Category: - Health Insurance Portability And Accountability Act

Law Enforcement Access [to Medical Records]

4/20/2019

Law Enforcement Access [to Medical Records]
Electronic Frontier Foundation no date

When exploring medical privacy issues, it's very useful to have an overview of the laws that affect control and privacy of medical information. We encourage you to read our legal overview.

Federal and state laws define some privacy rights for people who want to keep their medical records out of the hands of law enforcement. But law enforcement has many ways to access medical data when investigating crimes, identifying victims, or tracking down a fugitive. Often, the police are able to seek out sensitive medical records without an individual's consent—and sometimes without a judge's authorization.

To understand this, it's useful to compare the federal standards set by the Health Insurance Portability and Accountability Act (HIPAA) to the more privacy-protective legal standards in the State of California. We'll be jumping back and forth between the two throughout this discussion. Note: this discussion doesn’t cover access to health records relating to treatment in federally funded substance abuse facilities and programs under 42 U.S.C. § 290dd-2 and its “Part 2” regulations, which has stricter rules.

Disclosures of medical information to law enforcement by covered entities

The HIPAA Privacy Rule broadly defines law enforcement as "any government official at any level of government authorized to either investigate or prosecute a violation of the law."

Under HIPAA, medical information can be disclosed to law enforcement officials without an individual’s permission in a number of ways. Disclosures for law enforcement purposes apply not only to doctors or hospitals, but also to health plans, pharmacies, health care clearinghouses, and medical research labs. That's because under the HITECH Act, as implemented by the HIPAA Omnibus Rule, both a "covered entity" and any business associate (BA) are directly subject to these law enforcement access rules.

California has somewhat stronger privacy rules that require more court involvement, because HIPAA does not preempt more privacy-protective state laws. In California, search warrants for medical records are generally authorized under the Penal Code and require judicial approval based on probable cause. Less stringent court orders based on a showing of good cause can also be used. And in California, even if a mere administrative subpoena is used, the California Penal Code requires an authorizing court order.

By contrast, HIPAA permits 1 the police to use an administrative subpoena or other written request with no court involvement, as long as police include a written statement that the information they want is relevant, material, and limited in scope, and that de-identified information is insufficient. . . .

California,Federal, Electronic Frontier Foundation, Health Insurance Portability and Accountability Act (HIPAA), Health Records, Law Enforcement, Medical, Medical Records, Notice of Privacy Practices (NPP), Privacy, State

National Security and Medical Information

4/20/2019

National Security and Medical Information
Electronic Frontier Foundation (no date)

When exploring medical privacy issues, it's very useful to have an overview of the laws that affect control and privacy of medical information. We encourage you to read our legal overview.

The government has many options for obtaining your medical records on the grounds of national security. And if your medical records are swept up in a national security investigation, you likely won't be asked to consent and potentially won't ever know your medical records were accessed.

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule that went into effect in 2003 included a national security exception that permits doctors, hospitals, and any other "covered entity" to disclose individual health information "to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities authorized by the National Security Act." This exception overrides the normal requirement that your authorization is needed before your medical information can be disclosed for anything other than your treatment, bill payment, or your health care provider’s business operations.

This national security exception appears to allow covered entities to disclose health records, at their own discretion, to any federal agency that plays a role in intelligence, counter-intelligence, and national security activities. This includes but isn't limited to the CIA, the FBI, and the NSA.

For example, a hospital could disclose any or all of the patient medical records in its possession to the NSA on the hospital’s own initiative, and could even allow the NSA or other federal agencies to access the hospital’s health record system on a permanent, ongoing basis. This could be done without a court order, without any procedural or substantive protections or barriers, and even without any request from the agency. . . .

Bio-terrorism, Central Intelligence Agency, Electronic Frontier Foundation, Federal, Federal Bureau of Investigation, Foreign Intelligence Surveillance Act, Foreign Intelligence Surveillance Court, Health Insurance Portability and Accountability Act (HIPAA), Health Records, Intelligence Community, Medical, Medical Records, Military, National Security, National Security Act, National Security Agency, Notice of Privacy Practices (NPP), Patriot Act, President, Privacy, Section 215 of the Patriot Act, Secret Service, Surveillance

IN THE NEWS

Law Enforcement Access [to Medical Records]

National Security and Medical Information

NEWS and publications

Archives

Categories

Disclaimer: Targeted America is not a law firm. The information contained in this website is provided for informational purposes only and should not be construed as legal advice on any matter.

This website is best viewed on a computer or laptop.