The HIPAA privacy rules allow healthcare providers to disclose protected health information to the extent another state or federal law or regulation requires it:
A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.1
(45 C.F.R. § 164.512(a)(1)). Importantly, HIPAA only allows such disclosures if the other law requires the disclosure, not if the other law simply allows disclosures. (78 FR 5618). In cases where another law permits but does not require disclosure, HIPAA would preempt the other law and prohibit the disclosure unless another HIPAA exception applied.
MANDATORY REPORTS UNDER IDAHO LAW. Idaho law requires healthcare providers to report information to authorities under the following circumstances:
- Child abuse, abandonment or neglect.
- Vulnerable adult abuse, neglect or exploitation.
- Abuse occurring in a facility.
- Treatment of victims of a crime or injury by a firearm.
- Credible threat to an identified victim.
- Births, deaths, stillbirths and induced abortions.
- Death under suspicious circumstances.
- Certain communicable diseases.
Each of these is discussed in more detail below. Additional state or federal licensing or certification regulations may require reports for certain types of providers, e.g., Medicare conditions applicable to hospitals or long-term care facilities.
1. Child Abuse, Abandonment or Neglect.
Any physician, resident on a hospital staff, intern, nurse, … social worker, or other person having reason to believe that a child under the age of eighteen (18) years has been abused,2 abandoned3 or neglected4 or who observes the child being subjected to conditions or circumstances that would reasonably result in abuse, abandonment or neglect shall report or cause to be reported within twenty-four (24) hours such conditions or circumstances to the proper law enforcement agency or the department.
(I.C. § 16-1605(1); see also 45 C.F.R. § 164.512(b)(1)(ii)). If such a person learns of the suspected abuse or neglect in the course of performing services for a hospital or similar institution, the person “shall notify the person in charge of the institution or his designated delegate who shall make the necessary reports.” (Id.). Failure to report is a misdemeanor (Id. at § 16-1605(4)), and persons and institutions failing to make the report have been prosecuted.
Although the statute only applies if the person has “reason to believe” the child has been abused or neglected, Idaho regulators appear to interpret the statute broadly: they may expect reports if there is any allegation of abuse even if any abuse is very unlikely. When in doubt, healthcare providers may contact the appropriate agency, describe the situation without disclosing names of the patient or abusers, and ask the agency if it is reportable. If the agency requires the report, then the practitioner should document the same and make the report. If the agency concludes the situation does not require a report, the practitioner should document same.
Persons who make the report in good faith are immune from liability for making the report. (I.C. § 16-1606). Those who report “knowing the same to be false … or in bad faith or with malice” may be subject to actual damages or statutory penalties. (Id. at § 16-1607).
2. Vulnerable Adult Abuse, Neglect, or Exploitation. Idaho Code § 39-5301 et seq. applies to reports concerning “vulnerable adults,” i.e.,
a person eighteen (18) years of age or older who is unable to protect himself from abuse, neglect or exploitation due to physical or mental impairment that affects the person’s judgment or behavior to the extent that he lacks sufficient understanding or capacity to make or communicate or implement decisions regarding his person.
(Id. at § 39-5302(10)). Per the statute,
Any physician, nurse, employee of a public or private health facility, or a state-licensed or certified residential facility serving vulnerable adults, medical examiner, dentist, osteopath, optometrist, chiropractor, podiatrist, social worker, … pharmacist, physical therapist, or home care worker who has reasonable cause to believe that a vulnerable adult is being or has been abused,5 neglected6 or exploited shall immediately report such information to the [Adult Protective Services]. Provided however, that nursing facilities … and employees of such facilities shall make reports required under this chapter to the [Department of Health and Welfare].
(Id. at § 39-5303(1); see also id. at § 39-5304(1) and 45 C.F.R. § 164.512(c)(1)(i)).
When there is reasonable cause to believe that abuse or sexual assault has resulted in death or serious physical injury jeopardizing the life, health or safety of a vulnerable adult, any person required to report under this section shall also report such information within four (4) hours to the appropriate law enforcement agency.
(Id. at § 39-5303(1)). “If known, the report shall contain the name and address of the vulnerable adult; the caretaker; the alleged perpetrator; the nature and extent of suspected abuse, neglect or exploitation; and any other information that will be of assistance in the investigation.” (Id. at § 39-5304(1)). “Any person, department, agency or commission authorized to carry out the duties enumerated in this chapter shall have access to all relevant records ….” (Id. at § 39-5307).
