Source: https://www.tdcaa.com/journal/hipaa-in-the-county-and-district-attorneys-world/
Timestamp: 2019-04-19 02:16:18+00:00

Document:
Mention the Health Insurance Portability and Accountability Act of 1996,1 otherwise known as HIPAA, to someone in law enforcement or a county or district attorney’s office and you’ll likely receive one of a few responses: “[expletive deleted],” “I don’t have to worry about HIPAA because it doesn’t apply to me,” or “I can’t ever get the medical records I need without a fight!” It’s often accompanied by changes in a person’s physical appearance: redness of the face and neck, clenched fists, increased and rapid heart rate, and an unwavering glare. You can’t help but wonder which of these responses is correct.
It’s been my experience that it’s easier to learn something when you see how it applies in the real world, so this article presents a fairly straightforward hypothetical about health information and then analyzes the issues it presents under HIPAA’s Privacy Rule and several relevant Texas confidentiality statutes. It concludes with a “final answer” for each issue as to whether and how health information can be disclosed, plus what the requestor’s office must do to comply with HIPAA and with Texas law.
An assistant district attorney (ADA) is preparing his burglary case against a defendant. He issues a subpoena to the county hospital requesting the defendant’s medical records; she had cut her arm on the glass door of a house she had broken into (allegedly to burgle) as she tried to flee from the homeowner. The homeowner heard someone breaking into her house and immediately called the police. The homeowner then chased the defendant into the backyard, tackled her to the ground, and held her until police arrived. The defendant was taken to the county hospital for treatment for her injuries and was then taken to the county jail.
The ADA also sends a subpoena for the homeowner’s medical records to the hospital where she was treated for cuts and bruises she sustained during her fight with the defendant.
• May the ADA get the defendant’s medical records from the county hospital?
• May the ADA get the homeowner’s medical records from the other hospital?
• If the ADA obtains copies of the medical records he’s requested, must he protect the confidentiality of those records or take any special precautions with respect to handling or disposing of them?
The defendant’s medical records. When the defendant was taken to the county hospital, she was treated like any member of the general public who presents for treatment: She was registered as a patient in the emergency room and received treatment for her injuries, and that treatment was recorded in detail in her medical record. She was then discharged back to the police for transport to the county jail.
When the county hospital receives a request for the defendant’s health information, the county hospital has an obligation (as a covered entity under both HIPAA and Texas law) to protect it. HIPAA applies only to “covered entities”: 1) health plans, 2) healthcare clearinghouses, and 3) healthcare providers that transmit health information electronically in connection with HIPAA-defined transactions.2 Under Texas Health & Safety Code Chapter 181, aka “Texas’s HIPAA,” the term “covered entity” is broader, covering not just those individuals and entities, but also any individual or entity that comes into possession of health information. Therefore, the county hospital must determine 1) whether HIPAA’s Privacy Rule or Texas law will control the release of this individual’s records in this situation, and 2) whether that law requires or permits the county hospital to produce the requested medical records to the ADA in accordance with a subpoena, or whether the county hospital must obtain the defendant’s permission first.
In reality, however, while the county hospital is permitted to release the requested medical records solely because the ADA’s subpoena is valid, it is important to note that 1) such a disclosure is not mandated, it’s only allowed;13 and 2) occasionally, Texas hospitals will also require the ADA to provide a “HIPAA letter” or a “HIPAA affidavit” in addition to a subpoena before they will release the requested medical records. The HIPAA letter or affidavit sets forth the conditions that must be met under HIPAA’s Privacy Rule’s law enforcement purposes exception before the covered entity can release an individual’s PHI without first obtaining the individual’s authorization to law enforcement.14 The subpoena must specify that the information being requested is “relevant and material to a legitimate law enforcement inquiry,” that the subpoena is limited in scope and that “[d]e-identified information could not reasonably be used.” Covered entities that require HIPAA letters or affidavits in addition to valid subpoenas are in essence ensuring that their disclosure could be found proper under two exceptions to HIPAA’s Privacy Rule.
The homeowner’s medical records. While the ADA can obtain the defendant’s medical records without her written authorization under both HIPAA’s Privacy Rule and Texas law, the hospital at which the homeowner was treated will not be able to provide her medical records to the ADA until the homeowner authorizes their disclosure. In the ADA’s case against the defendant, the homeowner is a victim, not a party, so the exception allowed under Texas Health & Safety Code §241.153(20) does not apply to her.
