The HIPAA privacy rules have a number of disclosure exceptions, but those exceptions are only effective when state law also allows the disclosure. When there is no state-law exception, it is irrelevant that HIPAA would allow the disclosure. One such common situation involves crimes against patients.

45 CFR 164.512(f)(5) (“Crime on premises”) allows a hospital to “disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.”

One such situation involved the husband of a patient in her 50s who was alleged to have tampered with her life-support equipment in an attempt to kill her. The police wanted information from the hospital, and the hospital wanted to cooperate. However, even though this clearly meets the HIPAA crime-on-the-premises exception, where did state law allow the disclosure?

One answer is Louisiana’s adult abuse reporting statutes. R.S. 15:1504 requires hospital employees that have “cause to believe that an adult’s physical … welfare has been …adversely affected by abuse, neglect, or exploitation [to] report….” §1505 provides that “reports … shall be made to … law enforcement agency. All reports shall contain the name and address of the adult, the name and address of the person responsible for the care of the adult, if available, and any other pertinent information.”

It is important to remember that this exception doesn’t actually cover all adult patients in the hospital. §1503 defines “adult” as “any individual eighteen years of age or older… who, due to a physical, mental, or developmental disability or the infirmities of aging, is unable to manage his own resources, carry out the activities of daily living, or protect himself from abuse, neglect, or exploitation.” In the situation described above, the patient was unconscious and therefore was unable to protect herself. However, before using this exception to disclosure information regarding a crime against a patient, it is still necessary to check that the current situation meets the exception.

Written by: Greg Frost