Disclosure of PHI for Law Enforcement Purposes

Human Resources

Safety/Security

Research Compliance

Compliance

Privacy/Information Security

Business Operations

Intellectual Property

Faculty

Identification Card | Secure Area Card Access | Privacy/Confidentiality | Computer Use/Electronic Information | Retention and Destruction/Disposal of Private and Confidential Information | Use and Disclosure of Protected Health Information | Notice of Privacy Practices | Access to Designated Record Set | Accounting of PHI Disclosures | Patient/Consumer Complaints | Vendors | Fax Transmissions | Psychotherapy Notes | Facility Security | Conditions of Treatment Form | Informed Consent for UNMC Media | Transporting Protected Health Information | Honest Broker | Social Security Number | Third Party Registry | Information Security Awareness and Training | Patient Privacy Investigations and Levels of Violation | Use and Disclosure of PHI for Training Health Care Professionals | Disclosures of PHI as Permitted or Required by Law | Disclosure of PHI for Law Enforcement Purposes

Policy No.: 6305
Effective Date: Draft 10/28/22
Revised Date:
Revised Date:

Policy on Disclosure of PHI for Law Enforcement Purposes

Basis for Policy

To establish guidelines for the disclosure of PHI for law enforcement purposes in accordance with HIPAA and University of Nebraska Medical Center (UNMC) policies.

Policy

UNMC shall disclose protected health information (PHI) for law enforcement purposes in accordance with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and UNMC policies to maintain confidentiality of PHI and protect patient privacy.

Procedures

Disclosure of PHI for Law Enforcement Purposes

In addition to disclosures of PHI that are allowed by UNMC Policy No. 6303, Disclosures of PHI as Permitted or Required by Law, PHI may be disclosed to law enforcement only under the following, limited circumstances. All such disclosures must be documented via Quick Disclosure. Disclosure must be limited to the minimum necessary amount needed to accomplish the disclosure’s intended purpose (which may be the elements listed in a relevant state law).

1. When believed in good faith to be necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. If law enforcement is to be contacted, first contact campus Public Safety (unless the threat is immediate, in which case local law enforcement should be contacted immediately). Reference this policy, UNMC Policy No. 6304, Disclosure of PHI for Law Enforcement Purposes.
2. In compliance with and as limited by the relevant requirements of:
   • A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer (reference UNMC Policy No. 6303, Disclosures of PHI as Permitted or Required by Law regarding disclosures for judicial or administrative proceedings pursuant to a court or administrative tribunal order or subpoena);
   • A grand jury subpoena; or
   • An administrative request (a Law Enforcement Investigative Demand form, CON-MR-2200) that indicates the following:
     • The information sought is relevant and material to a legitimate law enforcement inquiry;
     • The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and
     • De-identified information could not reasonably be used.

Note: Law enforcement is not permitted to be present in an operating room or any other treatment space unless:

• required by a court order or search warrant;
• at the request of clinical staff (e.g., for their safety); or
• the Individual gives permission for a law enforcement officer to be in the patient’s room (and the law enforcement officer’s presence does not impede or in any way compromise the patient’s medical care, in staff’s sole determination).

1. If a law enforcement officer requests PHI to identify or locate a suspect, fugitive, material witness, or missing person. Staff may provide only the following PHI about the Individual in this scenario:
• • name,
  • address,
  • date and place of birth,
  • SSN,
  • ABO blood type and Rh factor,
  • type of injury,
  • date and time of treatment,
  • date and time of death, and
  • a description of distinguishing physical characteristics**, including:
    • height,
    • weight,
    • gender,
    • race,
    • hair and eye color,
    • presence or absence of facial hair (beard or moustache),
    • scars, and
    • tattoos.

May not provide information related to the Individual’s DNA or DNA analysis, dental records, or typing/samples/analysis of bodily fluids or tissue.

