What you CAN say: An explanation of privacy laws

CHRIS THOMAS: Hello, Welcome to The Center Collaborative: Creative Solutions in Behavioral Health and Criminal Justice, produced by the Oregon Center on Behavioral Health and Justice Integration, a division within Greater Oregon Behavioral Health, Inc. I am your host, Chris Thomas. We have a special episode for you today, a radio play about privacy laws (that is HIPAA and CFR 42, part 2) titled “What you CAN say: an explanation of privacy laws”.  It is intended for healthcare professionals, first responders, and others who are interested in this topic.

 

The radio play uses realistic examples to demonstrate what you can say, not just what you can’t say, in various situations. Please note that these situations concern potentially sensitive topics in mental health crisis response.

 

The Center collaborated with GOBHI employees while drafting the script and during production. We are excited to provide a tool that helps make privacy laws understandable, accessible, and hopefully, somewhat entertaining.  You can find a link to the transcript in the show notes or on the website. 

 

None of the characters in our narrative vignettes are based on real people or events—any similarity to actual people, living or dead, or actual events, is purely by chance.

 

NARRATOR: I am your narrator and your guide throughout the play and will be setting the stage for you during this episode. As we begin, we are joined by a lawyer specializing in privacy laws and a legalese translator to help make sense of what the lawyer is talking about.  

 

LAWYER: I’m Avery Morgan, Attorney at Law. If you work in behavioral health or law enforcement, you’ve heard about privacy laws involving patient health information. These laws are sometimes perceived as closed doors. Obstacles “explained” in legalese where sometimes it’s just easier to focus on what you can’t say.  

But what if we told you there’s important language dictating what health care providers ARE able to share in a professional capacity and that this radio play will provide you with the required legal language that you are used to seeing along with regular language explanations that don’t require a law degree to understand? 

 

LEGALESE TRANSLATOR (PST): Hello! That’s my job! I’ll translate the legalese and help you see where you CAN provide information and what your limits are. 

 

LAWYER: Of course health care providers can share anything that a patient has authorized them to share. However, let’s discuss the circumstances under which health care providers are permitted to share individually identifiable health information, also known as protected health information, or PHI for short, to law enforcement WITHOUT the individual’s authorization.

You are all familiar with the

• Health Insurance Portability and Accountability Act of 1996 (HIPAA) https://www.congress.gov/bill/104th-congress/house-bill/3103

  • The Federal regulation governing the disclosure of behavioral health, physical health, and dental health information. 

• and 42 Code of Federal Regulations (“CFR”) Part 2. 

https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2

• The Federal regulation governing the disclosure of information regarding clients of Federally assisted alcohol and drug treatment programs. You might also hear the terms substance use disorder treatment or SUD treatment - it all refers to the same thing. We are going to call it Part 2 for the rest of this radio play.

PST: Yes, I’m familiar with them both, but I usually fall back on not saying anything because I’m scared I’ll break the rules. It leaves me wondering if I can say anything or even acknowledge I know who the person is without a signed release of information.

 

LAWYER: You can talk about observable behaviors and information that both law enforcement and healthcare professionals are privy to. For example, if a Behavioral Health staff member and a Law Enforcement Officer respond to a crisis call, the Behavioral Health worker can talk about what they both see and are told while working together with an individual and then give recommendations for follow-up based upon those observations. “The individual is pacing and talking with a pressured and rapid speech. He is not wearing clothing appropriate for the weather conditions.  He appears to be talking to himself, or someone that I cannot see.” 

 

PST: Generally, diagnosis and meds aren’t the kind of information that law enforcement are looking for anyway – they are more concerned about the individual’s behavior and making sure that the person gets the help they need without the situation escalating or leading to a return call. It’s important to use everyday language and not psychological jargon to tell dispatch or officers information. Doing this helps to avoid escalating the situation. For example, you wouldn’t say this person has mutism, photophobia, and auditory sensitivity due to Autism Spectrum Disorder. You would say “it could escalate the situation if you respond with lights and sirens going. They will likely stay calmer if you use a calm voice and short directives. They might take some time to process and won’t respond to what you ask the first time. They are not noncompliant, it just takes a little bit. Be patient with them. Also, they won’t likely speak to you when you ask them a question.”

 

LAWYER: Exactly! Also, there is a low risk of liability for violating the privacy rule if the Behavioral Health professional discusses information that they are privy to outside the confines of protected health information, as long you haven’t heard it or read it within a clinical setting. 

 

PST: Oh, like “My son works at the grocery store and this individual comes in with cans that he collects from the side of the road. He often is talking to himself and making strange body movements” OR “‘My Aunt heard from her Sister at the salon that her brother takes Adderall!’ That type of thing.