HIPAA imposes additional requirements on reports of adult abuse:
A covered entity that makes a disclosure [per above] must promptly inform the individual that such a report has been or will be made, except if:
(i) The covered entity, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or
(ii) The covered entity would be informing a personal representative, and the covered entity reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.
(45 C.F.R. § 164.512(c)(2)).
As with child abuse, Idaho law enforcement and regulators appear to adopt a broad view of the reporting requirement. Although the statute only requires a report if the provider “has reasonable cause to believe” abuse, neglect or exploitation have occurred, regulators appear to expect reports if there is any allegation or potential for abuse even if the circumstances are such that abuse or neglect is improbable if not impossible. To be safe, providers should relay such allegations or circumstances to the relevant agency and let the agency determine whether a full report is required. Again, providers should document such contacts or reports.
Failure to report vulnerable adult abuse, neglect or exploitation is a misdemeanor. (Id. at § 39-5303(2)). Residential nursing facilities and their employees who fail to report may be subject to additional penalties. (Id.). Persons who make reports in good faith are immune from liability. (Id. at § 39-5303(5)). Persons who make reports in bad faith, with malicious purpose, or gross negligence may be subject to liability, including in certain circumstances actual damages or statutory penalties. (Id. at § 39-5303(6)).
Significantly, Idaho’s adult abuse reporting statute only applies to reports of abuse, neglect or exploitation of vulnerable adults, not all domestic abuse. However, reports of domestic or other abuse may be required under I.C. § 39-1390 or state licensing rules, as described below.
3. Reporting of Abuse in Facility. Relevant Idaho licensing regulations may require reporting of potential abuse of patients. For example, IDAPA 16.014.220.12 states, “[i]f hospital staff become aware of potential abuse or neglect of a patient, the hospital must protect the patient from future harm and report the suspicions to the appropriate legal entity.” Similarly, IDAPA 16.022.154.01 requires residential assisted living facilities to report “incidents, accidents, and allegations of abuse, neglect, or exploitation to the Idaho Bureau of Facility Standards within one (1) business day of the incident.” (IDAPA 16.03.22.161.08(a); see also id. at 16.022.161.07).
4. Treatment of Victims of a Crime or Injury Inflicted by Firearm.
[A]ny person operating a hospital or other medical treatment facility, or any physician, resident on a hospital staff, intern, physician assistant, nurse or emergency medical technician, shall notify the local law enforcement agency of that jurisdiction upon the treatment of or request for treatment of a person when the reporting person has reason to believe that the person treated or requesting treatment has received:
(a) Any injury inflicted by means of a firearm; or
(b) Any injury indicating that the person may be a victim of a criminal offense.
(I.C. § 39-1390(1)). The report to law enforcement must be made “[a]s soon as treatment permits” and (except when obtaining anonymous sexual assault evidence kits) “shall include the name and address of the injured person, the character and extent of the person’s injuries, and the medical basis for making the report.” (Id. at § 39-1390(2)).
Significantly, § 39-1390 requires the report regardless of whether the patient desires or consents to the report although, as discussed below, there is no enumerated penalty for failing to report. In the case of adult abuse, neglect or domestic violence, HIPAA requires that the provider
promptly inform the individual that such a report has been or will be made, except if:
(i) The covered entity, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or
(ii) The covered entity would be informing a personal representative, and the covered entity reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.
(45 C.F.R. § 164.512(c)(2)).
“Any person operating a medical facility, or any physician, resident on a hospital staff, intern, physician assistant, nurse or emergency medical technician, shall be held harmless from any civil liability for reasonable compliance with [the reporting requirement].” (I.C. § 39-1390(3)). Curiously, § 39-1390 does not expressly include any penalty for failure to report. The statute is part of the hospital and nursing facility licensing statutes; a regulator may try to cite a hospital or other facility for failing to make the report. Perhaps more importantly, a plaintiff might use the failure to report as a basis for a negligence per se claim if a provider failed to report and such report may have prevented subsequent harm to the patient.