6) the individual’s signature and date signed or, if signed by someone other than the individual, the signature of that individual, the date she signed, and a description of the authority of that individual to act on behalf of the individual.
Many covered entities prefer (or require) the requestor to use the covered entity’s HIPAA Authorization. In some cases, the reason for this requirement is because the employees responsible for confirming an authorization is “valid,” as required by HIPAA’s Privacy Rule, are unfamiliar with forms other than those on which they have received training.
3) permitted uses and disclosures.
Texas’s HIPAA’s “covered entity” is defined as any person who handles PHI, including a business associate, healthcare payer, governmental unit, information or computer management entity, school, health researcher, healthcare facility, clinic, healthcare provider, or person who maintains an Internet site.19 Texas’s definition is far broader than HIPAA’s.
Unlike HIPAA’s Privacy Rule, which describes in some detail what a covered entity can do with PHI and how the covered entity must do it, the primary focus of Texas’s HIPAA is on what the covered entity is prohibited from doing with PHI.25 Under Texas’s HIPAA, the prosecutor’s office’s sole affirmative obligation to the individuals whose PHI is obtained by and stored in the office is to notify them that their PHI is subject to electronic disclosure.26 Nonetheless, the fact that the prosecutor office is required to conduct training that addresses both state and federal law could be interpreted to mean that Texas covered entities are expected to protect the PHI in their possession. The Texas Attorney General is responsible for enforcing Texas Health & Safety Code Chapter 181 and has the power to seek injunctive relief and impose civil penalties against a Texas covered entity for a violation of the law. In addition, §181.202 provides that “a covered entity that is licensed by an agency of this state is subject to investigation and disciplinary proceedings, including probation or suspension by the licensing agency.” While the likely intent of the Texas Legislature was that §181.202 would apply only to covered entities that were licensed healthcare individuals and entities, the section could also be interpreted to include attorneys who use and/or access PHI. While state attorneys general can enforce HIPAA, it is not common—only four have ever done it, and Texas’s AG has never taken any such action.
Evaluating and adopting the relevant administrative requirements in HIPAA’s Privacy Rule27 would certainly help the prosecutor’s office demonstrate it had taken “reasonable steps” to protect the PHI in its possession.
Many prosecutors reading this article may wonder what, if anything, they must do to protect the health information they obtain given their discovery obligations under the Michael Morton Act.28 The good news is, provided that the ADA has properly obtained that information in accordance with HIPAA’s Privacy Rule and with Texas law, and provided that the prosecutor’s office has implemented “reasonable steps” to protect the health information in its possession, health information need not be treated any differently from any other documents, papers, or written or recorded statements related to the criminal case during discovery.
The ADA is not a covered entity under HIPAA’s Privacy Rule, so the prosecutor is free to disclose health information without regard to HIPAA’s Privacy Rule. The ADA is a covered entity only under Texas’s HIPAA, and Texas’s HIPAA does not prohibit the ADA from re-disclosing health information, only from selling it, using the health information for marketing purposes, or re-identifying the individual from the health information.29 Because disclosing the health information in accordance with the Michael Morton Act is not one of the prohibited disclosures under Texas’s HIPAA, prosecutors should not be concerned about potential enforcement activities, either under HIPAA or under Texas’s HIPAA, with respect to their providing health information to the defense during discovery in accordance with the Michael Morton Act.
HIPAA’s Privacy Rule, and to an extent Texas law, requires covered entities to protect the health information in their possession, and these laws subject those covered entities to significant civil and criminal penalties30 if they fail. Covered entities rightly fear being held liable for those penalties, so they take extra care to ensure that every disclosure is proper, which occasionally makes even the simplest release take longer than it should.
Law enforcement and prosecutors should recognize they’re more likely to receive the health information they request when they 1) convey their identity and the fact that they have the authority to obtain the information, 2) describe their reason for needing the information (i.e., describe the purpose of the disclosure), 3) ensure that the facts and circumstances of their request meet the criteria of an authorized disclosure, and 4) make their request in a professional and respectful manner. And when law enforcement and prosecutors come into possession of health information, they must recognize that Texas law imposes an obligation on their employers to properly train employees and take “reasonable steps” to protect and safeguard that information.
Please note: The views and opinions expressed in this paper are those of the author and do not necessarily reflect the official policy or position of Harris County.
