individually
identifiable health information" held or transmitted by a covered entity or its
business associate, in any form or media, whether electronic, paper, or oral. The
Privacy Rule calls this information "protected health information (PHI)."12
 “Individually identifiable health information” is information, including
demographic data, that relates to:
 the individual’s past, present or future physical or mental health or condition,
 the provision of health care to the individual, or
 the past, present, or future payment for the provision of health care to the
individual,
 and that identifies the individual or for which there is a reasonable basis to
believe it can be used to identify the individual.13 Individually identifiable health
information includes many common identifiers (e.g., name, address, birth date,
Social Security Number).
Discovery MCR 6.201
(C) Prohibited Discovery.
 (1) Notwithstanding any other provision of this rule,
there is no right to discover information or evidence
that is protected from disclosure by constitution,
statute, or privilege, including information or
evidence protected by a defendant's right against
self-incrimination, except as provided in subrule (2).
MCR 6.201 (C)(2)
 (2) If a defendant demonstrates a good-faith belief,
grounded in articulable fact, that there is a reasonable
probability that records protected by privilege are likely to
contain material information necessary to the defense, the
trial court shall conduct an in camera inspection of the
records. (People v Stanaway, 446 Mich. 643, 662; 521 NW2d
557 (1994).)
 (a) If the privilege is absolute, and the privilege holder
refuses to waive the privilege to permit an in camera
inspection, the trial court shall suppress or strike the
privilege holder's testimony.
MCR 6.201 (C)(2), continued
 (b) If the court is satisfied, following an in camera inspection,
that the records reveal evidence necessary to the defense, the
court shall direct that such evidence as is necessary to the
defense be made available to defense counsel. If the privilege is
absolute and the privilege holder refuses to waive the
privilege to permit disclosure, the trial court shall suppress or
strike the privilege holder's testimony.
 (c) Regardless of whether the court determines that the
records should be made available to the defense, the court shall
make findings sufficient to facilitate meaningful appellate
review.
MCR 6.201 (C)(2), continued
 (d) The court shall seal and preserve the records for review in
the event of an appeal
 (i) by the defendant, on an interlocutory basis or following
conviction, if the court determines that the records should not
be made available to the defense, or
 (ii) by the prosecution, on an interlocutory basis, if the court
determines that the records should be made available to the
defense.
 (e) Records disclosed under this rule shall remain in the exclusive
custody of counsel for the parties, shall be used only for the
limited purpose approved by the court, and shall be subject to
such other terms and conditions as the court may provide.
MCR 6.201 (D)
 (D) Excision. When some parts of material or information
are discoverable and other parts are not discoverable, the
party must disclose the discoverable parts and may excise
the remainder. The party must inform the other party that
nondiscoverable information has been excised and
withheld. On motion, the court must conduct a hearing in
camera to determine whether the reasons for excision are
justifiable. If the court upholds the excision, it must seal
and preserve the record of the hearing for review in the
event of an appeal.
MCR 6.201 (E)
 (E) Protective Orders. On motion and a showing of good cause,
the court may enter an appropriate protective order. In
considering whether good cause exists, the court shall consider
the parties' interests in a fair trial; the risk to any person of
harm, undue annoyance, intimidation, embarrassment, or
threats; the risk that evidence will be fabricated; and the need
for secrecy regarding the identity of informants or other law
enforcement matters. On motion, with notice to the other party,
the court may permit the showing of good cause for a protective
order to be made in camera. If the court grants a protective
order, it must seal and preserve the record of the hearing for
review in the event of an appeal.
Privileges-SA or DV Counselor
MCL 600.2157a Definitions; consultation between victim and
sexual assault or domestic violence counselor; admissibility.
(1) For purposes of this section:
(a) “Confidential communication” means information transmitted
between a victim and a sexual assault or domestic violence counselor, or
between a victim or sexual assault or domestic violence counselor and any
other person to whom disclosure is reasonably necessary to further the
interests of the victim, in connection with the rendering of advice,
counseling, or other assistance by the sexual assault or domestic violence
counselor to the victim.
(b) “Domestic violence” means that term as defined in section 1501 of Act
No. 389 of the Public Acts of 1978, being section 400.1501 of the Michigan
Compiled Laws.
(c) “Sexual assault” means assault with intent to commit criminal sexual
conduct.
Privileges-SA or DV Counselor
(continued)
(d) “Sexual assault or domestic violence counselor” means a person who is
employed at or who volunteers service at a sexual assault or domestic violence
crisis center, and who in that capacity provides advice, counseling, or other
assistance to victims of sexual assault or domestic violence and their families.
(e) “Sexual assault or domestic violence crisis center” means an office,
institution, agency, or center which offers assistance to victims of sexual assault
or domestic violence and their families through crisis intervention and
counseling.
(f) “Victim” means a person who was or who alleges to have been the subject of
a sexual assault or of domestic violence.
(2) Except as provided by section 11 of the child protection law, Act No. 238 of the
Public Acts of 1975, being section 722.631 of the Michigan Compiled Laws, a
confidential communication, or any report, working paper, or statement
contained in a report or working paper, given or made in connection with a
consultation between a victim and a sexual assault or domestic violence
counselor, shall not be admissible as evidence in any civil or criminal proceeding
without the prior written consent of the victim.
Privileges-Psychologist
MCL 333.18237 Confidential information; disclosure; waiver.
