EMS providers are often asked to provide information about their patients to law enforcement. Although this information may help the police perform their duties, federal privacy regulations (which are applicable to so-called Ë™covered entitiesà“) significantly restrict what information health-care providers can give to law enforcement and under what circumstances.
These HIPAA regulations have six basic exceptions for when Protected Health Information (PHI) can be shared with law enforcement.”ž
- Disclosures Required by Law: If your state law requires you to make a certain disclosure, then it_s permitted under HIPAA. For example, some states require EMS providers to notify law enforcement of gunshot wounds, burn injuries or child abuse. This would also permit you to release PHI in response to subpoenas and search warrants. Check your state laws.
- Disclosures for Identification and Location Purposes: Under HIPAA, covered entities may disclose a limited amount of PHI in response to requests to identify or locate a missing person, material witness, suspect or fugitive.
- Disclosures Regarding Crime Victims: EMS providers may release PHI pertaining to a crime victim based on request if the patient agrees (even verbally) to the disclosure. If the victim is incapacitated, the”ždisclosure is permissible if you determine it_s in the patient_s best”žinterests, and law enforcement officials document that they need the information immediately and don_t intend to use it against the victim.”ž
- Disclosures Regarding Decedents:”žEMS providers may release PHI to the police when it appears that a person died as a result of a crime.
- Disclosures Regarding Crime on Premises: An EMS provider may disclose PHI regarding a crime that occurred on their premises, including an ambulance. For instance, if a crewmember is assaulted by a patient, this exception would permit you to share all information necessary to report the crime.
- Disclosures Regarding Reporting Crime in Emergencies: An EMS provider may disclose PHI to alert law enforcement to the commission of a crime, as well as the location of the crime victim, and provide information about the perpetrator. For example, if you arrive on scene and find an enraged male and a female patient who_s the apparent victim of an assault following a domestic dispute, it_s permissible to notify the police of the situation, provide the address, request a law enforcement response and provide information about the alleged perpetrator.”ž
Even under HIPAA, however, common sense should help you deal with Ë™everydayà“ kinds of questions. For instance, when asked to which hospital you are transporting the patient, the answer might technically constitute PHI. But it makes no sense to withhold such information when the police officer could merely follow the ambulance and find out.
If you_re a Ë™covered entityà“ under HIPAA, check with your organization_s privacy officer for more information about releasing PHI to law enforcement, or visit the HIPAA page at”žwww.pwwemslaw.com. For more on covered entities, visit”žwww.cms.hhs.gov/HIPAAGenInfo/06_AreYouaCoveredEntity.asp.
