Police find HIPAA privacy law an obstacle

March 16--The police have an arrest warrant for a man and have credible information that he is in a health care facility.

Officers present the warrant at the facility, but they are told by staff that because of HIPAA they cannot confirm if the individual is there. The most the staff will do is try to talk that person into turning himself in -- if he is in the facility.

The Health Insurance Portability and Accountability Act, commonly called by its acronym HIPAA, is meant to protect an individual's privacy when it comes to their health care and medical background.

But for law enforcement, HIPAA can be an obstacle.

"It's the law of unintended consequences," Beaver County District Attorney Anthony Berosh said. He said HIPAA has become sort of a catchall excuse to withhold information.

Berosh said he's even run into instances where companies that don't fall under HIPAA have cited it as a reason to not supply investigators with information. He said once an employer told police they couldn't confirm if a person worked for them or had reported to work that day because of HIPAA.

Rochester Police Chief Frank Mercier said his department runs into issues with HIPAA on a frequent basis.

Mercier gave an example in which officers responded to an accident on Route 65, and a victim was taken to a Pittsburgh hospital with what were feared to be life-threatening injuries. He said when the officers called the hospital for the man's condition, the staff refused to tell them anything, which left the officers unsure of what charges to file.

In those types of cases, police can make a written administrative request for specific, limited information.

Mercier said even when police make the written request at some facilities "it's still a struggle to get information." He said it also takes an officer off the street to drive to the hospital and wait while they try to get the necessary information.

Berosh said in his experience Heritage Valley Beaver hospital has a good working relationship with the police to provide the information they are allowed by law to provide, but other facilities have been problematic. Berosh declined to name any specific facilities.

The U.S. Department of Health and Human Services issued something known as a "blue card" for law enforcement that outlines the basic HIPAA guidelines. The blue card also says when HIPAA-covered facilities may disclose personal health information to the police. Some of those instances include: to prevent or lessen a serious and imminent threat to the health and safety of an individual or public, to report evidence of a crime on the premises of a covered entity or to comply with a court order or court-ordered warrant, a subpoena or summons.

The law requires medical facilities to report to police if someone is treated for a gunshot or stab wound, but the way the law reads the use of the words "may disclose" leave the discretion to the facility.

Berosh said the last time police had a bench warrant for an individual who was in a facility, the charge was not a major felony, and the staff was able to talk him into turning himself in. But, if the charge had been for something very serious, like homicide, Berosh said he was prepared to tell officers to go door to door through the facility to find the individual, if necessary.

"HIPAA was not meant to create a sanctuary," Berosh said.

Berosh said that in his opinion, there is no discretion on the part of the facility if there is a court order or a court-ordered warrant. He said the police still have the use of criminal laws such as obstruction of justice and hindering apprehension.

"I'm not in the business of making threats. I understand the facility has a job to do, and we want to respect privacy. But, we have to protect the public," Berosh said.

Berosh said the policy some facilities have to tell the individual the police are there with a warrant could create a danger to the staff and other residents or patients, such as creating a hostage situation.

"Why would you want to assume that responsibility?" Berosh asked. "There is an inherent risk to the general public and people in the facility. Why do they want to assume the responsibility of that risk?"

Berosh said he is planning to organize an informational meeting with local health care providers and facilities to talk about HIPAA.

"We know what we can't have. If an officer asks for something he shouldn't have, they should tell him no. That I agree with," Berosh said, but citing HIPAA and denying requests has become standard practice.

"It's easier to say no to everybody than to have to figure out when you have to say yes to somebody," Berosh said.

A spokeswoman from Gateway Rehabilitation Center in Center Township said no one from the facility was available to comment on their policy, and a call to a spokeswoman at UPMC in Pittsburgh was not returned.

___

(c)2014 the Beaver County Times (Beaver, Pa.)

Visit the Beaver County Times (Beaver, Pa.) at www.timesonline.com

Distributed by MCT Information Services