5. Threat to Identified Persons. Mental health professionals (i.e., licensed physicians, professional counselors, psychologists, social workers, and licensed professional nurses) must “warn a victim if a patient has communicated to the mental health professional an explicit threat of imminent serious physical harm or death to a clearly identified or identifiable victim or victims, and the patient has the apparent intent and ability to carry out such a threat.” (I.C. § 6-1902; see also id. at § 6-1901).
The duty to warn a clearly identifiable victim shall be discharged when the mental health professional has made a reasonable effort to communicate, in a reasonable timely manner, the threat to the victim and has notified the law enforcement agency closest to the patient’s or victim’s residence of the threat of violence, and has supplied a requesting law enforcement agency with any information he has concerning the threat of violence. If the victim is a minor, in addition to notifying the appropriate law enforcement agency as required in this subsection, the mental health professional shall make a reasonable effort to communicate the threat to the victim’s custodial parent, noncustodial parent, or legal guardian.
(Id. at § 6-1903).
Failure to warn a victim or report to authorities may subject the mental health professional to lawsuits if the victim is subsequently injured. (See, e.g., Tarasoff v. Regents of the Univ. of California, 131 Cal. Rptr. 14, 551 P.2d 334 (1976)). On the other hand, those who report because they reasonably believe they have a duty to report are immune from liability for making the report. (I.C. § 6-1904(2)).
The Idaho statute is consistent with the general HIPAA exception that allows covered entities to disclose protected health information if the disclosure
(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and
(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat….
(45 C.F.R. § 164.512(j)(1)).
6. Births, Deaths, Stillbirths, and Induced Abortions. Several statutes and corresponding regulations require hospitals or other healthcare providers to report births, deaths, stillbirths, and induced abortions. (See, e.g., I.C. §§ 39-255, 39-260, 39-261, 39-272, 39-904, 39-1005). The reports must generally be made to the Bureau of Vital Statistics and contain such information as required by the statute or regulations.
7. Death from Violence or Suspicious Circumstances. Any person who finds or has custody of a body must report to a coroner or local law enforcement if:
(a) The death occurred as a result of violence, whether apparently by homicide, suicide or by accident;
(b)The death occurred under suspicious or unknown circumstances; or
(c) The death is of a stillborn child or any child if there is a reasonable articulable suspicion to believe that the death occurred without a known medical disease to account for the stillbirth or child's death.
(I.C. § 19-4301A(1)). Persons who fail to report may be subject to criminal fines and penalties. (Id. at § 19-4301A(2)).
8. Certain Communicable Diseases. Idaho statutes and regulations require reports of certain communicable diseases, including those set forth below. This is consistent with HIPAA, which allows disclosure to public health authorities “authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions.” (45 C.F.R. § 164.512(b)(1)(i)).
a. Reportable Diseases. Licensed physicians, physician assistants, certified nurse practitioners, registered nurses, school health nurses, infection surveillance staff, laboratory directors, and hospital administrators must report to the Department of Health and Welfare if persons are diagnosed with or treated for a long list of communicable diseases specified in IDAPA 16.02.10.050 (available here). (IDAPA 16.02.10.020). The deadline for reporting generally ranges from immediately to three working days depending on the disease. (See id. at 16.02.10.100 et seq.). The report must generally include:
(a) The identity and address of the attending licensed physician or the person reporting;
(b) The diagnosed or suspected disease or condition;
(c) The name, current address, telephone number, birth date, age, race, ethnicity, and sex of the individual with the disease or other identifier from whom the specimen was obtained;
(d) The date of onset of the disease or the date the test results were received; and
(e) In addition, laboratory directors must report the identity of the organism or other significant test result.
(Id. at 16.02.10.040.01). Failure to report may result in civil and criminal penalties. (Id. at 16.02.10.022; see also I.C. §§ 39-108, 39-109, 39-607, 39-1006, and 56-1008).
b. Venereal Diseases and Certain Oher Sexually Transmitted Diseases.
Any physician or other person who makes a diagnosis of or treats a case of venereal disease, and any superintendent or manager of a hospital, dispensary or charitable or penal institution, in which there is a case of venereal disease, shall immediately make a report of such case to the department of health and welfare, according to such form and manner as the state board of health and welfare shall direct, including syphilis, gonorrhea, AIDS, AIDS-related complexes, other manifestation of HIV, chancroid and hepatitis B.