 

LAWYER: Correct. Another important point to keep in mind:

 

• Law Enforcement is NOT constrained by HIPAA or Part 2, so they can say anything they like. Behavioral Health workers may listen to anything Law Enforcement has to say about a case and use that to inform Behavioral Health’s recommendations to Law Enforcement. https://www.samhsa.gov/about-us/who-we-are/laws-regulations/confidentiality-regulations-faqs

• Here are a couple of examples.

  • An officer calls a behavioral health program and speaks to a crisis worker.  The officer is able to tell the crisis worker all of the details of the call, for example, why they were called to the scene, how the person is behaving, what they are saying, what witnesses are reporting, or family is reporting regarding medication, treatment, and/or diagnosis.

  • The officer is also able to openly communicate with the individual in crisis. If the officer asks questions of the person in reference to their diagnosis, medications, treatment plan, etc. it opens the door for the behavioral health provider to speak about those issues far more freely, since the information was provided outside a protected conversation. Keep in mind, however, the person in crisis is not required to answer the officer’s questions.  

 

PST: That makes sense, but what if the law enforcement officer or behavioral health worker believes that the individual in crisis represents a serious and imminent threat to the health or safety of themselves or others?

 

LAWYER: While HIPAA permits a health care provider to disclose the minimum necessary information…https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html

 

PST: Minimum necessary information is lawyer speak for not telling the other person everything — you know, the life story and behavioral file — just the information that is needed to accomplish the goal of the immediate situation. 

 

We are looking for the happy medium for divulging information - not too little and not too much - just enough. So, going back to the Autism Spectrum Disorder example we gave earlier, a clinician would NOT want to tell law enforcement that they can’t discuss the person or the situation at all NOR would they want to go into a long clinician explanation with the person’s diagnosis, medications, jargon, and life story. 

• The clinician would want to stick to describing observable behaviors and what law enforcement needs to know to avoid

  • For example, using lights and sirens could escalate the situation and overstimulation could possibly lead to self harm or aggressive behavior. It could also result in them trying to seek safety by removing themselves from the situation. 

• Saying what might help the client de-escalate is also helpful, 

  • Which could include using a calm voice and short directives. Giving the person time to process. 

  • If it is safe to let the person rock back and forth while they are interacting with you, let them do it - it is a way that they cope with overstimulation. 

 

LAWYER: Correct. As I was saying, while HIPAA permits a health care provider to disclose the minimum necessary information to law enforcement to prevent or lessen a serious and imminent threat to the health or safety to themselves or others, Part 2 does not permit the disclosure of confidential information to the police or other non-medical personnel, including family members. Appropriate disclosures may, however, be made to medical personnel when requested during the immediate response to a bona fide medical emergency, or requested as part of ongoing treatment related to that medical emergency permitted under 45 CFR 164.512 https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-public-health-activities/index.html. 

 

PST: Wait, what? I thought this was about what we can talk about? When do federal confidentiality laws allow health care providers to disclose protected health information to law enforcement officials?  

 

LAWYER: Well, did you know the information you can divulge is based upon which law applies?

 

HIPAA prohibits the behavioral health worker from sharing any protected health information which he or she is aware of as a consequence of an individual receiving treatment in a community behavioral health program, with certain exceptions which will be covered during this radio play. Since the restrictions on the disclosure of drug and alcohol treatment information under Part 2 are much more stringent than those under HIPAA, if a healthcare worker does not know which source the individual’s protected health information came from, the stricter standards should generally be followed.

 

For a complete understanding of the conditions and requirements for disclosures under both statutes, please review the exact regulatory text at the citations provided at the end of this radio play. And if necessary, seek legal counsel.

 

PST: So, an easy way to remember which law applies is how I got the information. If I got the information through a mental health service, or in this case through a disclosure from the individual to a law enforcement official, only HIPAA applies. If I got the information through a federally assisted substance treatment service, which includes most alcohol and drug treatment providers, or the information communicated to the law enforcement official relates to alcohol and drug treatment Part 2 applies as well. So basically, as a behavioral health professional, I have to keep in mind the source and context of the information I have received as to, whether it is protected or not, and which rule applies. In this case because the information came through a conversation with law enforcement and is not protected health information, the behavioral health worker is then able to communicate that information to other medical providers for the purpose of treatment as long as it's limited to only pertinent information related to the current medical need or follow up. Is that right? 

 

LAWYER: Correct. 

 

PST: But there are laws around what I can talk about, right?

 

LAWYER: Indeed and that is what we are talking about for the rest of the radio play.

Here are some scenarios taking place in settings that involve the disclosure of a patient’s protected health information. Because the patients in these scenarios are not presenting to a federally assisted drug and alcohol treatment program, their health information is protected under HIPAA and is not subject to the Part 2 restrictions. We will talk about the differences when Part 2 applies.  

 

NARRATOR: Additionally, the scenarios are written for brevity and clarity - they do not necessarily represent how a conversation would occur in the real world.

