Whether the law enforcement exemptions from the provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") would apply to transfers and returns of juveniles involving non-member states.
Pursuant to ICJ Rule 9-101(3), a request has been made by the West Region of the ICJ member states concerning transfers of supervision and return of juveniles to and from non-member states and whether the law enforcement exemptions from the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) would apply to transfers and returns of juveniles involving non-member states or territories.
Whether the law enforcement exemptions from the provisions of the HIPAA would apply to transfers and returns of juveniles involving non-member states.
Applicable HIPAA Rules:
In considering this question it is useful to note that the HIPAA privacy rules are intended to protect an individual’s privacy while allowing important law enforcement functions to continue. (See HIPAA Privacy Rule & Public Health, Guidance from Center for Disease Control and The U.S. Department of Health and Human Services, April 11, 2003). Thus, HIPAA exempts certain disclosures of health information for law enforcement purposes without an individual’s written authorization. The various conditions and requirements concerning these exempt disclosures are contained in the regulatory text of the HIPAA privacy rule and may be found at 45 CFR 164 et. seq.
Under these provisions, protected health information may be disclosed for law enforcement purposes when such disclosures are required by law. Thus, disclosure of protected health information required to be furnished by or received from state agencies which administer the ICJ acting pursuant to the provisions of the compact and its authorized rules is permissible. [See 45 CFR 164.512 (f)(1)(i)]. In addition, exempt disclosures include those in which a response is required to comply with a court order. [See 45 CFR 164.512 (f)(1)(ii)(A)-(B)]. Under this provision, the disclosure and tracking of protected health information, among authorized compact administrators’ offices, concerning any juvenile subject to compact supervision pursuant to court order, as required by the ICJ and its authorized rules would be exempt from HIPAA.
The more general provisions of the HIPAA privacy rules allow disclosures of protected health information when consistent with applicable law and ethical standards, including disclosures to a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public. [45 CFR 164.512 (j)(1)(i)]; or to identify or apprehend an individual who appears to have escaped from lawful custody [See 45 CFR 164.51`2 (j)(1)(ii)(B)]. These provisions would apply to juveniles under ICJ supervision who have absconded or otherwise violated the terms of their supervision and need to be apprehended.
Additionally, HIPAA specifically authorizes disclosures of protected health information to law enforcement officials who need the information in order to provide health care to the individual and for the health and safety of the individual. [45 CFR 164.512 (k)(5)]. Under these provisions it appears that disclosures of health information which are required to provide for treatment of juveniles subject to the ICJ would also be exempt from HIPAA requirements.
Under the foregoing HIPAA rules, the law enforcement exemption [45 CFR 164.512 (f)(1)(i)] applies to “the disclosure and tracking of protected health information among authorized compact administrators’ offices concerning any juvenile subject to compact supervision, pursuant to court order as required by the ICJ and its authorized rules would be exempt from HIPAA.
In considering whether these exemptions apply to transfers of supervision and return of juveniles involving non-member states, it is important to keep in mind that several U.S. territories have not adopted the Compact, including American Samoa, Guam, the Northern Mariana Islands or the Commonwealth of Puerto Rico. Until a territory adopts the Compact, no transfers of supervision or returns of juveniles are authorized or required.
As a consequence, because several territories are not members of the Compact, it is likely that transfers of supervision and return of juveniles to and from those territories would be determined by an administrative agency or court not to be covered by the above referenced HIPAA law enforcement exemption because it is not authorized to transfer juveniles, otherwise subject to the ICJ, to another state. Moreover, at least one federal court opinion on the subject suggests that immunity from a private cause of action by an individual under HIPAA would only apply to jurisdictions which are signatories to the interstate compact agreement in question. See Johnson v. Quander, 370 F.Supp.2d 79 (D.D.C. 2005).
Based upon the provisions of the HIPAA administrative rules concerning exemptions from coverage and the above referenced authorities and analysis, the law enforcement exemptions from the HIPAA would not apply to transfers and returns of juveniles involving American Samoa, Guam, the Northern Mariana Islands or the Commonwealth of Puerto Rico.