Law Enforcement and Healthcare: When Consent, Privacy, and Safety Collide

Urgent message: Urgent care providers are likely to encounter law enforcement officers in the workplace at some point—and to be asked to comply with requests that may or may not violate a patient’s right to privacy, or compromise the urgent care center’s compliance with federal or state law or medical ethics. Understanding your legal rights and responsibilities is essential to fulfilling your obligations to both the patient and the law.

Suzanne Cate Jones and Anne M. Brendel
Introduction
On the heels of the widely publicized incident involving the arrest of a Utah emergency room nurse for refusing a law enforcement officer’s demand that she draw blood from an unconscious patient without the patient’s consent, ED and urgent care providers may be left wondering how to appropriately respond when receiving requests from law enforcement. Such requests can trigger multiple compliance issues, including patient privacy and consent requirements, particularly when a provider’s compliance with such requirements conflicts with law enforcement needs and goals, such as public safety, collection of evidence, and evidence integrity.

Providers working in emergency and urgent care settings face a unique set of challenges when dealing with law enforcement demands, due to the urgent “triage” approach (often involved when caring for patients in serious condition) and providers’ access to potentially incriminating or identifying evidence that may be sought by law enforcement. As a result, courts have found that patients in the ED have a diminished expectation of privacy because of the nature of emergency care.^1-3 Nonetheless, even with a diminished expectation of privacy, compliance with a law enforcement officer’s request is not always appropriate under the law. Thus, it is important for providers to know what the law is, in order to discern when a law enforcement request is in accord with the law and when it is not.
Complicating things further for providers, the “law” that governs such situations is not a single law but an entire network of rules and regulations, policies, and guidelines. For example, compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Fourth Amendment of the U.S. Constitution, among other laws, merely establishes a floor for what is required in connection with law enforcement requests that implicate patient privacy and consent requirements. State laws regarding privacy and consent, including criminal laws, introduce additional intricacies which vary widely across state lines.

In addition, there are facility policies and procedures, and state and national hospital associations that offer additional guidance for appropriately responding to law enforcement requests. The analysis here offers basic considerations related to appropriate provider responses to law enforcement requests when a patient has not given his or her consent or authorization with regard to a law enforcement request. Law enforcement requests to emergency providers typically include: 1) patient access; 2) fluid, body, or tissue samples; and/or 3) protected health information (PHI).

Accordingly, each of these types of requests will be discussed separately.

Requests for Patient Access
Providers who work in EDs (or urgent care settings) will be familiar with the fact that law enforcement officers are commonly present for one reason or another, because their duties often include responding to car accident scenes or other circumstances that involve injured people who need medical treatment (sometimes as a result of criminal activity). When not already present, law enforcement also may be specifically called by the hospital or urgent care facility in order to assist a provider in certain situations. In these and other types of circumstances, law enforcement officers may request access to an admitted patient in the ED or urgent care facility who has not consented to access.
There are several rules that govern whether or not law enforcement may appropriately have access to an admitted patient who has not given consent or authorization for such access.

Generally, law enforcement is not permitted access to a patient without that patient’s permission, unless the law enforcement officer has presented a warrant, restraining order, or other court order—in spite of the aforementioned diminished expectation of privacy. Patients have a right of protection from unreasonable searches and seizures under the Fourth Amendment of the U.S. Constitution Providers, however, should fully cooperate in seeking to obtain the patient’s consent when a law enforcement officer requests access to a patient. On the other hand, if a provider believes that such access might impede the patient’s care, access may be refused, unless a warrant, restraining order, or other court order is presented specifically permitting law enforcement access. Then, providers should allow the officer access consistent with the order.

Circumstances in which it is typically appropriate for a law enforcement officer to have access to an admitted patient without patient consent include instances where access to a patient is needed for safety purposes. For example, if access is requested for the safety of patients and/or security of facility staff because a patient has made threats or exhibited other behavior indicating that law enforcement protection is warranted, then law enforcement may be allowed access, as necessary. Access in such a case is dependent upon necessity (ie, whether it’s necessary that law enforcement be present for safety reasons). In these types of situations, safety concerns will prevail over privacy protections—with limitation. For example, with regard to patients in police custody, it may not always be appropriate to have law enforcement inside a patient’s room during an examination, when waiting outside is sufficient as determined by the HIPAA-covered provider/facility as long as it’s consistent with the order or warrant.

It is also useful to note that, pursuant to various laws and state hospital association guidance, law enforcement is permitted to accompany a patient who is in law enforcement custody, in the ED or urgent care center, while the patient is being treated in connection with legitimate law enforcement activities.^4-6 In these cases, providers should take necessary precautions to limit disclosure of PHI to only what is necessary for the legitimate activity, and limit disclosure of other PHI belonging to the patient to the extent possible. In addition, if and when the scope of such request expands to include a body fluid or tissue sample in connection with a criminal investigation related to the patient, then state law regarding informed consent for medical services will apply, in addition to federal and state privacy laws.