(I.C. § 39-602). Failure to report may result in criminal or civil fines. (Id. at § 39-607).
c. Blood Tests Following Potential Exposure. Idaho Code § 39-4505 allows a physician to
order tests of a patient's or a deceased person's blood or other body fluids for the presence of blood-transmitted or body fluid-transmitted viruses or diseases [e.g., hepatitis, malaria, syphilis, or HIV] without the prior consent of the patient if:
(a) There has been or is likely to be a significant exposure to the patient's or a deceased person's blood or body fluids by a person providing emergency or medical services to such patient which may result in the transmittal of a virus or disease; and
(b) The patient is unconscious or incapable of giving informed consent and the physician is unable to obtain consent pursuant to section 39-4504, Idaho Code.
(I.C. § 39-4505(1); see also IDAPA 16.02.10.060). If such tests are conducted,
[r]esults of tests … which confirm the presence of a blood-transmitted or body fluid-transmitted virus or disease shall be reported to the director of the department of health and welfare in the name of the patient or deceased person…. The exposed person shall only be informed of the results of the test and shall not be informed of the name of the patient or deceased person. Protocols shall be established by hospitals to maintain confidentiality while disseminating the necessary test result information to persons who may have a significant exposure to blood or other body fluids and to maintain records of such tests to preserve the confidentiality of the test results.
(Id. at § 39-4505(3)).
d. Inflammation of Eyes of Newborn. Any physician, surgeon, obstetrician, midwife, nurse, maternity home or hospital, or other person assisting the infant must report to DHW “[a]ny inflammation, swelling, or unusual redness in either one (1) or both eyes of any infant, either apart from, or together with any unnatural discharge from the eye or eyes of such infant, independent of the nature of the infection, if any, occurring at any time within two (2) weeks after the birth of such infant.” (I.C. §§ 39-901 and 39-902). The report is to enable and ensure that the infant receives an appropriate germicide. (Id. at § 39-903).
e. PKU Tests of Newborns. Hospital administrators must ensure phenylketonuria (PKU) are performed on newborns (unless exempted by IC 39-912) and that the test results are reported to DHW. (IC 39-909).
OTHER COMMON SITUATIONS. The following are additional common situations when the issue of reporting comes up.
1. Demands by law enforcement. Law enforcement officers may request or demand that hospitals or other providers report disclose certain information, e.g., motor vehicle accidents, discharge of certain patients, etc. HIPAA does contain certain limited exceptions that allow disclosures to law enforcement under specific circumstances, but the terms and conditions of those requirements must be satisfied (45 C.F.R. § 164.512(f)); there is no general exception that permits hospitals or other providers to disclose information merely because law enforcement requests it. For more information about disclosures to law enforcement, see here and here.
2. Subpoenas, court orders and warrants. Healthcare providers may be required to disclose information in response to subpoenas, court orders, or warrants. Again, however, HIPAA has specific rules and conditions for making such disclosures. (See 45 C.F.R. § 164.512(e)). For more information about disclosures pursuant to an order, warrant, or subpoena, see here.
3. Disclosures to licensing agencies. HIPAA contains a broad exception that allows reports to licensing agencies and government healthcare programs subject to certain limitations:
A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:
(i) The health care system;
(ii) Government benefit programs for which health information is relevant to beneficiary eligibility;
(iii) Entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or
(iv) Entities subject to civil rights laws for which health information is necessary for determining compliance.
(45 C.F.R. § 164.512(d)(1)).
4. Patients who are unfit to drive. Idaho Code 49-326(c)(4) states:
Any physician who has reason to believe that a patient is incompetent to drive a motor vehicle as defined in this subsection, may submit a report to the department. Before submitting a report, a physician should notify the patient or the patient’s family of the physician’s concerns about the patient’s ability to drive. If the physician submits a report, the physician shall provide a copy of the report to the patient or to a member of the patient’s family. If a physician submits a report in good faith, no professional disciplinary procedure, no monetary liability and no cause of action may arise against the physician for submission of the report.