1. If a law enforcement officer requests PHI about an Individual who is a victim (or suspected victim) of a crime for which staff is not otherwise legally required to report (see UNMC Policy No. 6303, Disclosures of PHI as Permitted or Required by Law), staff may disclose PHI with the Individual’s consent. Such consent must be documented in the patient’s medical record.

   If the Individual is unable to give consent (i.e., the patient is incapacitated or another emergency circumstance exists), staff may disclose PHI to law enforcement in this scenario if:

   • law enforcement represents that law enforcement needs the information to determine if someone other than the victim committed a crime and the information is not intended to be used against the victim;
   • law enforcement represents that immediate law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the Individual is able to agree to the disclosure; and
   • the disclosure is in the best interest of the Individual as determined by UNMC in the exercise of professional judgment.
2. To alert law enforcement of an Individual’s death suspected to have resulted from criminal conduct.
3. If the PHI is believed in good faith to constitute evidence of criminal conduct that occurred on the UNMC campus.
4. When a Workforce member is a victim of a crime, the Workforce member may disclose the following limited PHI about the suspected perpetrator of the criminal act to a law enforcement official:
   • name and address;
   • date and place of birth;
   • social security number;
   • ABO blood type and Rh factor;
   • type of injury;
   • date and time of treatment;
   • date and time of death, if applicable; and
   • a description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars and tattoos.
5. Disclosures of PHI to a correctional institution or law enforcement official that has custody of an inmate or other individual is permitted if the correctional institution or such law enforcement official represents that the PHI is necessary for:
   • the provision of health care to such Individuals;
   • the health and safety of such Individual or other inmates;
   • the health and safety of the officers or employees of or others at the correctional institution;
   • the health and safety of such Individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another;
   • law enforcement on the premises of the correctional institution; or
   • the administration and maintenance of the safety, security, and good order of the correctional institution.

     For the purposes of this provision, an Individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.

6. If law enforcement asks about an Individual’s condition, staff may disclose a one-word general description (i.e., undetermined, good, fair, serious or critical) if:
   • the Individual has not objected to the Individual’s PHI being used or disclosed in connection with the facility directory (see Nebraska Medicine Private Designation policy, RI 15)
   • the Individual has not been provided an opportunity to object to such use or disclosure because of the Individual’s incapacity or an emergency treatment circumstance and/or staff has otherwise automatically opted the Individual out of the facility directory pursuant to Nebraska Medicine’s Private Designation policy, RI 15, and, in the exercise of professional judgment, staff has determined that such disclosure is in the Individual’s best interest.

Staff may not communicate specific medical information about the Individual.

1. Staff may disclose an Individual’s date of birth upon request of law enforcement only if:
   • Staff first obtains the Individual’s permission to disclose such information; or
   • permitted by policies (reference Nebraska Medicine’s Reporting Abuse, Neglect or Injury policy, PE 03, and UNMC Policy No. 6303, Disclosures of PHI as Permitted or Required by Law).
2. If law enforcement requests notification of an Individual’s discharge, such disclosure is permitted only if:
   • law enforcement provides staff a court order that requires UNMC to make such a notification;
   • the Individual is in police custody; or
   • staff obtains the Individual’s prior written authorization to make such a disclosure.

     See Nebraska Medicine’s Legal Status Holds policy, LD-12.

