The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and rules promulgated pursuant thereto intended to protect certain health care information from disclosure to authorized persons or entities. Generally, prior to disclosure of health care information, the holder of that information must obtain a release from the patient. HIPAA covers the disclosure of both physical and mental health care information. Thus, persons subject to transfer under ICAOS may have a protected privacy interest in certain health care information.

There is a law enforcement exception to the requirement to obtain a written release from an offender prior to disclosure of protected health care information. See 45 C.F.R. 164.512(f)(1). Protected health care information may also be released pursuant to a court order. See 45 C.F.R. 164.512(f)(1)(ii). However, release of protected health care information pursuant to court order is limited to the explicit terms of the orders. See 45 C.F.R. 164.512(e)(1)(i). Additionally, providers may release protected health care information when such release is consistent with law and applicable ethical standards, including disclosure to law enforcement authorities when necessary to protect the public or an individual from serious imminent threat or to aid in the apprehension of an individual at large from lawful custody. See 45 C.F.R. 164.512(j)(1)(i) & (j)(1)(ii)(B). See also, 45 C.F.R. 164.512(k)(5).

The release of protected health care information must be genuinely for law enforcement purposes. Thus, it should not be assumed that offenders have no privacy rights in their health care information. To the extent that the disclosure of protected information is a legitimately necessary element in the supervision of an offender, such a release of information would not violate HIPAA. If the disclosure of such information is more general in nature and not directly linked to a legitimately necessary element of supervision, the release could violate HIPAA. Therefore, in deciding whether to release protected health care information to the authorities of another state, it is important to determine whether the release of such information is critical to the offender’s supervision or maintaining public safety.

Although HIPAA may arise in the context of an interstate transfer, several courts have concluded that HIPAA does not provide either an explicit or implicit private right of action. One court having addressed HIPAA within the context of transferring medical records in the ICAOS context concluded that “I need not determine whether petitioner’s allegations state a possible claim under this statute because the text of the statute does not provide a private right of action and two federal courts have concluded after thorough and persuasive analyses that no implied right of action exists.” O’Neal v. Coleman, No. 06-C-243-C, 2006 WL 1706426, at *10 (W.D. Wis. June 16, 2006) citing Johnson v. Quander, 370 F. Supp. 2d 79, 99-100 (D.D.C. 2005); Univ. of Colorado Hospital v. Denver Publishing Co., 340 F. Supp. 2d 1142, 1144-46 (D. Colo. 2004).