1 Pub. L. No. 104-191, 110 Stat. 1396 (1996).
2 See 42 U.S.C. §1320d-1(a). See also 45 C.F.R. §160.103.
3 See 45 C.F.R. §160.200 et seq.
4 Find it at https://www.texasattorneygeneral.gov/files/agency/hipaa.pdf.
6 45 C.F.R. §164.512(f). Disclosures that are allowed for law enforcement purposes are to be made to a law enforcement official 1) pursuant to laws that require reporting of certain types of wounds or injuries; 2) pursuant to court orders, court-ordered warrants, or a subpoena or summons signed by a judicial officer; 3) provided the information disclosed is limited and will be used only to locate and/or identify a suspect, fugitive, material witness, or missing person; 4) when the individual is suspected to be a victim of a crime; 5) to advise law enforcement that a decedent might have died as a result of criminal conduct; 6) to report a good faith belief that a crime was committed on the covered entity’s premises; or 7) to report a real or suspected crime in an emergency.
10 Texas Health & Safety Code §241.153(20).
11 Texas AG Preemption Analysis, supra note 6, at 225.
12 Tex. Code Crim. Proc. Art. 24.03. Because the defendant is the individual on trial, she is a “party to the judicial proceeding” as required for the county hospital to release her records to the ADA under Texas Health & Safety Code §241.153(20).
13 Texas Health & Safety Code §241.153.
14 See 45 C.F.R. §164.512(f)(1)(ii)(C).
15 See 45 C.F.R. §164.512(f)(2).
18 Texas Health & Safety Code §181.001(b)(2)(B).
20 Texas Health & Safety Code §181.101(a).
21 See 45 CFR §164.530(b)(1); Texas Health & Safety Code §181.101(a).
22 See Daniel J. Solove, HIPAA Training Requirements, Frequently Asked Questions, Teach Privacy, available at https://teachprivacy.com/hipaa-training-requirements/ (last visited July 31, 2018).
23 This article’s author has recorded two different videos accredited for MCLE hours through the Texas Bar. One is a 45-minute video on HIPAA only; it’s available at http://www.harriscountycao.org/hipaa-training-program. The other is a 75-minute video at http://www.harriscountycao.org/hipaa-181-training; it covers both HIPAA and Texas’s HIPAA. Each one has a link to YouTube in case the video can’t be viewed through the Harris County website. There’s also a form at the bottom of each page that viewers can complete to receive MCLE hours.
24 Texas Health & Safety Code §181.101. HIPAA’s Privacy Rule requires those statements be maintained for a minimum of “six years from the date [the statement is signed].” 45 CFR §164.530(j)(2).
25 See Texas Health & Safety Code, Chapter 181, Subchapter D. A covered entity cannot 1) re-identify or attempt to re-identify an individual based on his or her PHI unless the covered entity obtains the individual’s consent or authorization; 2) use PHI for marketing purposes; or 3) sell PHI for direct remuneration. A covered entity is also prohibited from electronically disclosing an individual’s PHI without first obtaining his or her authorization unless the disclosure is for purposes of treatment, payment, or healthcare operations. Note that legal offices are not “custodians” of the records they receive for case preparation, so they are not bound by the authorization requirement. In the electronic service of medical records filed with the court for use at trial, I strongly recommend that both the State and defense counsel file a joint protective order to protect medical records from everyone but the lawyers, the parties, and the court.
26 Texas Health & Safety Code §181.154(s).
27 See 45 C.F.R. §164.530. Besides training, the most relevant administrative requirements to consider would be the Safeguards Standard (45 C.F.R. §164.530(c)(1)), Sanctions Standard (45 C.F.R. §164.530(e)(1)), and Policies and Procedures Standard (45 C.F.R. §164.530(i)(1)).
28 See Tex. Code Crim. Proc. Art. 39.14.
29 See supra, note 25.
30 A detailed description of HIPAA’s civil and criminal penalties is beyond the scope of this article. See 42 U.S.C. §1320d-5 for a description of HIPAA’s civil penalties, and see 42 U.S.C. §1320d-6 for a description of HIPAA’s criminal penalties. See also Texas Health & Safety Code, Chapter 181, Subchapter E for a description of the Texas Attorney General’s enforcement powers under Texas’ HIPAA.

References: §241
 §181
 §181
 §1320
 §160
 §160
 §164
 §241
 Art. 24
 §241
 §241
 §164
 §164
 §181
 §181
 §164
 §181
 §181
 §164
 §181
 §164
 §164
 §164
 §164
 Art. 39
 §1320
 §1320