 

PST: So, in actuality, a person would have to ask more questions and have a longer conversation than what we are presenting today?

 

NARRATOR: Correct. We will have an example scenario at the end that demonstrates a conversation that is more representative of what one would experience in the real world. 

In the first scenario, we will be talking about Gunshot wounds, stabbings, and certain other physical injuries covered in 45 CFR 164.512 (f)(1)(i). https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

LAWYER: A covered entity may disclose protected health information as required by law, including laws that require the reporting of certain types of wounds or other physical injuries.  

   

PST: For example, let’s say a patient admits to the hospital with injuries from gunshot wounds, stab wounds, or injuries consistent with criminal activity.

 

NARRATOR: A patient stumbles up to the front desk of a hospital clutching his chest. The Emergency Room Provider greets him.

 

ED PROVIDER: Sir, what’s wrong?

 

JOHNNY SMITH: I’ve been stabbed! Can you help me out?

 

ED PROVIDER: Right away! 

​

NARRATOR: The clinic staff rush the man past the counter and through a hallway.

A moment later… 

The Emergency Room Provider picks up the phone to make a report.

Later that day…

A POLICE OFFICER enters the hospital and walks up to the same Emergency Room Provider 

 

OFFICER JONES: Good evening. I’m Officer Jones. We were dispatched to a call about an altercation in the alleyway outside and dispatch received your report. The caller told dispatch that there was some type of fight and that one of the people involved was observed bleeding and running to your ED. Can you tell us anything about this guy? 

 

NARRATOR: This seems a good point to freeze action and have our resident lawyer and legalese translator weigh in. When you hear the freeze action sound, it means that we are freezing the action for a lawyer/legalese translator consult. 

 

LAWYER: According to Oregon State law ORS 146.750, hospitals are required to report to local law enforcement when hospital staff have reasonable cause to believe they are providing treatment for an injury caused by other than accidental means. 

 

PST: For example, if a broken arm can be reasonably explained by a motorcycle accident, the hospital does not need to report to law enforcement. However, if the broken arm appears to be the result of an assault or does not match the explanation provided, the hospital is required to report.  

 

LAWYER: Oregon law does not specify what information is to be released to authorities, however it does state an oral report needs to be made immediately, by telephone or otherwise, followed as soon as possible, by a written report.

In these cases, Emergency Departments are required by law to report to law enforcement the reason for admission, type of injury, and patient identification. The information is specific and limited in scope to the extent that is reasonable in light of the purpose for which the information is sought. Only information regarding the wound is shared without a release of information. Substance use is not covered and blood test results need a subpoena before they can be released, except for as provided at the end of this radio play.

 

PST: So what CAN the clinician tell law enforcement?

 

NARRATOR: We are about to resume action and see how the ED provider responds. In the future when you hear ____ it means that we are going back to the vignette. 

 

ED PROVIDER: I can confirm that at 2:43 am we admitted a male patient for treatment of a stab wound. His name is Johnny Smith. Because of privacy laws, without a release of information signed by the patient, I have to stick with just those basics. You are welcome to talk to him. I can walk you back to his unit. 

 

NARRATOR:  Let’s move onto a scene involving 45 CFR 164.512 (f)(2): Identification and location purposes. But first, let’s hear an explanation from our lawyer. https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

LAWYER: A covered entity may disclose protected health information in response to a law enforcement official’s request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person. 

 

NARRATOR: An OFFICER enters a clinic and approaches the administration desk. 

 

OFFICER JONES: Good morning. I’m Officer Jones. I just saw a tall, blond guy walk into this building. He is suspected of robbing the snack bar yesterday. 

​

ADMIN: How can I help you?

 

OFFICER JONES: Can you tell me who he is and where he went so I can speak to him about the robbery?

 

LAWYER: Information can only be released if the Law Enforcement Officer verifies a person was suspected of being involved in a crime (either as subject or victim) and that the Law Enforcement Officer needs to talk to that person regarding that incident.  

HIPAA would permit the provider to release to law enforcement information to identify or locate an individual. However, only Protected Health Information that helps to identify a person may be released. 

 

PST: The staff member may only disclose the following identifying information: name, address, date and place of birth, social security number, ABO blood type and Rh factor, type of injury, date and time of treatment, date and time of death, if applicable and a description of distinguishing physical characteristics.  There is no need to disclose any medical information unless an injury resulted from the incident that the officer is investigating.

 

ADMIN: Because you have confirmed that this guy is involved in a current criminal investigation, I can provide you with some basic information that would be needed to identify this person. His name is Johnny Smith, and he lives at 1234 NW Main Street. His birthday is April 27th, 1986. He is 6’2” and 190 lbs. You already know he has blond hair. That’s what I have at this time. Without a signed release of information from the patient, I can’t disclose any further information. 

