Government

HIPAA allows police access to patients, federal judge rules

The case highlights the interplay between state and federal laws on sharing medical information about alleged crime victims, experts say.

By — Posted May 21, 2007

Print  |   Email  |   Respond  |   Reprints  |   Like Facebook  |   Share Twitter  |   Tweet Linkedin

HIPAA privacy rules do not bar law enforcement from having access to patients who are victims of alleged crimes, a Louisiana federal judge recently ruled. The decision affirmed that police had the right to arrest a hospital case worker for obstruction of justice when she tried to stop police from questioning a patient.

The ruling likely will not embolden state authorities to barge into the treatment room, experts say.

"But the facts are perhaps a wake-up call," said Philip H. Lebowitz, a HIPAA lawyer and partner with Philadelphia-based Duane Morris LLP. "It does point out that what you might think is the right thing to do might not be under HIPAA."

Elizabeth Maier, the hospital employee at the center of the case, sued the police for falsely arresting her when she kept local police from seeing a patient who was being treated for alleged domestic abuse at Lafayette General Medical Center. The patient did not want to report the incident, but a nurse already had called 911, according to court records. Maier was never prosecuted.

During the encounter, Maier told police that HIPAA requires a patient's consent before disclosing private medical information. She argued in her lawsuit that the nurse who called the police to report the abuse had violated the patient's confidentiality under HIPAA. Maier also said police should have known she was just doing her job to protect the patient's privacy.

The police, on the other hand, argued that Louisiana law requires them to investigate reports of domestic violence once they are made and that Maier's actions prevented them from doing their duty.

Federal Judge Tucker L. Melancon agreed and dismissed Maier's lawsuit. He found that the officers had adequate reason to arrest Maier.

The privacy statute does not "prohibit hospital personnel from allowing police officers access to a patient who was a victim of a crime," his March 30 opinion states. It also does not prevent police from getting information directly from the patient.

Experts say the court's decision is consistent with the federal privacy statute. But they warn that a case like this can be a close call, and doctors should take note of the interplay between state and federal law. HIPAA does not pre-empt stricter state medical records privacy laws.

Lebowitz said HIPAA includes certain exceptions, allowing doctors and hospitals to disclose to authorized law enforcement or government agencies limited information about a patient they reasonably believe to be an abuse or neglect victim. This is the case, for example, when states have laws mandating the reporting of domestic abuse.

Louisiana law requires doctors and hospitals to report incidents of abuse of the elderly or minors but not competent adults, said Gregory D. Frost, a health lawyer and HIPAA expert with Adams and Reese LLP in Baton Rouge, La.

But doctors and hospitals shouldn't assume that the absence of a state abuse reporting requirement for competent adults means that these patients' privacy is protected under HIPAA, he said. For one thing, the federal statute applies to medical records, not necessarily the patient in person.

In a case such as Maier's, the nurse who made the original phone call might have violated HIPAA, absent a state abuse reporting mandate, Lebowitz said.

But once police arrive, HIPAA requires doctors and hospitals to comply with any legal request -- such as a search warrant, a subpoena or court order -- for information about the injured patient, he emphasized.

Hospital officials don't disagree with the court's finding on HIPAA. But they maintain that their first priority is to the patient.

Gordon E. Rountree, general counsel at Lafayette General, said hospital policy, which follows both HIPAA and state law, requires patient consent before the release of protected health information related to the domestic abuse of a competent adult.

The hospital had agreed to comply with the police request to question the patient in person, Rountree noted.

"We just told police, not here, not right now," while the patient was being treated, he said. "Our obligation at that point was to the patient, and that was the more pressing interest, as opposed to a long-term investigation."

Maier's attorney, G. Paul Marx, insists that police officers went too far and that HIPAA does not give law enforcement broad discretion to gain access to patients. He warned that the court's ruling could add tension between state authorities and medical personnel.

"Officers are going to feel compelled under state law to do [their duty], and if a patient refuses, medical providers can't facilitate that, so there's going to be a conflict," he said. An appeal of the decision, however, is unlikely, Marx said.

Attorneys for the police officers did not return calls for comment.

Lebowitz recommended that to protect themselves, doctors should know their state laws and make a good-faith effort to first obtain patient consent.

If law enforcement comes knocking, physicians can disclose limited medical information related to an alleged incident, he said. But if they aren't sure what is required of them, doctors can seek legal counsel and ask to see a legal request.

Back to top


ADDITIONAL INFORMATION

Case at a glance

Elizabeth Maier v. Morgan Green et al.

Venue U.S. District Court for the Western District of Louisiana
At issue Whether police had the right to arrest a hospital worker for obstruction of justice when she cited HIPAA to prevent law enforcement from accessing an alleged victim of domestic abuse. The court said yes.
Potential impact Legal experts say the ruling is consistent with HIPAA, but doctors should be aware of the interaction between state and federal laws. The plaintiff lawyer in the case fears it will give police broader access to patients, irrespective of medical privacy.

Back to top


ADVERTISEMENT

ADVERTISE HERE


Featured
Read story

Confronting bias against obese patients

Medical educators are starting to raise awareness about how weight-related stigma can impair patient-physician communication and the treatment of obesity. Read story


Read story

Goodbye

American Medical News is ceasing publication after 55 years of serving physicians by keeping them informed of their rapidly changing profession. Read story


Read story

Policing medical practice employees after work

Doctors can try to regulate staff actions outside the office, but they must watch what they try to stamp out and how they do it. Read story


Read story

Diabetes prevention: Set on a course for lifestyle change

The YMCA's evidence-based program is helping prediabetic patients eat right, get active and lose weight. Read story


Read story

Medicaid's muddled preventive care picture

The health system reform law promises no-cost coverage of a lengthy list of screenings and other prevention services, but some beneficiaries still might miss out. Read story


Read story

How to get tax breaks for your medical practice

Federal, state and local governments offer doctors incentives because practices are recognized as economic engines. But physicians must know how and where to find them. Read story


Read story

Advance pay ACOs: A down payment on Medicare's future

Accountable care organizations that pay doctors up-front bring practice improvements, but it's unclear yet if program actuaries will see a return on investment. Read story


Read story

Physician liability: Your team, your legal risk

When health care team members drop the ball, it's often doctors who end up in court. How can physicians improve such care and avoid risks? Read story

  • Stay informed
  • Twitter
  • Facebook
  • RSS
  • LinkedIn