HIPAA and the Criminal Investigation

As medical practitioners and the attorneys who defend (or sue) them have learned over the last few years, health care professionals are liable for wrongful disclosure of protected health care information under HIPAA and various state statutes. Health Insurance Portability and Accountability Act, Pub. L. No. 104-191, 110 Stat. 1936 (1996) (amending, Employee Retirement Income Security Act of 1974, 29 U.S.C. 1001-1461 (1994) (ERISA). Lack of sophistication of the law in this area is no excuse for turning over medical records to unauthorized recipients, and appropriate statutory requirements must always be met. But it's not always easy to tell when those safeguards on patient privacy are paramount and when other considerations might trump them. A recent case offers an interesting permutation on the question by asking: When can law enforcement authorities access medical records without the patient's authorization? The wrong answer could leave the health care facility or provider that hands over patient records vulnerable to liability for unauthorized release.