3. When a law enforcement officer asks to interview an Individual:
   • If the Individual is in police custody, it is permissible for the law enforcement officer to be present and ask an Individual questions unless the officer’s presence would impede staff’s ability to provide patient care or compromise sterilization/infection control procedures.
   • If the Individual is not in police custody, it is permissible for the law enforcement officer to be present and ask an Individual questions if the Individual agrees and the officer’s presence would not impede staff’s ability to provide patient care or compromise sterilization/infection control.
   • Regardless if the Individual is in police custody or not, it is the Individual’s decision as to whether the Individual speaks with law enforcement.
4. When a law enforcement officer requests visitor restrictions:
   • If the Individual is in police custody, it is permissible to restrict the Individual’s visitors per the law enforcement officer’s request.
   • If the Individual is not in police custody, it is permissible to restrict the Individual’s visitors per the law enforcement officer’s request in two scenarios:
     • the Individual agrees to the request and honoring the request does not impede patient care or compromise sterilization/infection control; or
     • the law enforcement officer states that the request is necessary to avoid a serious threat to the Individual’s health or safety (e.g., to confirm that the family/visitor did not cause the Individual’s injuries), and honoring the request does not impede patient care or compromise sterilization/infection control.
   • If either of the situations in Section 13 applies, any visitor restrictions should be limited to the shortest time possible.
   • If neither of the situations in Section 13 applies, follow the standard visitor policy.
5. Forensic testing
   • When a law enforcement officer asks staff to take a blood draw or collect a urine specimen for purposes of testing the presence of alcohol and/or illegal drugs, staff may do so only if:
     • staff has obtained the Individual’s written consent for the testing; or
     • staff is presented a search warrant; or
     • the law enforcement officer provides a signed attestation that exigent circumstances exist.
   • When a law enforcement officer requests the test specimen or results, staff may disclose only if:
     • the Individual provides written authorization for the disclosure; or
     • staff is presented a court order, subpoena, or warrant for the test specimen or results (forward the document to the Health Information Management department (HIM) for processing; for urgent requests that cannot wait for HIM, contact Risk or General Counsel’s office).

Reference Nebraska Medicine’s Legal Blood Alcohol Testing policy, ESD 06.005, and Legal Drug/Alcohol Testing policy, PC18.

Definitions

Individual

The person who is the subject of the PHI. Personal representatives of the Individual have the same rights as the Individual under HIPAA (i.e., they “step into the shoes” of the Individual). Personal representatives include the legal guardian and anyone else authorized by law to act on behalf of the Individual. (See Nebraska Medicine Consents and Permits policy, MS14.)

Protected Health Information (PHI)

Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:

• is created or received by UNMC/ACE; and
• relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual.

PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):

• an Individual’s genetic tests;
• the genetic tests of an Individual’s family members; or
• the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history).

PHI excludes:

• individually identifiable health information of a person who has been deceased for more than fifty (50) years.
• education records covered by the Family Educational Rights and Privacy Act (FERPA); and
• employment records held by UNMC in its role as employer.

Workforce

Employees, medical staff, volunteers, trainees and other persons whose conduct, in the performance of work for Nebraska Medicine/UNMC, is under the direct control of Nebraska Medicine/UNMC, whether or not they are paid by Nebraska Medicine/UNMC.

Additional Information

• Contact the Privacy Office or at 402-559-5136.
• Contact Office of Information Security or 402-559-2545.
• Contact Public Safety; for Emergencies: 402-559-5555, 24 hours per day; for Dispatch: 402-559-5111, 24 hours per day
• Risk (consult Web On Call or the hospital operator to reach on-call Risk staff)
• General Counsel’s Office (Hospital or University??)
• UNMC Policy No. 6045, Privacy, Confidentiality and Security of Patient and Proprietary Information
• UNMC Policy No. 6051, Computer Use/Electronic Information
• UNMC Policy No. 6057, Use and Disclosure of Protected Health Information
• UNMC Policy No. 6303, Disclosures of PHI as Permitted or Required by Law
• Procedure for UNMC Policies No. 6051 and 6057, Electronic Communication of Protected Health Information
• a Law Enforcement Investigative Demand form, CON-MR-220 need link to form
• Nebraska Medicine Consents and Permits policy, MS14.
• Nebraska Medicine Private Designation policy, RI 15,
• Nebraska Medicine Reporting Abuse, Neglect or Injury policy, PE 03;
• Nebraska Medicine Legal Status Holds policy, LD-12
• Nebraska Medicine Legal Blood Alcohol Testing policy, ESD 06.005
• Nebraska Medicine Legal Drug/Alcohol Testing policy, PC18
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)

This page maintained by dkp.