1. Understanding HIPAA from a Law Enforcement Perspective Presented by: Dede Ford, Violence Against Women Project Training Attorney, PAAM and Jan Walton, Director of Health Information Management, Oaklawn Hospital

2. PAAM wishes to thank the MDVSAPTB for their financial support of this project. This project was supported by Grant No. 2011-WF-AX-0013 awarded by the Office on Violence Against Women, U.S. Department of Justice to the Michigan Domestic Violence Prevention and Treatment Board. The opinions, findings, conclusions, and recommendations expressed in this publication/program/exhibition) are those of the author(s) and do not necessarily reflect the views of the Department of Justice, Office on Violence Against Women or the Michigan Domestic Violence Prevention and Treatment Board.

3.  The Health Insurance Portability and Accountability Act of 1996 is a multifaceted piece of legislation covering 3 areas: A. Insurance Portability B. Fraud Enforcement (Accountability) C. Administrative Simplification-Ensures system-wide, technical and policy changes in healthcare organizations in order to protect patient’s privacy and the confidentiality of identifiable protected health information (PHI). What is HIPAA?

4. What Information is Protected?  Protected Health Information. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." 12  “Individually identifiable health information” is information, including demographic data, that relates to:  the individual’s past, present or future physical or mental health or condition,  the provision of health care to the individual, or  the past, present, or future payment for the provision of health care to the individual,  and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. 13 Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number). Protected Health Information

5. (C) Prohibited Discovery.  (1) Notwithstanding any other provision of this rule, there is no right to discover information or evidence that is protected from disclosure by constitution, statute, or privilege, including information or evidence protected by a defendant's right against self-incrimination, except as provided in subrule (2). Discovery MCR 6.201

6.  (2) If a defendant demonstrates a good-faith belief, grounded in articulable fact, that there is a reasonable probability that records protected by privilege are likely to contain material information necessary to the defense, the trial court shall conduct an in camera inspection of the records. (People v Stanaway, 446 Mich. 643, 662; 521 NW2d 557 (1994).)  (a) If the privilege is absolute, and the privilege holder refuses to waive the privilege to permit an in camera inspection, the trial court shall suppress or strike the privilege holder's testimony. MCR 6.201 (C)(2)

7.  (b) If the court is satisfied, following an in camera inspection, that the records reveal evidence necessary to the defense, the court shall direct that such evidence as is necessary to the defense be made available to defense counsel. If the privilege is absolute and the privilege holder refuses to waive the privilege to permit disclosure, the trial court shall suppress or strike the privilege holder's testimony.  (c) Regardless of whether the court determines that the records should be made available to the defense, the court shall make findings sufficient to facilitate meaningful appellate review. MCR 6.201 (C)(2), continued

8.  (d) The court shall seal and preserve the records for review in the event of an appeal  (i) by the defendant, on an interlocutory basis or following conviction, if the court determines that the records should not be made available to the defense, or  (ii) by the prosecution, on an interlocutory basis, if the court determines that the records should be made available to the defense.  (e) Records disclosed under this rule shall remain in the exclusive custody of counsel for the parties, shall be used only for the limited purpose approved by the court, and shall be subject to such other terms and conditions as the court may provide. MCR 6.201 (C)(2), continued

9.  (D) Excision. When some parts of material or information are discoverable and other parts are not discoverable, the party must disclose the discoverable parts and may excise the remainder. The party must inform the other party that nondiscoverable information has been excised and withheld. On motion, the court must conduct a hearing in camera to determine whether the reasons for excision are justifiable. If the court upholds the excision, it must seal and preserve the record of the hearing for review in the event of an appeal. MCR 6.201 (D)

10.  (E) Protective Orders. On motion and a showing of good cause, the court may enter an appropriate protective order. In considering whether good cause exists, the court shall consider the parties' interests in a fair trial; the risk to any person of harm, undue annoyance, intimidation, embarrassment, or threats; the risk that evidence will be fabricated; and the need for secrecy regarding the identity of informants or other law enforcement matters. On motion, with notice to the other party, the court may permit the showing of good cause for a protective order to be made in camera. If the court grants a protective order, it must seal and preserve the record of the hearing for review in the event of an appeal. MCR 6.201 (E)

11. MCL 600.2157a Definitions; consultation between victim and sexual assault or domestic violence counselor; admissibility. (1) For purposes of this section: (a) “Confidential communication” means information transmitted between a victim and a sexual assault or domestic violence counselor, or between a victim or sexual assault or domestic violence counselor and any other person to whom disclosure is reasonably necessary to further the interests of the victim, in connection with the rendering of advice, counseling, or other assistance by the sexual assault or domestic violence counselor to the victim. (b) “Domestic violence” means that term as defined in section 1501 of Act No. 389 of the Public Acts of 1978, being section 400.1501 of the Michigan Compiled Laws. (c) “Sexual assault” means assault with intent to commit criminal sexual conduct. Privileges-SA or DV Counselor

12. (d) “Sexual assault or domestic violence counselor” means a person who is employed at or who volunteers service at a sexual assault or domestic violence crisis center, and who in that capacity provides advice, counseling, or other assistance to victims of sexual assault or domestic violence and their families. (e) “Sexual assault or domestic violence crisis center” means an office, institution, agency, or center which offers assistance to victims of sexual assault or domestic violence and their families through crisis intervention and counseling. (f) “Victim” means a person who was or who alleges to have been the subject of a sexual assault or of domestic violence. (2) Except as provided by section 11 of the child protection law, Act No. 238 of the Public Acts of 1975, being section 722.631 of the Michigan Compiled Laws, a confidential communication, or any report, working paper, or statement contained in a report or working paper, given or made in connection with a consultation between a victim and a sexual assault or domestic violence counselor, shall not be admissible as evidence in any civil or criminal proceeding without the prior written consent of the victim. Privileges-SA or DV Counselor (continued)

