HEALTH INDUSTRY ONLINE - Law Enforcement Requests for PHI

Handling Law Enforcement Requests for PHI

Most law abiding citizens and healthcare providers tend to have a knee-jerk reaction when asked for something from a law enforcement agency - they just say yes. However, as a recent Ohio federal court case reminds us, that reaction may get you into trouble. In Turk vs. Oiler, N.D. Ohio, No. 09-cv-381, 2/1/10, the U.S. District Court for the Northern District of Ohio refused to dismiss claims of invasion of privacy and civil rights violations against the Cleveland Clinic based on it’s compliance with a grand jury subpoena seeking the medical records of a patient during investigation of criminal weapon related charges. The Court held that the HIPAA Law Enforcement Purpose permitted disclosure exception did not provide a defense to disclosure of the PHI in this case because Ohio state law does not make an exception to the physician/patient privilege for grand jury subpoenas. The lesson here is that HIPAA compliance alone is insufficient if the applicable state law is more stringent.

TEXAS LAW

Healthcare Facilities

In Texas, disclosure of PHI without a written authorization is governed by Texas Health and Safety code section 241.153. The disclosure exceptions applicable to a PHI request generated by law enforcement are :

19. to comply with a court order except as provided by Subdivision (20); or

20. related to a judicial proceeding in which the patient is a party and the disclosure is requested under a subpoena issued under:

(A) The Texas Rules of Civil Procedure or Code of Criminal Procedure; or

(B) Chapter 121, Civil Practice and Remedies Code.

Note that exception 19 above requires a court order directing production, which is different than a subpoena. If a hospital receives a court order directing disclosure of PHI, it is protected and in fact must comply to avoid risking sanctions for contempt. If on the other hand a hospital receives a subpoena seeking disclosure of any PHI, it must first determine whether the patient at issue is a party to the action and then determine whether the subpoena itself complies with the Texas Rules of Civil Procedure, Criminal Procedure or the Civil Practices and Remedies Code. This requires careful analysis, and it is advisable to have one or two designated employees who are well trained to perform this function to maintain consistency in compliance.

Physicians

If you are a physician in Texas, Chapter 159.003 of the Texas Occupations Code applies to disclosure of PHI without a written authorization in court or other administrative proceedings. The provisions which authorize disclosure of PHI pursuant to a law enforcement subpoena are found in:

159.003 (6) - in a criminal investigation of a physician in which the board is participating, or assisting in the investigation....if the board protects the identity of the patient whose billing or medical records are provided...;

159.003 (7) - in an involuntary civil commitment proceeding, proceeding for court-ordered treatment , or probable cause hearing under Chapter 462,574 0r 593, Health and Safety;

159.003 (10) in a criminal prosecution in which the patient is a victim, witness, or defendant (but the records are not discoverable under this provision until after the court conducts an in camera inspection); and

159.003(12) to a court or a party to an action under a court order or court subpoena.

(b) This section does not authorize the release of confidential information to investigate or substantiate criminal charges against a patient.

As you can see, the permitted disclosure exceptions applicable to physicians differ somewhat from the provisions applicable to hospitals. For instance, a court order is not sufficient to allow for a physician to disclose PHI if the information is to be used to “investigate or substantiate criminal charges against a patient”, which is often the situation when law enforcement issues a request for PHI. Further, the Occupation Code requires an “in camera” review by the court for PHI sought in a criminal prosecution where the patient is either a victim, witness or defendant, but the Health and Safety Code does not include reference to an in-camera review.

Conclusion

Appropriate compliance with law enforcement requests for PHI requires attention to detail and careful analysis of the mechanism by which the information is sought. Clear policies and procedures on subpoena compliance are essential as inappropriate, unnecessary disclosures or failing to disclose when required may lead to both civil and/or criminal sanctions.

We recommend training one or two employees to perform this function and designation of those employees as the go-to team for subpoena and/or court order response. If there is uncertainty as to whether a law enforcement request for PHI complies with Texas law or if it clearly does not, an attorney should be consulted to determine the appropriate response, which may include a formal opposition (i.e. Motion for Protective Order). The bottom line is, do not ignore the request; give the request full analysis; and either respond with the information or seek advice of counsel and relief from the Court.

All of the above relates to state and/or local law enforcement requests for PHI on patients, and not to federal, governmental or quasi-governmental investigation or enforcement activities regarding alleged violations in your own health care practice.