A psychologist licensed or allowed to use that title under this part or an
individual under his or her supervision cannot be compelled to disclose
confidential information acquired from an individual consulting the
psychologist in his or her professional capacity if the information is
necessary to enable the psychologist to render services. Information may
be disclosed with the consent of the individual consulting the
psychologist, or if the individual consulting the psychologist is a minor,
with the consent of the minor's guardian, pursuant to section 16222 if the
psychologist reasonably believes it is necessary to disclose the information
to comply with section 16222, or under section 16281. In a contest on the
admission of a deceased individual's will to probate, an heir at law of the
decedent, whether a proponent or contestant of the will, and the
personal representative of the decedent may waive the privilege created
by this section.
Privileges-Physician
MCL 600.2157 Physician-patient privilege;
waiver.
Except as otherwise provided by law, a person
duly authorized to practice medicine or surgery
shall not disclose any information that the
person has acquired in attending a patient in a
professional character, if the information was
necessary to enable the person to prescribe for
the patient as a physician, or to do any act for the
patient as a surgeon. . . .
First Things First
 Do you NEED the information contained in the records to
help PROVE an element of a charged offense?
If the answer is no, DON’T REQUEST THE RECORDS!
Example 1: SANE record reveals physical injury. You probably
don’t need the Emergency Department triage record.
Example 2: SANE record reveals that victim is on an antipsychotic or anti-depressant medication. There is no need to
obtain the medical or psychiatric records that would give the
history behind prescribing that medication.
First Things First, continued
 If the answer is yes, have a discussion with the victim and,
if they agree, obtain their consent. Consider including an
advocate in this discussion to provide additional support to
the victim, if needed.
 Keep in mind that the victim has already been traumatized
by the event(s) that have brought her into the criminal
justice system. Obtaining private, confidential records of
the victim may exacerbate that trauma. Proceed with
caution.
Release of Protected Health
Information to Law Enforcement
 The Privacy Rule is balanced to protect an individual’s
privacy while allowing important law enforcement
functions to continue. The Rule permits covered
entities (health care providers) to disclose protected
health information to law enforcement officials,
without the individual’s written authorization, under
specific circumstances.
Permitted Disclosures for Law
Enforcement Purposes
 To comply with a court order or court-ordered
warrant, a subpoena or summons issued by a judicial
officer, or a grand jury subpoena.
45 CFR 164.512(f)(1)(ii)(A)-(B)).
Permitted Disclosures for Law
Enforcement Purposes
 To respond to a request about a victim of a crime, and
the victim agrees. If the victim is unable to agree
(due to an emergency or incapacity), the information
may be disclosed if law enforcement represents that
the information is not intended to be used against the
victim and is needed because the investigation would
be materially and adversely affected by waiting until
the victim could agree.
45 CFR 164.512(f)(3)
Permitted Disclosures for Law
Enforcement Purposes
 To report protected health information that the
covered entity in good faith believes to be evidence
of a crime that occurred on the covered entity’s
premises.
45 CFR 164.512(f)(5)
Permitted Disclosures for Law
Enforcement Purposes
 To respond to a request for purposes of identifying or
locating a suspect, fugitive, material witness or
missing person; but the information released must be
limited.
45 CFR 164.512(f)(2)
Release of Information for PHIConsiderations
 Review with victim and request only what is necessary.
 Avoid overbroad terms in your request; “Any and all records . . .” may
open a Pandora’s box that you won’t be able to close.
Example: Your request was overbroad. Not only did you receive
Emergency Department records but you also received records of a
psychiatric hospitalization from 3 years ago that reveal a suicide
attempt. Your support staff copied them and provided them to defense
counsel without your review. You will have to file protective motions,
etc. to try to keep that information out of court.
More importantly, the victim suffers knowing that her private records
are in the hands of the person that assaulted her. This damages your
relationship with her going forward.
Release of Information for PHIConsiderations
 Include FULL NAME and DATE OF BIRTH
 Include specificity about specific treatments and dates.
Example 1: “operative report from November 01, 2012,” if
you will be calling the surgeon as a witness.
Example 2: “emergency department record dated
November 01, 2012” if you intend to call the ED healthcare
provider to show petechial hemorrhage for a GBH case.
 Obtain signature of victim.
Search warrants for PHI
 Same considerations apply as with permissive
releases.
 When in doubt, contact a medical records
professional at the healthcare provider that maintains
the desired records for assistance in formulating the
appropriate and relevant request.
Things to think about when records
are received
 Review the contents before automatically turning a
copy over to defense counsel.
 Are they responsive to your specific request? If not,
return those records that aren’t relevant.
 If appropriate, excise information that is not
discoverable.
 If you are unsure about potential Brady material, seek
assistance.
Request a meeting with local Health
Information Management Director
 Develop a good working relationship.
 Utilize their expertise.
 If records need to be admitted in court, utilize the
business records exception and certification of record
custodian in lieu of testimony. MRE 803 (6).
 Work through problems together. Develop a process
for dealing with issues that develop after business
hours before an issue comes up.
Educate local law enforcement about
PHI and releases from victims
 Ensure that there is an understanding about the
victim’s right to have their private records remain
private, absent an absolute need.
 If they obtain a release due to their contact with the
victim, review it for relevance before it is sent to the
healthcare provider.
Links for Additional Information
US Department of Health and Human Services
A full listing of situations where disclosures are permitted for law
enforcement officials:
http://www.hhs.gov/ocr/privacy/hipaa/faq/disclosures_for_law_enforceme
nt_purposes/505.html
National District Attorneys Association Update:
HIPAA—Exceptions providing Law Enforcement Officials and Social Service
Providers Access to Protected Health Information
http://www.ndaa.org/ncpca_update_v16_no4.html
Questions?
Violence Against Women Project
Prosecuting Attorneys Association of Michigan
 Director Herb Tanner, 517-334-6060 ext. 829
 Training Attorney Dede Ford, 517-334-6060 ext. 806