Like a scene out of Law & Order, imagine you have detectives in your office waving around their badges, telling you and your staff they are investigating “something” and need information on one or more of your patients.
First, don’t panic. Time is critical, and this article is designed to outline the steps you and your staff need to take if faced with this challenging scenario.
Under certain and limited circumstances, law enforcement and other agencies may access protected health information (PHI) without express patient authorization. For example, medical records may be obtained in a criminal investigation pursuant to a valid search warrant (Civil Code §56.10(b)(6)).
The requestor has a duty to provide appropriate credentials and indicate what authority they have to obtain information. Once the requestor’s credentials and authority are confirmed as legitimate, it is your office’s responsibility to release your patient’s health information in compliance with what is specifically requested, nothing more or less.¹ Your office personnel must understand that they are required to follow patient confidentiality rules and regulations when law enforcement personnel or a government representative requests your patient’s protected health information (PHI). In this instance it is crucial to adhere to the “minimum necessary” rules established by HIPAA.²
Depending on the urgency of the situation, when the requestor is from an investigative branch of government (Social Services, school district, health Inspector), your office may request a fax, on official letterhead, from the investigating department to include 1) the information requested is relevant, specific, and limited in scope and, 2) under what code or regulation you may release your patient’s information to the individual(s) on site in your office.3
If the representative is requesting information beyond the scope of the authorization provided, your office must inform the requestor that a search warrant or court order is necessary for the information they are seeking.4 Certain laws require additional specific authorization to protect the medical record of the diagnosis and/or treatment of the following patient conditions: minors, HIV, psychiatric/mental health conditions, and alcohol/substance abuse.5
Search Warrants
When a search warrant is served, this indicates that two conditions were met for a judge to sign off on approving the search warrant:
- A misdemeanor or felony has been committed.
- Evidence related to a criminal case is likely to be found in the location described in the search warrant.¹
Search warrants may have two different paths:4
• The physician is not a suspect. In this instance, medical records may be released only to a “special master” rather than to a police officer. A special master is an attorney who is a member in good standing of the State Bar of California and who has been selected by the court from a list maintained by the State Bar. (“California Penal Code § 1524 (2021) - Justia Law”)
The special master must accompany the person serving the warrant and must inform the physician, upon whom the warrant is being served, of the specific items being sought and that the physician being served will have an opportunity to produce the items requested. If the physician being served states that certain items should not be disclosed, those items must be sealed by the special master and taken to court for a hearing. (“California Penal Code § 1524 (2022) - Justia Law”). The physician must be informed of the date, time, and place of the hearing, which ordinarily must be held within three days.
• The physician is a suspect - Law enforcement officers may, pursuant to a valid search warrant, conduct a search of the office. (Penal Code §1524). The office should ask law enforcement to produce the warrant for inspection. When your office is presented with a valid search warrant, let the officers know you are contacting your personal attorney and ask if they can wait until your attorney is present to start the investigative process.
Having your attorney in your office as the search takes place is ideal but if that is not possible, contact your personal attorney for direction and stay on the phone with them telling them in detail what is being searched and seized and document everything.4
Key steps to execute in the event of an investigation on the premises:
- Do not interfere with the investigation
- Inform staff that they are not required to make statements to investigators
- Close the office and send non-essential employees home
It is in your office and patients’ best interest that a seizure log is created as patients’ original records and the office electronic health record system may be seized during the processing of the search warrant. Request that medical records are segregated and sealed and document that you made that request in the seizure log.¹
Request the prosecuting attorney’s business card as seized patient records may be needed to treat active patients, which will require your office to contact the prosecutor’s office to make arrangements to copy records so that you may continue to practice. Bear in mind that the prosecutor’s office may charge your office to copy requested records.4
In summary, when law enforcement comes to a physician’s office requesting records, it is important to handle the situation professionally and in accordance with the law. Here are the steps to consider:
- Confirm identity and authority of inquiring party: Request to see valid authorization and identification from requestor. Review warrant or subpoena for validity and scope of patient information requested.
- Call your attorney: Immediately contact your attorney for direction and guidance in responding to search warrant.
- Protect patient’s health information: Prevent tampering or unauthorized access to your patient’s health information. As you comply with legal obligations maintain the integrity of your patient’s health information.
- Log request into disclosure log: Log search into disclosure log. Keep a detailed record of the law enforcement agency, the officers’ names, badge numbers, and the purpose of their request. Note the date, time, and any other relevant information about the interaction.
- Disclose patient information that is minimally necessary: Release records that are specified in warrant or subpoena. Do not share any more information than what is stated is subpoena. HIPAA regulations still apply as privacy and confidentiality must be protected.
- Patient notification (if required): Consult with an attorney whether patient notification is required.
- Accommodate law enforcement request: Compliance with an authorized request from a law enforcement agency should be done in collaboration with your attorney to ensure patient privacy and confidentiality is held within the confines of the law and HIPAA.
Remember, each situation may vary, and it is essential to consult legal counsel to navigate through the process appropriately.
Once the urgency of the search is over, contact CAP at 800-252-0555 and request to speak with the Risk Management Department to report the incident.
Maryland Nua is a Risk Management and Patient Safety Specialist. Questions or comments related to this article should be directed to MNua@CAPphysicians.com.
References
¹Greg Freeman, Relias Media, Healthcare Risk Management, With Law Enforcement, Be Courteous but Follow HIPAA Rule (July 1, 2023)
https://www.reliasmedia.com/articles/with-law-enforcement-be-courteous-…
²U.S Department of Health & Human Services, U.S Department of Health & Human Service’s Office for Civil Rights HIPAA, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: A Guide for Law Enforcement https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding…
³U.S Department of Health and Human Services, United States Government, Health Information Privacy, Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524 Request for Access https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/ind…
4California Medical Association Legal Affairs, California Physician Legal Handbook, Requests by Law Enforcement/Search Warrants, Document #4203, January 2022
pg. 1, 2 CPLH.org
5CAP Risk Management, CAPPhysicians.com, Cooperative of American Physicians, Patient Record Requests: What Is Proper Release Protocol? (12/2019)
https://www.capphysicians.com/articles/patient-record-requests-what-pro…