At Issue

Guidance from the U.S. Department of Health & Human Services, Office of Civil Rights as to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Coverage & Exemptions for the Interstate Compact for Adult Offender Supervision

Requested by: Pennsylvania

Issued on: 26-08-2005

Issued by: Richard L. Masters, Legal Counsel

Background:

This is in response to the request to the Executive Director from Pennsylvania for citation to authority from the U.S. Department of Health & Human Services,Office of Civil Rights concerning applicability of the provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 CFR Parts 160 and 164, to the Interstate Compact on for the Supervision of Adult Offenders (“ICAOS”). As you are aware ICAOS is the only state or federal law which regulates the transfer of supervised adult offenders, across state lines and promotes the proper supervision and rehabilitation of covered adult offenders. The underlying question raised by Pennsylvania seeks clarification as to whether or not the activities, including the disclosure and tracking of protected health information, of state agencies which administer the ICAOS, acting pursuant to the provisions of the Compact and its authorized rules are exempt from the applicability of HIPAA and the privacy rule promulgated thereunder.

Applicable Rules & Statute

In considering this question it is useful to note that the HIPAA privacy rules are intended to protect an individual’s privacy while allowing important law enforcement functions to continue. (See HIPAA Privacy Rule & Public Health, Guidance from Center for Disease Control and The U.S.Department of Health and Human Services, April 11, 2003). Thus, HIPAA exempts certain disclosures of health information for law enforcement purposes without an individual’s written authorization. The various conditions and requirements concerning these exempt disclosures are contained in the regulatory text of the HIPAA privacy rule and may be found at 45 CFR 164 et. seq.

Analysis & Conclusion

Under these provisions protected health information may be disclosed for law enforcement purposes when such disclosures are required by law. Thus, disclosure of protected health information required to be furnished by or received from state agencies which administer the ICAOS acting pursuant to the provisions of the compact and its authorized rules is permissible. [See 45 CFR 164.512 (f)(1)(i)]. In addition exempt disclosures include those in which a response is required to comply with a court order. [See 45 CFR 164.512 (f)(1)(ii)(A)-(B)]. Under this provision, the disclosure and tracking of protected health information, among authorized compact administrators’offices, concerning any adult offender subject to compact supervision pursuant to court order, as required by the Compact and its authorized rules would be exempt from HIPAA. (See OCR Summary of the HIPAA Privacy Rule – April 11, 2003; See also OCR Guidance Explaining Significant Aspects of the Privacy Rule – December 4,2002).

The more general provisions of the HIPAA privacy rules allow disclosures of protected health information when consistent with applicable law and ethical standards, including disclosures to a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public. [45 CFR 164.512 (j)(1)(i)]; or to identify or apprehend an individual who appears to have escaped from lawful custody [See 45 CFR 164.51`2 (j)(1)(ii)(B)]. These provisions would apply to adult offenders under ICAOS supervision who have absconded or otherwise violated the terms of their supervision and need to be apprehended and retaken. (OCR Guidance Explaining Significant Aspects of the Privacy Rule – December 4,2002).

Additionally HIPAA specifically authorizes disclosures of protected health information to law enforcement officials who need the information in order to provide health care to the individual and for the health and safety of the individual. [45 CFR 164.512 (k)(5)]. Under these provisions it appears that disclosures of health information which are required to provide for treatment of adult offenders subject to the ICAOS would also be exempt from HIPAA requirements.