 

OFFICER JONES: Okay, got it. Thank you for your help.

 

NARRATOR: Next we explore  45 CFR 164.512 (j)(1)(i):  Averting Harm, but first a word from our consultants.  https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

LAWYER: Permitted disclosures: A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of the person or the public and is necessary for law enforcement authorities to identify or apprehend an individual.  

The health provider’s duty to warn generally is derived from and defined by standards of ethical conduct and state laws. HIPAA permits a health care provider to require notification of a patient’s family members of a serious and imminent threat to the health or safety of the patient or others if HIPAA would permit the provider to warn the appropriate person(s) of the threat, consistent with his or her professional ethical obligations and state law requirements. 

For example, in Oregon, when in the professional judgment of a healthcare provider, there is a clear and immediate danger to others or to society, the health care professional MAY share information obtained during the course of diagnosis, evaluation, and even treatment to law enforcement. However, they DO NOT have to share the information with law enforcement, or anyone else, and cannot be held liable if they do not. If we were talking about California, it would be a whole different kettle of fish. 

It is important to remember that this standard differs between states, so make sure you know yours. Oregon and California, for instance, are NOT THE SAME. 

In addition, even where danger is not imminent, HIPAA permits a covered provider to communicate with a patient’s family members, or others involved in the patient’s care, to be on watch or ensure compliance with medication regimens, as long the patient has been provided an opportunity to agree or object to the disclosure and no objection has been made.

 

PST: So, a health provider can call family members when they believe a person is likely to seriously hurt themselves or someone else in the near future. They can also communicate with family members about concerns regarding if a person is taking their meds, attending treatment, etc., as long as the person in treatment has had an opportunity to prevent the information from being shared, and did not choose to do so.  

 

NARRATOR: This scenario takes place in an outpatient clinic other than a drug and alcohol treatment program.

 

OFFICER JONES: Hi, I’m Officer Jones. I received a call from dispatch that there was some type of threat made by a patient here at your office.

 

JAMIE: I believe that I have an ethical obligation to tell you my patient has threatened to hurt someone. I think that there was and still is an immediate threat and that’s why we called you here. My patient Johnny Smith stated that he believes that his girlfriend is cheating on him with Matthew Jones and that he is going to “hurt him real good.” My past interactions with Mr. Smith led me to believe that he would be capable of doing bodily harm to Mr. Jones, and I realized that it was important to report his threats to protect Mr. Jones. 

 

OFFICER JONES: Can you tell me more?

 

JAMIE: Yes, we can go into that because HIPAA allows it. I have his full name, address, phone number and place of employment. I am very worried for both Mr. Smith and Mr. Jones. Thank you, officer. 

 

LAWYER: Part 2 regulations do not permit a disclosure to avoid a serious and imminent threat to health and safety. If program staff believe that there is clear and imminent danger to a particular person, it is wise to consult with counsel about next steps, especially if there is any ambiguity about where the information came from. 

 

PST: So, if Part 2 applies or might apply and I am very concerned about an immediate danger, then I should consult with counsel and supervisor. 

 

LAWYER: Correct.

 

NARRATOR: Here’s a scenario involving a behavioral health worker and law enforcement along the same theme. 

 

CLINICIAN: Hello, 9-1-1? Yes, I’m calling about a client. We have an escalating domestic violence situation going on. I had an appointment with one of my clients this afternoon and I shared with her that I would be making this call for her safety. She presented with some bruising that does not match her description of how she got them. The bruise on her upper arm looked to me to have been caused by fingers, and she has a pretty swollen left eye. When I asked her about them, she stated that she ran into something and then fell. When I asked about things at home, she became scared and left before our counseling session was over. I believe that she has a live-in boyfriend. His name is Johnny Smith. She has spoken of him a few times, but I really don’t have any other information about him. Let me grab her chart and I can give you her full name, DOB, and address. Could you please have officers do a wellness check on her? I am very worried for her safety. Thank you. 

 

LAWYER: The Health Care Provider may call and report the crime to local law enforcement if they believe that the victim continues to be at risk of further assault, neglect, or domestic violence.

 

NARRATOR: Moving onto 45 CFR 164.512(f)(3): Victim of a Crime https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

LAWYER: Before we begin, I want to explain that if law enforcement requests information about a person who is suspected of being a victim of a crime, a health care provider may disclose information if: (a) the individual agrees to the disclosure, 

Remember: an individual can always agree to a particular or more general disclosure—it often just involves asking them.

Or (b) if they are not able to obtain the individual’s agreement due to incapacity or other emergency circumstance, provided that the officer represents that the information is necessary to determine whether someone other than the victim has committed a crime. AND all of the following:

• the information will not be used against the victim,

• the information is needed immediately,

• the law enforcement activity would be adversely affected by waiting to obtain the victim's agreement,

• and the Provider determines it is in the victim's best interest to disclose the information.