(Emphasis added). The problem is that the statute allows, but does not require, the report; accordingly, it does not fall within the HIPAA exception applicable to laws that require reports, and HIPAA preempts the Idaho statute. In its 2013 HIPAA omnibus rule, the Department of Health and Human Services addressed this issue in the context of immunization laws:
We take this opportunity to clarify that the Privacy Rule at § 164.512(a) permits a covered entity to use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. As such, the Privacy Rule does not prohibit immunization disclosures that are mandated by State law, nor does it require authorization for such disclosures.… However, with regard to State laws that permit but do not require covered entities to disclose immunization records to schools, this does not meet the requirements of the provisions at § 164.512(a), and disclosures of immunization records are subject to the Privacy Rule agreement and documentation requirements described in this part.
(78 FR 5618, emphasis added). Accordingly, a physician may not make the report under HIPAA even if allowed by Idaho law unless another HIPAA exception applies. For example, the report may be made if the physician believes it is necessary to “prevent or lessen a serious and imminent threat to the health or safety of a person or the public” under 45 C.F.R. § 164.512(j)).
5. Dog bites. There does not appear to be any general Idaho law that requires reports of dog bites. It is possible, however, that some city or county ordinance requires such reports. Also, as discussed above, it may be necessary to report under IDAPA 16.02.10.020 if there is a concern about rabies. Also, Idaho Code 25-2810 makes it a crime to own, possess or harbor a dangerous dog under certain circumstances. Treating a person for a bite from a dangerous dog might require a report per I.C. § 39-1390 as discussed above.
CONCLUSION. HIPAA generally prohibits disclosures of protected health information unless there is an exception. While HIPAA allows disclosures to the extent another law requires the disclosure, covered entities must ensure that they act consistent with the requirements of such laws and limit disclosures accordingly.
Endnotes:
1Although HIPAA allows disclosures required by law, HIPAA requires that the covered entity satisfy certain additional requirements described in 45 C.F.R. § 164.512(c), (e), and (f) for disclosures about victims of abuse, neglect, or domestic violence (45 C.F.R. § 164.512(c); disclosures for judicial or administrative proceedings (id. at § 164.512(e), and disclosures to law enforcement (id. at § 164.512(f)). (Id. at § 164.512(a)(2)).
2As defined by statute,
“Abused” means any case in which a child has been the victim of:
(a) Conduct or omission resulting in skin bruising, bleeding, malnutrition, burns, fracture of any bone, head injury, soft tissue swelling, failure to thrive or death, and such condition or death is not justifiably explained, or where the history given concerning such condition or death is at variance with the degree or type of such condition or death, or the circumstances indicate that such condition or death may not be the product of an accidental occurrence; or
(b) Sexual conduct, including rape, molestation, incest, prostitution, obscene or pornographic photographing, filming or depiction for commercial purposes, human trafficking … or other similar forms of sexual exploitation harming or threatening the child’s health or welfare or mental injury to the child.
(I.C. § 16-1602(1)).
3“‘Abandoned’ means the failure of the parent to maintain a normal parental relationship with his child including, but not limited to, reasonable support or regular personal contact.” (I.C. § 16-1602(2)).
4“Neglected” means a child:
(a) Who is without proper parental care and control, or subsistence, medical or other care or control necessary for his well-being because of the conduct or omission of his parents, guardian or other custodian or their neglect or refusal to provide them; however, no child whose parent or guardian chooses for such child treatment by prayers through spiritual means alone in lieu of medical treatment shall be deemed for that reason alone to be neglected or lack parental care necessary for his health and well-being…; or
(b) Whose parent, guardian or other custodian is unable to discharge the responsibilities to and for the child and, as a result of such inability, the child lacks the parental care necessary for his health, safety or well-being; or
(c) Who has been placed for care or adoption in violation of law; or
(d) Who is without proper education because of the failure to comply with section 33-202, Idaho Code.
(I.C. § 16-1602(31)).
5“‘Abuse’ means the intentional or negligent infliction of physical pain, injury or mental injury.” (IC 39-5302(1)).
6“‘Neglect’ means failure of a caretaker to provide food, clothing, shelter or medical care reasonably necessary to sustain the life and health of a vulnerable adult, or the failure of a vulnerable adult to provide those services for himself.” (IC 39-5302(7)). However, nothing in the Idaho statute “shall be construed to mean a person is abused, neglected, or exploited for the sole reason he is relying upon treatment by spiritual means through prayer alone in accordance with the tenets and practices of a recognized church or religious denomination…” (Id. at 39-5302).