Law Enforcement Asks for a Patient's PHI: What Do You Do? Have a Process, Speaker Recommends

​When law enforcement officers ask for the protected health information (PHI) of a patient, "the patient still has privacy rights, even if they've committed a crime," emphasized Rebecca Carlson, general counsel assistant, system legal affairs, SSM Health, speaking April 27, 2018, at the spring conference of the Wisconsin Society for Healthcare Risk Management. It's important to thoroughly train healthcare workers on both HIPAA (the Health Insurance Portability and Accountability Act) and state laws, Carlson said, particularly because some workers may have practiced in other states. Even with training, however, various exceptions under HIPAA or state laws allow the sharing of PHI, and states typically mandate or permit reporting in certain circumstances, though it can be tricky to determine whether and when each exception, mandate, or permission applies. Therefore, Carlson recommended that organizations have a process for considering and responding to law enforcement requests for PHI. For example, organizations could develop a standardized form and ask law enforcement to submit requests in writing using the form. This can help make sure that law enforcement knows what the healthcare organization wants and vice versa. The form would also serve as documentation, which could come in handy if, for example, it is later discovered that the officer sought the information for personal reasons. "It's reasonable to tell law enforcement that you want that in writing," said Carlson. Staff should also feel comfortable taking time to consult legal affairs or risk management and telling law enforcement that they will get back to the officer with an answer.