Requests to Obtain Body, Fluid, or Tissue Samples from Patient
Generally, providers may not render medical services without the patient’s consent, unless performance of emergency, lifesaving care is necessary. Taking samples from a patient is a type of medical service; thus, state consent laws apply. In addition, providers may not disclose PHI without patient authorization. State consent laws limit providers’ responses to requests from law enforcement to obtain body, fluid, or tissue samples from a patient, and federal and state privacy laws limit disclosure of the sample results.

EMTALA considerations
It appears that the law continues to be unsettled regarding whether or not the Emergency Medical Treatment and Active Labor Act (EMTALA) requires an ED or urgent care center to perform a medical screening examination (MSE) on an individual who is accompanied by law enforcement. EMTALA requires an MSE if 1) an individual comes to the ED (which includes individuals brought to the ED by law enforcement), or, in some cases, an urgent care center,⁷ and 2) there is a request for examination or treatment of a medical condition.⁸ Additional legal and regulatory complexities arise when a patient is not personally requesting an MSE or experiencing an emergency condition.⁹ In fact, CMS interpretive guidelines state that a hospital may not be required to provide an MSE to such individuals.¹⁰ In such cases, EMTALA requires providers to take reasonable steps to obtain the patient’s written informed consent to refuse or waive examination and treatment of a medical condition.¹¹

State consent considerations
As a general rule, the patient must consent for law enforcement to obtain a patient sample, or the law enforcement officer must be in possession of a warrant or administrative request.^12,13 In most states, the law requires that licensed drivers consent to blood or urine testing following an arrest for driving under the influence when they obtain their driver license. These laws are considered “implied consent laws.”

Under implied-consent laws, blood draws may be performed on an unconscious patient in an ED or urgent care if the patient has been arrested for driving under the influence because the patient has already consented to such a blood draw when obtaining his or her license. However, if the patient who has been arrested for a DUI is conscious, then the patient cannot be forced to submit to a blood draw.  Thus, a blood draw may be performed only with the patient’s consent, unless the law enforcement officer has an applicable court order or warrant. Even though drivers have consented to blood or urine tests prior to obtaining their driver licenses, at the time of law enforcement’s request for a blood draw, patients may still choose to withhold their consent and be subject to legal consequences for such withholding. Providers may be protected from civil liability for taking and/or being required to take a patient’s blood sample from patients who are arrested or involved in a car accident pursuant to a law enforcement request.¹⁴

HIPAA considerations
There are some exceptions to the consent requirement under HIPAA in specified circumstances that implicate health and safety concerns. Specifically, blood draw results, or other PHI, may be disclosed without patient authorization to avert a serious threat to the individual’s or the public’s health or safety. Depending on the state, providers may even be required to notify law enforcement of any blood test result that indicates the patient’s blood alcohol level is at or above the legal limit or of the presence of a controlled substance, but only if the provider is providing medical care immediately after the patient’s involvement in a car accident.

As stated above, federal and state privacy laws limit disclosure of the results of body, fluid, or tissue samples taken from a patient, when certain conditions are present. This is because the result of the blood draw, or any other sample taken from a patient, if accompanied by patient identifiable information, constitutes PHI and thus triggers HIPAA and state privacy laws, as discussed below. Patient samples alone, however, are not PHI. As such, samples (or sample results) may be provided to law enforcement without patient authorization, but only if the sample is not accompanied by information identifying the patient, and the results have been de-identified. Such information does not constitute PHI under HIPAA because PHI must be individually identifiable. 

Requests for PHI
HIPAA and state privacy laws generally prohibit the disclosure of PHI to law enforcement. However, a provider may disclose PHI to law enforcement without patient authorization, including individually identifiable samples or sample analyses, under certain circumstances. It is important to note that disclosures of an individual’s identifiable DNA, dental records, body, fluid, or tissue samples or analysis cannot be disclosed without a court order, warrant, or written administrative request in the following situations:

1. When required by law

Providers may disclose PHI to law enforcement when disclosure is required by state law (eg, gunshot wounds). HIPAA permits disclosure of PHI as necessary to comply with state laws. A provider may also disclose PHI in response to 1) an administrative request (ie, an administrative subpoena), 2) a civil or authorized investigative demand, or 3) some other authorized legal process.

The conditions for disclosure are 1) that the information sought is relevant and material to a legitimate law enforcement inquiry, 2) that the request is specific and limited in scope (to the extent reasonably practicable), and 3) that de-identified information could not be reasonably used. Such disclosure should be limited to the PHI requested.

2. Law enforcement requests relating to identification and location

When requests are made by law enforcement for PHI without being accompanied by an administrative or court order, a provider’s disclosure of PHI must be limited to disclosures for identifying and locating a suspect, fugitive, material witness, or missing person. Even then, providers are not given free-rein to respond to such requests. Such disclosure should be limited in accordance with the limitations described below.

