When Is It Okay Under HIPAA to Report Domestic Violence?
When Is It Okay Under HIPAA to Report
Domestic Violence?
issue of REPORT ON PATIENT PRIVACY, the industry’s
most practical source of news on
HIPAA patient privacy provisions.
A patient presents at a hospital emergency r
oom with injuries that she says are from
falling down stairs, but the medical staff de
termines they are from domestic violence.
She asks them not to report the incident to
police. What should the staff do? Report it
anyway because she could be in more dang
er? Or respect her wishes and protect her
privacy? And how do state laws on inve
stigating domestic abuse come into play?
This is the scenario one privacy official
posed to his co-workers and to his colleagues
through a listserv. “This was a good scenario that we tossed out there to see how others
dealt with it,” says Steve Stark, informatio
n technologies manager at Skaggs Community
Health Center in Branson, Mo. “We took this all the way to our legal department …
[and] what we learned through this is that, in
the state of Missouri, it is perfectly legal
for a physician to report [an incident] even after a request.”
With or without a victim’s request, protecte
d health information (PHI) is not protected
if a crime was involved, Stark found. “Our attorney
told us that if we feel that a patient is
in danger, we have every right to report it [a
nd] we could probably be held liable if we
didn’t.”
But there is a twist
. Stark says caregivers want to be cautious and not jump to
conclusions or make false accusations. “You
wouldn’t want to do anything that would
prevent patients from seeking care because they
might start to think that every time they
come in, their privacy is going to be breached.”
Jon Burke, a consultant on privacy and security issues, agrees. He says a hospital should
take advantage of all the options it has befo
re contacting police. “If a patient comes in
with a variety of wound patterns that show an abuse context, it is a no-brainer: Make the
call,” he tells RPP. But, he says, “In a normal
hospital, there is a psychiatrist on call or a
social worker on call. Before you put someon
e in the system, you really need to consider
[those options]. Try to relate to what you would do in the course of normal life. Knowing
what you know, how likely woul
d you be to report this? If
you know that someone is
beating the hell out of somebody else, yeah, re
port it. But if you’re not sure, then ask.”
Burke, who received Stark’s scenario through
a listserv, points out that “in most abuse
cases, if the victim gets to the hospital, it
is the spouse that abused them [who] drives
them there. If the abuser knows [he is] going to
jail, that victim is not going to get to the
hospital.”
So, to report an incident against the patien
t’s will could put him or her more at risk,
Burke says. For example, “in California, the state can take over as the plaintiff. So a guy
When Is It Okay Under HIPAA to Report Domestic Violence?
Page 2 of 3
would be out of the house that night and maybe in jail,” and probably pretty upset,
Burke says.
In one case that illustrates confusion on this
issue, a case manager at a hospital in
Louisiana sued two police officers after they
arrested her for obstruction of justice for
delaying the investigation of a domestic abuse case. A nurse called the police to report
the incident. The case manager would not le
t officers speak to the victim, however,
saying that she had asserted her right to
privacy of medical treatment under HIPAA,
according to court documents. The officers al
lege that she barred them from seeing the
victim and threatened them with a lawsuit, court documents say.
The case manager was later arrested after the
officers obtained a warrant. She filed suit
against the officers and the city for false a
rrest, seeking damages of $170,000. Part of
the case manager’s argument was that her acti
ons were justified by HIPAA, according to
court documents.
Josephus Verheijde, a physical
therapist and bioethicist at Mayo Clinic, explains that
when the nurse called police and informed th
em about the potential abuse, state laws
went into effect, so law enforcement was unde
r the obligation to investigate, which is
“on a totally different level [than HIPAA].”
“You can ask the question ‘is any health ca
re provider obligated to disclose this
information?’” says Verheijde, who is a certified compliance professional. “[HIPAA]
allows disclosure about a victim of a crim
e and you can disclose if it is expressly
authorized by a state or to prevent any seri
ous harm to the victim,” he points out.
Court Dismisses Case
The U.S. District Court for the Western Distri
ct of Louisiana dismissed Maier’s suit on
March 30. Her attorney, Paul Marx, says they
do not intend to appeal, but they maintain
that Maier was correct. “There is no question a state cannot violate patient
confidentiality provided by federal law,” he
tells RPP. “Since that issue was not before
the court, anything in the ruling on that su
bject is just commentary, and has no legal
import.”
“Maier’s claim that the police officers should
have known that her actions were justified
by HIPAA regulations and thus lacked probable
cause has no basis in law or in fact,” the
court’s opinion says. “HIPAA prohibits hospit
al personnel from disclosing protected
health care information to third parties.
It does not bar police officers from
obtaining information related to a perp
etrated crime directly from a patient
nor does it prohibit hospital personnel
from allowing police officers access
to a patient who was a victim of a crime,” the court explains.
Stark says this last quote from the opinion “should be added to every HIPAA training
manual in existence and should be relaye
d to existing staff and all new staff.”
When Is It Okay Under HIPAA to Report Domestic Violence?
Page 3 of 3
“This case demonstrates the risks hospitals
take on when not fully understanding the
rules and regulations of HIPAA. It is the re
sponsibility of the [privacy and security
officer] to train its staff members on when
and how to apply HIPAA.
Case worker Maier
acted as well as she knew how
to at the time, but obviously
was violating Louisiana state
statutes,” he says.
“I think hospitals should rehearse events exac
tly as described in this court case and see
how nurses respond,” Stark continues. “Only when
a nurse is presented with this type of
scenario can one learn how their staff members wi
ll react. I know it is hard letting go of
PHI to anyone who is not a care provider, but
ultimately we as health care professionals
have a higher goal of protecting the patien
t and, many times, in order to accomplish
this, we must rely on [law enforcement officials],” he adds.
Verheijde says it is also important to know wh
at your state laws say. “I would think that
most – if not all – states have some regulation that says these types of crimes require an
investigation.”
“[HIPAA] clearly allows disclosure of information about an individual even without
consent to prevent serious harm. But it’s a
judgment call too,” Verh
eijde says, according
to Sec. 164.512 of the HIPAA Privacy Rule.
“It is important that institutions have polici
es that are well written and detailed enough
so the staff knows how to handle these case
s. Once the call is made, you’re done. The
state laws take over. And most states have
statutes that say [offici
als] will investigate
domestic violence and prosecute if appropriate.”
Copyright © 2007 by Atlantic
Information Services, Inc.