 

NARRATOR: Here's another hospital emergency department scenario.

 

OFFICER JONES: Hello, I’m Officer Jones. I would like to talk to one of your patients. There was a report of an incident at their residence last evening and I’m worried for their safety. Your patient is not under investigation and anything that they may tell me will not be used as evidence against them. We believe this patient was the victim of domestic violence. If the patient is unavailable, I need this information now because the investigation could be compromised if we wait. 

 

 LAWYER: Information is limited to what the officer needs to know for his or her investigation.

 

ED PROVIDER: I can tell you if the patient is currently at our facility. If the patient is able to speak to you, we will escort you to them so you can chat with them. We can also take you back if you need to see injuries for prosecution purposes.  

If the patient is unable to consent due to incapacitation because of medical procedures or level of consciousness, we are able to provide information that is necessary for law enforcement authorities to further your investigation and to identify or apprehend the person who did this so others won’t get hurt.  

 

NARRATOR: What about if a Crime occurs on the premises, as covered in CFR 164.512 (f)(5)? https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

LAWYER: A covered entity may disclose to a law enforcement official protected health information that a covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.  

 

NARRATOR: A known client of the clinic storms into the front office and starts yelling at the receptionist. His manner is perceived as threatening, and others in the waiting room are scared. 

 

ADMIN: Please have a seat, and we’ll see you in a moment.

 

JOHNNY: No! I can’t wait any more. My appointment is at 3:00 and it is 3:00, I want to see my doctor now! It is my turn.  Who is with him now? Make them leave!  It is my time, who is back there? 

 

NARRATOR: The client tries to push past the receptionist station to go to the back room.

 

ADMIN: If you just stay calm—

 

NARRATOR: The client throws a chair across the room, barely missing another client, starts yelling and screaming at them to move out of his way, punches another client “in his way”, and storms out.  

 

ADMIN: What do I do now?

 

LAWYER: A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity, including the commission and nature of the crime; location of such crime or of the victim(s) and the identity, description, and location of the perpetrator of such crime, i.e. last known address, physical description, date of birth.

This would also be true if a client stole a piece of medical equipment during a check-up, or a therapist's laptop during a treatment session.

 

ADMIN: Hello, 9-1-1 dispatch? We just had a patient trash our lobby and hit another patient. His name is Johnny Smith, he lives at 1234 NW Main St. He is angry, has a history of assault, and I’m worried that he might hurt someone else.

Yes, I can describe him. He is 34 years old, with blond, longish hair. He is about 6 feet tall and wearing blue jeans, a white t-shirt and black shoes. He took off on foot traveling north from our office located at 118 East Harriman about two minutes ago.

 

NARRATOR: What about  CFR 164.512 (f)(6): Reporting crime away from the premises? https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

LAWYER: If, in the course of responding to an off-site medical or mental health emergency, health care provider personnel become aware of criminal activity, they may disclose certain information to law enforcement as necessary to alert law enforcement to the criminal activity, including information about the commission and nature of the crime, the location of the crime or any victims, and the identity, description, and location of the perpetrator of the crime.
 

PST: We just talked about if a crime occurs on the premises and the same holds true if a crime occurs off the premises. 

 

NARRATOR: We won’t belabor the point with another scenario and instead will move onto A Court order or court-ordered warrant, as outlined in CFR 164.512(f)(1)(ii)(A)-(B) https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

LAWYER: A covered entity may disclose protected health information to comply with a court order, a court ordered warrant, a subpoena, summons issued by a judicial officer, or a grand jury subpoena. The standards for disclosure are, however, not all the same.

​

NARRATOR: At a Behavioral Healthcare clinic, a CLINICIAN brings a letter to the admin. This admin takes the letter and reads it aloud. 

 

ADMIN: You have been served a court order … 

 

CLINICIAN: So what do we do from here? 

 

ADMIN: The order is signed by a judge, so we can give them just the information requested in the order. Don’t over comply by providing unrequested information. But the judge gets the information he or she formally requests. There’s no need to notify the individual whose information has been requested. It’s just like that grand jury subpoena we got last week. The grand jury process puts safeguards in place to ensure that the information will not be unnecessarily disclosed—so you don’t have to take any additional steps. Just make sure you are only providing what was asked for. However, if it was a subpoena merely signed by a lawyer that would be a different story.

 

LAWYER: In the event that a subpoena is only signed by a lawyer who is not acting as a judge, one of two things must also occur before the information is provided: 

First, the lawyer could timely notify the individual whose information is being requested, providing the individual with an opportunity to object to the disclosure of the individual’s information using legal process.

Second, the lawyer requesting the information could get a protective order from the court responsible for the legal proceeding to ensure that the information will not be used for purposes other than the proceeding.

