HIPAA allows police access to patients, federal judge rules
■ The case highlights the interplay between state and federal laws on sharing medical information about alleged crime victims, experts say.
- WITH THIS STORY:
- » Case at a glance
HIPAA privacy rules do not bar law enforcement from having access to patients who are victims of alleged crimes, a Louisiana federal judge recently ruled. The decision affirmed that police had the right to arrest a hospital case worker for obstruction of justice when she tried to stop police from questioning a patient.
The ruling likely will not embolden state authorities to barge into the treatment room, experts say.
"But the facts are perhaps a wake-up call," said Philip H. Lebowitz, a HIPAA lawyer and partner with Philadelphia-based Duane Morris LLP. "It does point out that what you might think is the right thing to do might not be under HIPAA."
Elizabeth Maier, the hospital employee at the center of the case, sued the police for falsely arresting her when she kept local police from seeing a patient who was being treated for alleged domestic abuse at Lafayette General Medical Center. The patient did not want to report the incident, but a nurse already had called 911, according to court records. Maier was never prosecuted.
During the encounter, Maier told police that HIPAA requires a patient's consent before disclosing private medical information. She argued in her lawsuit that the nurse who called the police to report the abuse had violated the patient's confidentiality under HIPAA. Maier also said police should have known she was just doing her job to protect the patient's privacy.
The police, on the other hand, argued that Louisiana law requires them to investigate reports of domestic violence once they are made and that Maier's actions prevented them from doing their duty.
Federal Judge Tucker L. Melancon agreed and dismissed Maier's lawsuit. He found that the officers had adequate reason to arrest Maier.
The privacy statute does not "prohibit hospital personnel from allowing police officers access to a patient who was a victim of a crime," his March 30 opinion states. It also does not prevent police from getting information directly from the patient.
Experts say the court's decision is consistent with the federal privacy statute. But they warn that a case like this can be a close call, and doctors should take note of the interplay between state and federal law. HIPAA does not pre-empt stricter state medical records privacy laws.
Lebowitz said HIPAA includes certain exceptions, allowing doctors and hospitals to disclose to authorized law enforcement or government agencies limited information about a patient they reasonably believe to be an abuse or neglect victim. This is the case, for example, when states have laws mandating the reporting of domestic abuse.
Louisiana law requires doctors and hospitals to report incidents of abuse of the elderly or minors but not competent adults, said Gregory D. Frost, a health lawyer and HIPAA expert with Adams and Reese LLP in Baton Rouge, La.
But doctors and hospitals shouldn't assume that the absence of a state abuse reporting requirement for competent adults means that these patients' privacy is protected under HIPAA, he said. For one thing, the federal statute applies to medical records, not necessarily the patient in person.
In a case such as Maier's, the nurse who made the original phone call might have violated HIPAA, absent a state abuse reporting mandate, Lebowitz said.
But once police arrive, HIPAA requires doctors and hospitals to comply with any legal request -- such as a search warrant, a subpoena or court order -- for information about the injured patient, he emphasized.
Hospital officials don't disagree with the court's finding on HIPAA. But they maintain that their first priority is to the patient.
Gordon E. Rountree, general counsel at Lafayette General, said hospital policy, which follows both HIPAA and state law, requires patient consent before the release of protected health information related to the domestic abuse of a competent adult.
The hospital had agreed to comply with the police request to question the patient in person, Rountree noted.
"We just told police, not here, not right now," while the patient was being treated, he said. "Our obligation at that point was to the patient, and that was the more pressing interest, as opposed to a long-term investigation."
Maier's attorney, G. Paul Marx, insists that police officers went too far and that HIPAA does not give law enforcement broad discretion to gain access to patients. He warned that the court's ruling could add tension between state authorities and medical personnel.
"Officers are going to feel compelled under state law to do [their duty], and if a patient refuses, medical providers can't facilitate that, so there's going to be a conflict," he said. An appeal of the decision, however, is unlikely, Marx said.
Attorneys for the police officers did not return calls for comment.
Lebowitz recommended that to protect themselves, doctors should know their state laws and make a good-faith effort to first obtain patient consent.
If law enforcement comes knocking, physicians can disclose limited medical information related to an alleged incident, he said. But if they aren't sure what is required of them, doctors can seek legal counsel and ask to see a legal request.