13. MCL 333.18237 Confidential information; disclosure; waiver. A psychologist licensed or allowed to use that title under this part or an individual under his or her supervision cannot be compelled to disclose confidential information acquired from an individual consulting the psychologist in his or her professional capacity if the information is necessary to enable the psychologist to render services. Information may be disclosed with the consent of the individual consulting the psychologist, or if the individual consulting the psychologist is a minor, with the consent of the minor's guardian, pursuant to section 16222 if the psychologist reasonably believes it is necessary to disclose the information to comply with section 16222, or under section 16281. In a contest on the admission of a deceased individual's will to probate, an heir at law of the decedent, whether a proponent or contestant of the will, and the personal representative of the decedent may waive the privilege created by this section. Privileges-Psychologist

14. MCL 600.2157 Physician-patient privilege; waiver. Except as otherwise provided by law, a person duly authorized to practice medicine or surgery shall not disclose any information that the person has acquired in attending a patient in a professional character, if the information was necessary to enable the person to prescribe for the patient as a physician, or to do any act for the patient as a surgeon.... Privileges-Physician

15.  Do you NEED the information contained in the records to help PROVE an element of a charged offense? If the answer is no, DON’T REQUEST THE RECORDS! Example 1: SANE record reveals physical injury. You probably don’t need the Emergency Department triage record. Example 2: SANE record reveals that victim is on an anti- psychotic or anti-depressant medication. There is no need to obtain the medical or psychiatric records that would give the history behind prescribing that medication. First Things First

16.  If the answer is yes, have a discussion with the victim and, if they agree, obtain their consent. Consider including an advocate in this discussion to provide additional support to the victim, if needed.  Keep in mind that the victim has already been traumatized by the event(s) that have brought her into the criminal justice system. Obtaining private, confidential records of the victim may exacerbate that trauma. Proceed with caution. First Things First, continued

17.  The Privacy Rule is balanced to protect an individual’s privacy while allowing important law enforcement functions to continue. The Rule permits covered entities (health care providers) to disclose protected health information to law enforcement officials, without the individual’s written authorization, under specific circumstances. Release of Protected Health Information to Law Enforcement

18.  To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena. 45 CFR 164.512(f)(1)(ii)(A)-(B)). Permitted Disclosures for Law Enforcement Purposes

19.  To respond to a request about a victim of a crime, and the victim agrees. If the victim is unable to agree (due to an emergency or incapacity), the information may be disclosed if law enforcement represents that the information is not intended to be used against the victim and is needed because the investigation would be materially and adversely affected by waiting until the victim could agree. 45 CFR 164.512(f)(3) Permitted Disclosures for Law Enforcement Purposes

20.  To report protected health information that the covered entity in good faith believes to be evidence of a crime that occurred on the covered entity’s premises. 45 CFR 164.512(f)(5) Permitted Disclosures for Law Enforcement Purposes

21.  To respond to a request for purposes of identifying or locating a suspect, fugitive, material witness or missing person; but the information released must be limited. 45 CFR 164.512(f)(2) Permitted Disclosures for Law Enforcement Purposes

22.  Review with victim and request only what is necessary.  Avoid overbroad terms in your request; “Any and all records...” may open a Pandora’s box that you won’t be able to close. Example: Your request was overbroad. Not only did you receive Emergency Department records but you also received records of a psychiatric hospitalization from 3 years ago that reveal a suicide attempt. Your support staff copied them and provided them to defense counsel without your review. You will have to file protective motions, etc. to try to keep that information out of court. More importantly, the victim suffers knowing that her private records are in the hands of the person that assaulted her. This damages your relationship with her going forward. Release of Information for PHI- Considerations

23.  Include FULL NAME and DATE OF BIRTH  Include specificity about specific treatments and dates. Example 1: “operative report from November 01, 2012,” if you will be calling the surgeon as a witness. Example 2: “emergency department record dated November 01, 2012” if you intend to call the ED healthcare provider to show petechial hemorrhage for a GBH case.  Obtain signature of victim. Release of Information for PHI- Considerations

24.  Same considerations apply as with permissive releases.  When in doubt, contact a medical records professional at the healthcare provider that maintains the desired records for assistance in formulating the appropriate and relevant request. Search warrants for PHI

25.  Review the contents before automatically turning a copy over to defense counsel.  Are they responsive to your specific request? If not, return those records that aren’t relevant.  If appropriate, excise information that is not discoverable.  If you are unsure about potential Brady material, seek assistance. Things to think about when records are received

26.  Develop a good working relationship.  Utilize their expertise.  If records need to be admitted in court, utilize the business records exception and certification of record custodian in lieu of testimony. MRE 803 (6).  Work through problems together. Develop a process for dealing with issues that develop after business hours before an issue comes up. Request a meeting with local Health Information Management Director

27.  Ensure that there is an understanding about the victim’s right to have their private records remain private, absent an absolute need.  If they obtain a release due to their contact with the victim, review it for relevance before it is sent to the healthcare provider. Educate local law enforcement about PHI and releases from victims

28. US Department of Health and Human Services A full listing of situations where disclosures are permitted for law enforcement officials: http://www.hhs.gov/ocr/privacy/hipaa/faq/disclosures_for_law_enforceme nt_purposes/505.html National District Attorneys Association Update: HIPAA—Exceptions providing Law Enforcement Officials and Social Service Providers Access to Protected Health Information http://www.ndaa.org/ncpca_update_v16_no4.html Links for Additional Information

29. Violence Against Women Project Prosecuting Attorneys Association of Michigan  Director Herb Tanner, 517-334-6060 ext. 829  Training Attorney Dede Ford, 517-334-6060 ext. 806 Questions?