The obligation is not on the covered entity; it is on the lawyer requesting it, so the covered entity needs evidence that the lawyer requesting the information has taken at least one of the aforementioned steps.

 

ADMIN: Hello. Yes, I am the custodian of records here at Acme Behavioral Healthcare. Oh you are an attorney representing someone who was injured in an accident. Got it. So the information you are requesting is not your client’s information. As I’m sure you are aware, in order for me to release those records, if we even have them, I’m going to need to see some proof that you have notified the individual whose records you are requesting, or a protective order issued by the court. Great. Please send the protective order to me at admin@abh.org, and I’ll get you the records if we have them.

 

PST: So, what this means is the lawyer either needs to notify the patient or the lawyer needs to get an order from the court requiring that the information is only going to be used for the court proceeding.

 

NARRATOR: On to 45 CFR 164.512(f)(1)(ii)(C): Administrative request or an administrative subpoena or investigative demand or other written request from a law enforcement official.  https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html

 

In the same clinic, the ADMIN brings another clinician their mail.

 

ADMIN: Here is your mail. That top one looks like it might be important. It looks like one of those administrative requests sent out by law enforcement or regulatory bodies from the state. Enjoy.

 

JAIME: It’s asking us to provide information on a patient, and it’s specific to a specific time frame, or incident and an ongoing investigation. I know there’s a privacy law saying what I can’t do. But what CAN I do?

 

LAWYER: Staff should only provide the information requested in the subpoena, and remove or black out information that is not needed or requested.  

Because an administrative request may be made without judicial involvement, the Rule requires that for all administrative requests, the information requested is relevant and material, specific and limited in scope, and that de-identified information would be insufficient for the needs of the investigation. If you can de-identify the information, do it!

 

PST: Keep in mind, if a person only uses whiteout or a marker to redact information, there are ways to remove the whiteout and/or marker to see the covered information. To avoid this, it’s a good idea to use whiteout or a marker and then make a photocopy of the page. Release the photocopy and shred the original.  

 

JAIME: Here’s the info they asked for. I am leaving out the girlfriend’s name who was also part of group therapy because she’s not part of the case. 

 

LAWYER: If the provider in the scenario above is a federally assisted drug and alcohol treatment provider, Part 2 requires that a court order for the disclosure of the client information must accompany the subpoena.

 

PST: So, under Part 2, a subpoena alone is not sufficient, a court order must accompany it. 

 

NARRATOR: This brings us to ORS 676.260: Healthcare Facility Notification of Blood Alcohol Level or Presence of Cannabis or Controlled Substance in Blood  https://oregon.public.law/statutes/ors_676.260

 

An Officer is dispatched to a medical facility to which the driver of a motor vehicle crash was transported.  The Officer is investigating the crash as a DUII crash. 

 

OFFICER JONES: Hi I’m Officer Jones. I’m here in reference to Johnny Smith who was just transported in by EMS. He was the driver involved in a motor vehicle crash. I believe the driver was operating under the influence of intoxicants. Can I see the results of his toxicology tests?

 

ED PROVIDER: According to state statute, I can release to you the patient’s name, the results of his blood alcohol content, blood cannabis content and/or the level of any controlled substance disclosed by the test. I can also release to you the date and time the test was administered. Any other information disclosed by tests will need a court order signed by a Judge or a release of information signed by the patient to allow release.  

 

NARRATOR: As we alluded to earlier, the previous scenarios were written to get as much information across as possible in a short amount of time. However, conversations rarely go that way in the real world. Thus, the following is an example of what real world conversations might look like and how to find the happy medium regarding information disclosure during a mobile crisis call.   

Officer Jones is dispatched to a call regarding an out of control pedestrian who is yelling at passing traffic and lurking behind bushes. While driving to the scene, the officer requested that a mobile crisis worker co-respond to the scene. 

Upon arriving at the scene, the officer observed a disheveled male yelling at the passing cars and waving his arms around. The officer has had previous interaction with this individual and knew his name to be Johnny Smith. A small crowd of people are gathered around watching him, which could potentially put him or the crowd members at harm or risk.

 

OFFICER JONES: Johnny, can you come over here and talk to me, please?

​

NARRATOR: Johnny runs up to Officer Jones and stops within a few feet of the officer, Johnny is bouncing on the balls of his feet and speaking rapidly and loudly. 

 

JOHNNY: Officer, you have to help me! They are trying to kill me!

 

OFFICER JONES: Johnny, slow down, I can’t understand you when you are talking so fast.

 

JOHNNY: You have to help me! They are coming for me! You have to help me! They are going to kill me! 

 

OFFICER JONES: Johnny, slow down and take a breath. You are talking too fast and I need to be able to understand you. I asked Jaime from the crisis team to join us. Are you ok with that?

 

JOHNNY: Why? We don’t need anyone! They will just lie about me and make you take me to the hospital, especially Jaime.