3. Provider is a victim or crime occurs on hospital or urgent care facility premises

In the event that a provider is the victim of a crime (for example, a patient assaults a provider), then the provider─victim may disclose PHI to law enforcement, provided that the PHI disclosed is 1) about the suspected perpetrator of the crime and 2) limited to information for identification and location purposes. If a crime occurs on the facility’s premises, a provider may report PHI that he or she believes, in good faith, to be evidence. Such disclosure should be limited in accordance with the limitations described below.

4. To apprehend a perpetrator

A provider may disclose PHI to law enforcement when the provider reasonably believes a patient may have caused serious physical harm to a victim—provided that the admission was not made in the course of or based on the individual’s request for therapy, counseling, or treatment related to the propensity to commit a violent act. Such disclosure should be limited in accordance with the limitations described below.

5. To avert a serious threat to health or safety

A provider may disclose information that he or she believes, in good faith, is 1) necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and 2) is to a person who can reasonably prevent or lessen the threat or is necessary for law enforcement authorities to apprehend an individual. Such disclosure should be consistent with ethical standards and limited in accordance with the limitations described below.

Limitations on certain disclosures of PHI
Where indicated above, disclosures are limited to the following information: name and address, date and place of birth, Social Security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics (ie, height, weight, gender, race, hair and eye color, facial hair, scars, and tattoos). State laws may further restrict provider disclosures.

Conclusion
Providers who work in ED and urgent care settings will be faced with law enforcement requests that trigger multiple compliance issues. As discussed above, a provider’s response to a law enforcement request is limited by applicable federal and state law and facility policies and procedures. Unless law enforcement has presented a warrant, restraining order, or other court order requiring a different response, providers must obtain appropriate consent from patients prior to providing access to patients or obtaining samples from patients. In addition, providers must keep patient PHI safe and endeavor to balance patient and public safety and privacy protections when dealing with such requests.

(Authors’ note: Our intent here is to provide basic considerations for healthcare providers when faced with law enforcement requests in an ED or urgent care setting. However, the content of this article does not constitute legal advice. This article should not be used as a substitute for obtaining legal advice from an attorney licensed to practice in your jurisdiction. Providers should consult their facility policies, ask their facility’s general counsel, and/or seek outside counsel advice whenever questions arise with regard to law enforcement requests related to patients.)

References

1. Wilson v State. 99 S.W.3d 767 (Tex. App. 2003).
2. Buchanan v State. 432 So. 2d 147 (Fla. Dist. Ct. App. 1983).
3. State v Rheaume. 2005 VT 106.
4. Oregon Association of Hospitals and Health Systems. HIPAA and Law Enforcement – Guidelines for Release of Protected Health Information (PHI) in Oregon (2013). Available at: https://community.corporatecompliance.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=129e6da4-7a3d-4a20-a4d9-356a729356cd. Accessed January 8, 2018.
5. Washington State Hospital Association. Hospital and Law Enforcement Guide to Health Care Related Disclosure, Eighth Edition (2017). Available at: http://www.wsha.org/wp-content/uploads/HIPAA-Guide-2017-Update.pdf. Accessed January 8, 2018.
6. Florida Hospital Association, HIPAA Requirements and Florida Law – Disclosure of Protected Health Information for Law Enforcement Purposes (2016). Available at: http://www.fha.org/showDocument.aspx?f=HIPAA_Requirements_and_Law_Enforcement_Guide.pdf. Accessed January 8, 2018.
7. Medicare State Operations Manual. Appendix V – Interpretive Guidelines – Responsibilities of Medicare Participating Hospitals in Emergency Cases § IV (Task 2 – Care Selection Methodology). Available at: https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/som107ap_V_emerg.pdf. Accessed January 8, 2018.
8. Oregon Association of Hospitals and Health Systems, Hospital & Law Enforcement Guidance for Conducting Forensic Blood Draws. March 2016. Available at: https://www.oahhs.org/sites/default/files/forensic_blood_draw_guidance_FINAL_March2016.pdf. Accessed January 8, 2018.
9. Bitterman RA. Blood alcohols, labs, and minor treatments in the ED: is a medical screening exam required by EMTALA? ACEP News. July 1998. Available at: https://www.acep.org/Clinical—Practice-Management/Blood-Alcohols,-Labs-and-Minor-Treatments-in-the-ED–Is-a-Medical-Screening-Exam-Required-by-EMTALA-/. Accessed January 8, 2018.
10. Centers for Medicare and Medicaid Services. State Operations Manual Appendix V – Interpretive Guidelines – Responsibilities of Medicare Participating Hospitals in Emergency Cases. July 2010. Available at: https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/som107ap_V_emerg.pdf. Accessed January 8, 2018.
11. Examination and Treatment for Emergency Medical Conditions and Women in Labor (EMTALA). 45 U.S.C. § 1395dd(b)(2).
12. Missouri v McNeely. 569 U.S. 141. 2013.
13. American Hospital Association. Guidelines for Releasing Patient Information to Law Enforcement. Available at: http://www.aha.org/content/00-10/guidelinesreleasinginfo.pdf. Accessed January 8, 2018.
14. Pennsylvania Title 75 Pa.C.S.A. Vehicles § 1547(j).