HIPAA and law enforcement: does HIPAA apply to police?

HHS’s guide for law enforcement states that many entities holding health information are not subject to HIPAA, including most state and local police and other law enforcement agencies. HIPAA’s role is on the other side of the conversation: it decides what covered entities — and their business associates — may tell officers.

The routes for a disclosure to law enforcement

Without the patient’s authorization, a covered entity may disclose PHI to a law enforcement official only through one of these routes, each with its own limits (45 CFR 164.512):

Situation	What may be shared, and the conditions	Rule
A court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena	What the document requires, as limited by it	164.512(f)(1)(ii)(A)–(B)
An administrative request — an administrative subpoena, civil investigative demand or similar process	Only if the information is relevant and material to a legitimate inquiry, the request is specific and limited, and de-identified information could not reasonably be used	164.512(f)(1)(ii)(C)
A law requires the report, such as certain wounds or injuries	What that law requires. Child abuse or neglect reports follow 164.512(b)(1)(ii); other abuse, neglect or domestic-violence reports follow 164.512(c), with its conditions	164.512(f)(1)(i)
Identifying or locating a suspect, fugitive, material witness or missing person	Only name and address, date and place of birth, Social Security number, ABO blood type and Rh factor, type of injury, date and time of treatment or death, and distinguishing physical characteristics. No other information about DNA or DNA analysis, dental records, or body-fluid or tissue typing, samples or analysis under this route	164.512(f)(2)
A victim of a crime	With the victim’s agreement. If incapacity or an emergency prevents agreement: the official must state that the information is needed to determine whether someone other than the victim broke the law, will not be used against the victim, and that waiting would materially harm immediate law enforcement activity — and you must judge disclosure to be in the victim’s best interests	164.512(f)(3)
A death you suspect resulted from criminal conduct	Information to alert law enforcement to the death	164.512(f)(4)
A crime on your premises	Information you believe in good faith is evidence of it	164.512(f)(5)
Emergency care given off your premises	What appears necessary to alert police to the crime, its location or victims, and the perpetrator — not when you believe the emergency results from abuse, neglect or domestic violence	164.512(f)(6)
A serious and imminent threat to a person or the public	What is necessary to prevent or lessen it, to someone reasonably able to do so	164.512(j)
A correctional institution, or a law enforcement official with lawful custody of an inmate or other individual	What the institution or official says is necessary for that person’s health care, the health and safety of inmates, staff and those transporting them, or the institution’s safety and order. Not for someone released on parole, probation or supervised release, or otherwise no longer in lawful custody	164.512(k)(5)

A coroner or medical examiner identifying a deceased person or determining a cause of death uses a separate route (164.512(g)(1)). All of these are permissions: HIPAA does not require you to disclose unless another law or a court order does.

Before you disclose

• Verify who is asking — and on what authority. Verify identity with official credentials or a request on appropriate agency letterhead, unless you already know the official. Separately verify the legal authority and the conditions for this disclosure — the route in the table above; a badge alone does not authorize access to records (45 CFR 164.514(h)(2)(ii)–(iii)).
• Share only what the route allows. The minimum necessary standard applies to most of these disclosures; it does not apply where a law requires a specific disclosure, and some routes set their own limits, like the short list for identifying a suspect.
• Psychotherapy notes need the patient’s authorization for most disclosures, with narrow exceptions such as disclosures required by law (45 CFR 164.508(a)(2)).
• Substance use disorder records of a federally assisted program covered by 42 CFR Part 2 need the patient’s Part 2 consent or a court order that meets Part 2’s own requirements; a subpoena alone is not enough. For use in an investigation or proceeding, the consent must specifically cover that purpose and cannot be combined with consent for another purpose. A Part 2 court order authorizes disclosure; a subpoena or other legal mandate is needed to compel it (42 CFR 2.31(d), 2.61).
• State law can be stricter — for example for mental health records — and can require reports HIPAA only permits.

Record it

Most disclosures to law enforcement must go into the patient’s accounting of disclosures (45 CFR 164.528). If an official states that an accounting to the patient would be reasonably likely to impede the agency’s activities, you must temporarily withhold only the accounting entries covered by the official’s statement — for the period a written statement specifies, or, after an oral statement you document, for no longer than 30 days unless a written statement is submitted within that time — and provide the rest of the accounting as required. Keep recording the underlying disclosures (164.528(a)(2)). Disclosures to correctional institutions or law enforcement officials under 164.512(k)(5) are not included in the accounting (164.528(a)(1)(vii)).

At the front desk

When an officer arrives, staff should not hand over records on the spot. Ask for the document or the request in writing, take a name and badge number, and pass it to the privacy official. For subpoenas and court orders, see a subpoena for patient records arrives.

An ambulance or EMS service run by a police or fire department can be a HIPAA covered entity for the care it provides if it bills electronically.