When Missouri health care providers were required to comply with the Health Insurance Portability and Accountability Act in 2003, they were forced to act conservatively when disclosing patient health information to law enforcement.
Since then, the Missouri Police Chiefs’ Association has worked to propose revisions to Missouri law to give police more access to information about patients associated with crimes.
HIPAA was passed in 1996 to govern the use and release of patients’ protected health information. The law calls for strict patient security and privacy standards. There aren’t many loopholes around the law when trying to get information on patients associated with crimes. This is especially true under the Missouri statute, which is more stringent than federal law. According to the Missouri Hospital Association, when state law and HIPAA conflict, the stricter law must be followed.
If a patient is involved in a criminal investigation, his or her personal health information is protected under HIPAA. Health care providers may only release limited information: the patient’s name, location and a one-word general condition report. If the patient — or a close family member, if the patient is unconscious — does not permit that information to be released, it becomes confidential. Withholding that information prohibits health care providers from even confirming if a patient is in the hospital. Police are not notified when a criminal suspect is released, though in some extreme cases police are able to obtain this information by court order.
“We’ve had problems with it in the past,” Columbia police Sgt. Tim Moriarity said. “They have their restrictions. Their primary service is medical, not to report to us.”
Because hospital staff members can’t notify police when a patient is released, police have the option of posting officers at the hospital. They usually only post officers when the patient poses a significant threat to hospital staff or the community. Capt. Warren Brewer, administrator at the Boone County jail, said officers are only posted at the hospital to watch patients suspected of committing one of the “seven deadly sins” — serious felonies such as murder and forceful rape.
Posting officers at the hospital creates staffing problems for police, Columbia Police Chief Randy Boehm said.
“We work eight-hour shifts, so that’s going to require at least three officers per day,” he said. “And sometimes you would be uncomfortable leaving an officer there by themselves, so that would be six officers per day for the duration of the patient’s stay. We do not have the officers on duty to do that.”
HIPAA puts hospital staff in an awkward position as well.
“We’d like to be able to help law enforcement,” said Mary Becker, spokeswoman for the Missouri Hospital Association. “It puts us in a difficult situation, but we really do want to cooperate with law enforcement.”
Becker said the penalties for breaking HIPAA are severe.
According to the Missouri Hospital Association’s Web site, the government may impose civil and criminal penalties ranging from $50,0000 and/or imprisonment for one year to $250,000 and/or 10 years imprisonment, depending on the intent of the disclosure.
“We know that HIPAA rules don’t allow them to communicate that information,” Boehm said. “Sure that causes issues ... but I don’t blame the hospital, it’s just part of the legislation.”
The Police Chiefs Association’s proposals to revise the Missouri statute are in their infancy. Jerry Sill, the Missouri Hospital Association’s legal counsel, said the association and the attorney general’s office should file legislation quickly.
“Hopefully we can agree on something and get the legislature to agree,” Sill said. “The process would need to get started pretty quickly because we’re already six weeks into the legislative session.”