 

OFFICER JONES: “Johnny, I don’t think that Jaime wants to put you in the hospital against your will.  But I do think that Jaime would like to talk to you and see how to keep you and everyone safe. Will you talk to Jaime?”

 

NARRATOR: Johnny nods his head to show agreement. Jaime drives up. 

 

NARRATOR: Johnny agreed to talk with the behavioral health care worker in this case, however during previous incidents he would not agree to engagement. 

 

LAWYER: In accordance with Section 164.510(b)(3) of the HIPAA Privacy Rule if an individual has already been engaged in services through the behavioral health provider, informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual. This relates to a behavioral health worker with prior knowledge of the individual's diagnosis, medications, or services received. This would not apply to a behavioral health care worker without prior knowledge of the individual.  https://www.hhs.gov/hipaa/for-professionals/faq/491/may-a-doctor-disclose-information-to-a-person-that-can-notify-a-patients-family/index.html

 

PST: It sounds to me like if Johnny had said no, the fact that the behavioral healthcare worker had previously been a part of an organization serving him, they could use their best professional judgment to determine if this was a true emergency situation that the information they have could impact the situation, reduce the crisis, and improve the outcome for Johnny, as well as reduce the threat to public safety. If the healthcare worker had not previously served Johnny, and he said no to engagement, they would be best off using crisis prevention interventions aimed to reduce conflict, build rapport, and work toward getting Johnny to agree to engage. They could also continue to support law enforcement by providing information based on observations of Johnny's behavior and possible interventions unrelated to diagnosis or history. Is that correct?

 

LAWYER: That is correct.

 

OFFICER JONES: Johnny, let me talk to Jaime for just a moment, ok? Just stay here where I can see you, so I can make sure you are safe. I will be right back.

 

NARRATOR: Officer Jones walks over to Jaime’s car to talk about the situation. 

 

OFFICER JONES: Hi Jaime. Thank you for coming out. I received a call from dispatch of a male shouting at passing cars and lurking behind bushes. The caller was worried about him, so I had dispatch call you. I know Johnny Smith from some past contacts that I’ve had with him. I have told him that you are here to talk to him and he has agreed to talk with you. Since I got here, Johnny has been yelling that someone is after him and isn’t really making a lot of sense.

 

JAIME: Thank you Officer. I’ll go talk to him.

 

NARRATOR: Jaime and Officer Jones walk toward where Johnny is pacing. Johnny stops pacing and starts to walk in their direction. He is talking at a rapid pace and with a loud volume, making it difficult to understand exactly what he is saying.

 

JAIME: Hi Johnny. My name is Jaime, and I work on the mobile crisis team. Will you talk to me for a few moments? 

 

JOHNNY: Jaime, yeah I know you. I’ve tried to tell you that someone is after me. You guys just want to hospitalize me and not help me, so you don’t have to deal with me anymore.

 

NARRATOR: Johnny clenches his fists and grinds jaw as he steps forward. He starts to walk up to Jaime, closing the distance and stops just a few feet from Jaime.

 

OFFICER JONES: Johnny, I need you to step back.

 

JAIME: He won’t hurt me, Officer, it's fine.

 

NARRATOR: Jaime remains standing in place with Johnny within arm’s reach. 

 

OFFICER JONES: Johnny, step back!

 

NARRATOR: Johnny reaches towards Jaime. 

 

OFFICER JONES: Jaime, I need you to return to your car.

 

NARRATOR: Jaime does not retreat to the car and continues to remain standing.

 

JAIME: I know Johnny, he won’t hurt me. 

 

NARRATOR: Johnny closes the gap and yells in Jaime’s face.

 

JOHNNY: You guys aren’t listening to me and don’t even care!

 

NARRATOR: Officer Jones quickly steps between Jaime and Johnny

 

OFFICER JONES: Jaime, I need you to get back into your car NOW!

 

NARRATOR: Jaime steps back and re-enters the car. Johnny attempts to follow.  

 

OFFICER JONES: Johnny, STOP! Stop right there! Johnny, I’m going to secure you for safety reasons. You are not under arrest, but I’m going to pat you down for weapons. You said that you didn’t have any, but I just need to be sure that we’re all safe.

 

NARRATOR: Officer Jones pats Johnny down. After finding no weapons, she asks Johnny to sit in the back of the patrol car.  

 

OFFICER JONES: Jaime, you can talk to Johnny now. But I need you to understand, in the future when I ask you to do something, I need you to act quickly. It is for your safety, as well as Johnny’s, that I asked you to return to your car. Johnny wasn’t excited about talking to you initially; he said that you would tell lies about him and try to force him to go to the hospital. I had to talk him into talking with you.

 

JAIME: What? Don’t you think that you should have told me that sooner? He has always been fine with me, but there are some of the other staff that he just plain doesn’t like and can get pretty abusive – all verbal – but still I think you should have told me.

