The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and rules promulgated pursuant thereto are intended to protect certain healthcare information from disclosure to authorized persons or entities. Generally, prior to disclosure of health care information, the holder of that information must obtain a release from the patient. HIPAA covers the disclosure of both physical and mental health care information. Thus, persons subject to transfer under ICAOS may have a protected privacy interest in certain health care information.

There is a law enforcement exception to the requirement to obtain a written release from a supervised individual prior to disclosure of protected health care information. See 45 C.F.R. 164.512(f)(1). Protected healthcare information may also be released pursuant to a court order. See 45 C.F.R. 164.512(f)(1)(ii). However, release of protected health care information pursuant to court order is limited to the explicit terms of the orders. See 45 C.F.R. 164.512(e)(1)(i). Additionally, providers may release protected health care information when such release is consistent with law and applicable ethical standards, including disclosure to law enforcement authorities when necessary to protect the public or an individual from serious imminent threat or to aid in the apprehension of an individual at large from lawful custody. See 45 C.F.R. 164.512(j)(1)(i) & (j)(1)(ii)(B). See also, 45 C.F.R. 164.512(k)(5).

The release of protected health care information must be strictly for law enforcement purposes and should not imply that supervised individuals forfeit their privacy rights regarding their health care data. Disclosure of protected information is permissible under HIPAA only when it is essential for the supervision of the individual. If the disclosure is more general and not directly related to a necessary aspect of supervision, it may violate HIPAA regulations. Therefore, before releasing protected health care information to authorities in another state, it is crucial to assess whether the release is essential for the individual's supervision or for ensuring public safety.

Although HIPAA may arise in the context of an interstate transfer, several courts have concluded that HIPAA does not provide either an explicit or implicit private right of action. One court having addressed HIPAA within the context of transferring medical records in the ICAOS context concluded that “I need not determine whether petitioner’s allegations state a possible claim under this statute because the text of the statute does not provide a private right of action and two federal courts have concluded after thorough and persuasive analyses that no implied right of action exists.” O’Neal v. Coleman, No. 06-C-243-C, 2006 WL 1706426, at *10 (W.D. Wis. June 16, 2006) citing Johnson v. Quander, 370 F. Supp. 2d 79, 99-100 (D.D.C. 2005); Univ. of Colorado Hospital v. Denver Publishing Co., 340 F. Supp. 2d 1142, 1144-46 (D. Colo. 2004).