Whether or not the activities, including the disclosure and tracking of protected health information, of state agencies which administer the ICJ, acting pursuant to the provisions of the ICJ and its authorized rules, are exempt from the applicability of HIPAA.
Pursuant to Commission Rule 9-101.3, a request has been made by the state of North Dakota to address the following issues:
States releasing information regarding sex offender evaluations, given that these evaluations are medical records and therefore protected under HIPAA.
- The applicability of the provision of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR Parts 160 and 164, to the Interstate Commission for Juveniles
- Whether or not the activities, including the disclosure and tracking of protected health information, of state agencies which administer the ICJ, acting pursuant to the provisions of the ICJ and its authorized rules, are exempt from the applicability of HIPAA
The HIPAA privacy rules are intended to protect an individual’s privacy while allowing important law enforcement functions to continue. (See, HIPAA Privacy Rule & Public Health, Guidance from Center for Disease Control and The U.S. Department of Health and Human Services, April 11, 2003). Thus, HIPAA exempts certain disclosures of health information for law enforcement purposes without an individual’s written authorization. The various conditions and requirements concerning these exempt disclosures are contained in the regulatory text of the HIPAA privacy rule and may be found at 45 CFR 164 et. seq.
Under these provisions, protected health information may be disclosed for law enforcement purposes when such disclosures are required by law. Thus, disclosure of protected health information required to be furnished by or received from state agencies which administer the ICJ acting pursuant to the provisions of the Compact and its authorized rules is permissible. See, 45 CFR 164.512 (f)(1)(i). In addition, exempt disclosures include those in which a response is required to comply with a court order. See, 45 CFR 164.512 (f)(1)(ii)(A)-(B). Under this provision, the disclosure and tracking of protected health information, among authorized Compact Administrators’ offices, concerning any juvenile subject to Compact supervision pursuant to court order, as required by the Compact and its authorized rules would be exempt from HIPAA.
The more general provisions of the HIPAA privacy rules allow disclosures of protected health information when consistent with applicable law and ethical standards, including disclosures to a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public. See, 45 CFR 164.512 (j)(1)(i); or to identify or apprehend an individual who appears to have escaped from lawful custody. See, 45 CFR 164.512 (j)(1)(ii)(B). These provisions would apply to juveniles under ICJ supervision who have absconded or otherwise violated the terms of their supervision and need to be apprehended.
Additionally, HIPAA specifically authorizes disclosures of protected health information to law enforcement officials who need the information in order to provide health care to the individual and for the health and safety of the individual. See, 45 CFR 164.512 (k)(5). Under these provisions, it appears that disclosures of health information which are required to provide for treatment of juveniles subject to the ICJ would also be exempt from HIPAA requirements.
It is also important to note that in the context of an interstate transfer of supervision under the Interstate Compact for Adult Offender Supervision, several courts have concluded that HIPAA does not provide either an explicit or implicit private right of action. See, O’Neal v. Coleman, 2006 U.S. Dist. Ct., LEXIS 40702 (W.D. Wis. June 16, 2006 citing Johnson v. Quander, 370 F. Supp.2d 79, 99-100 (D.D.C. 2005); See also, Univ. of Colorado Hospital v. Denver Publishing Co., 340 F. Supp.2d 1142, 1144-46 (D. Colo. 2004). It is reasonable to predict that this analysis would also be applicable to interstate transfers under the ICJ should the question arise.
Protected health information may be disclosed for law enforcement purposes when such disclosures are required by law. The disclosure and tracking of protected health information, among authorized Compact Administrators' offices, concerning any juvenile subject to Compact supervision pursuant to court order, as required by the Compact and its authorized rules would be exempt from HIPAA.