 

OFFICER JONES: I’m sorry, you are right. I probably should have told you that when you got here. 

 

JAIME: Thanks, and I know you are just trying to keep everyone safe.

 

OFFICER JONES: Thanks for that - let’s get back to business. Johnny is secured in the back of my car.  He is not under arrest, but, per policy, he needs to be secured. The window is down to allow for the two of you to talk. I’ll wait by the front of my car while you do your assessment. 

​

NARRATOR: Jaime approaches the patrol car and begins to talk with Johnny. Johnny continues to talk in a loud volume with a rapid pace. The conversation continues for a few moments, Jaime concludes the assessment to consult with officer jones.

 

OFFICER JONES: So who’s going to put a hold on this guy? Are you going to put a director’s hold on him? I can transport him to the hospital and we can get him out of here.

 

JAIME: Director’s holds are hard to place.

 

OFFICER JONES: What do you mean that they are “hard”? Police Officer Custody needs the person to be at imminent risk of harm to self or others, and he meets that.. But, if I put a hold on him, he will likely be released from the hospital within hours. If you aren’t going to do anything, then why did I even call you? 

 

JAIME: He just doesn’t meet the director’s hold criteria. He was aggressive, but not enough so that he reaches the level of dangerousness required for a hold. He isn’t presenting as a danger to himself; he has eaten today, has food available, and is able to meet his basic needs.

 

OFFICER JONES: Look, even though you aren’t going to hospitalize him, he is causing quite a scene which could cause multiple calls to dispatch. I don’t want to have to keep coming out here and we know I’m going to keep getting calls after he is released on my hold. Do you have any information on his family or friends that we can contact, so we can find another solution?

 

JAIME: Due to HIPAA regulations, I’m not able to discuss this with you.

 

OFFICER JONES: Actually, due to the crisis nature of this call, HIPAA doesn’t apply.

 

JAIME: I don’t want to get sued or lose my job.

 

OFFICER JONES: Look, I don’t need his diagnosis or a list of his medications. All I want to know is how to get him out of here and someplace safe, so I don’t keep getting called out. It is not a crime to be in crisis and this really should not be a police problem. But, here we are, so what are we going to do with this guy? Do you know of any family members or friends that you can contact? We need to come up with a plan of action.

 

JAIME: I guess you are right. I remember something about how HIPAA has an exception that permits a health care provider to disclose the minimum necessary information to law enforcement to prevent or lessen a serious and imminent threat to the health or safety to themselves or others, but “minimal necessary” information only. Ok, Johnny has family………. 

 

LAWYER: Because this is an active crisis situation, Jaime is able to discuss with Officer Jones the relevant treatment history, emergency contact information, and a previously determined safety plan put in place to help keep Johnny out of the hospital.

As a final note, Federal law takes priority over conflicting state law. The way HIPAA is structured, it is the floor, rather than the ceiling for privacy protection. Additionally, HIPAA is often deferential to state standards, which, if they are different, are often more stringent.

 

PST: In other words … state law can be more stringent than or the same level as Federal law, but it cannot be more lax than Federal law. 

 

LAWYER: For a full version of these privacy laws — HIPAA and Part 2 — please check out the show notes on the OCBHJI website at ocbhji.org. Keep in mind this radio play should not be interpreted as official legal advice in any specific investigation or case. It’s a set of guidelines to help you frame your understanding of the law. 

https://www.asam.org/resources/publications/magazine/read/article/2013/08/15/confused-by-confidentiality-a-primer-on-42-cfr-part-2

 

NARRATOR: That concludes our “What I CAN say” scenarios. 

We hope this toolkit prompts further conversations about cooperation between behavioral health and law enforcement. The idea is everyone working together and that we want to have the conversation, but sometimes we have to take extra steps, like ROIs, to share more information. 

Thanks for listening — and for all you do serving our communities to ensure public health and safety.

 

We acknowledge that all people regardless of sex, gender, sexual orientation, race, and ethnicity can be both the perpetrators and victims of criminal behavior. The portrayal of the characters in the interpersonal violence scenario reflects the gender dynamic that is observed most often in the statistical sense, however we do not intend to minimize the impact of violence within any other relationship.  

 

Thank you for joining us for our radio play. Special thanks to the staff who helped create and vet the script, as well as those who volunteered their voices! 

 

In order of appearance:

Aylee Allen Rhea - Narrator

Lindsay Gordon - Lawyer

Chris Thomas - Legalese Translator

Lyndsey Ketchum-Harkless - ED Provider

Sam Shea - Johnny Smith

Chris Barnes - Officer Jones

Rod Harwood - Admin

Kris Boler - Jaime

Jacque Serrano - Clinician

 

Special thanks to Patrick Kennedy for audio production and Patrick Mulvihill for composing and recording music.