HIPAA Privacy Regulations: Uses and Disclosures For Which Consent, an Authorization, or Opportunity to Agree or Object is Not Required: Disclosures About Victims of Abuse, Neglect or Domestic Violence - § 164.512(c)
As Contained in the HHS HIPAA Privacy Rules
|
HHS Regulations |
(c) Standard: Disclosures about victims of abuse, neglect or domestic violence—(1) Permitted disclosures. Except for reports of child abuse or neglect permitted by paragraph (b)(1)(ii) of this section, a covered entity may disclose protected health information about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence:
(i) To the extent the disclosure is required by law and the disclosure complies with and is limited to the relevant requirements of such law;
(ii) If the individual agrees to the disclosure; or
(iii) To the extent the disclosure is expressly authorized by statute or regulation and:
(A) The covered entity, in the exercise of professional judgment, believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or
(B) If the individual is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents that the protected health information for which disclosure is sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.
(2) Informing the individual. A covered entity that makes a disclosure permitted by paragraph (c)(1) of this section must promptly inform the individual that such a report has been or will be made, except if:
(i) The covered entity, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or
(ii) The covered entity would be informing a personal representative, and the covered entity reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.
| HHS Description Uses and Disclosures For Which an Authorization or Opportunity to Agree or Object is Not Required: Disclosures About Victims of Abuse, Neglect or Domestic Violence |
The NPRM included two provisions related to disclosures about persons who are victims of abuse. In the NPRM, we would have allowed covered entities to report child abuse to a public health authority or other appropriate authority authorized by law to receive reports of child abuse or neglect. In addition, under proposed § 164.510(f)(3) of the NPRM, we would have allowed covered entities to disclose protected health information about a victim of a crime, abuse or other harm to a law enforcement official under certain circumstances. The NPRM recognized that most, if not all, states had laws that mandated reporting of child abuse or neglect to the appropriate authorities. Moreover, HIPAA expressly carved out state laws on child abuse and neglect from preemption or any other interference. The NPRM further acknowledged that most, but not all, states had laws mandating the reporting of abuse, neglect or exploitation of the elderly or other vulnerable adults. We did not intend to impede reporting in compliance with these laws.
The final rule includes a new paragraph, § 164.512(c), which allows covered entities to report protected health information to specified authorities in abuse situations other than those involving child abuse and neglect. In the final rule, disclosures of protected health information related to child abuse continues to be addressed in the paragraph allowing disclosure for public health activities (§ 164.512(b)), as described above. Because HIPAA addresses child abuse specifically in connection with a state's public health activities, we believe it would not be appropriate to include child abuse-related disclosures in this separate paragraph on abuse. State laws continue to apply with respect to child abuse, and the final rule does not in any way interfere with a covered entity's ability to comply with these laws.
In the final rule, we address disclosures about other victims of abuse, neglect and domestic violence in § 164.512(c) rather than in the law enforcement paragraph. Section 164.512(c) establishes conditions for disclosure of protected health information in cases involving domestic violence other than child abuse (e.g., spousal abuse), as well as those involving abuse or neglect (e.g., abuse of nursing home residents or residents of facilities for the mentally retarded). This paragraph addresses reports to law enforcement as well as to other authorized public officials. The provisions of this paragraph supersede the provisions of § 164.512(a) and § 164.512(f)(1)(i) to the extent that those provisions address the subject matter of this paragraph.
Under the circumstances described below, the final rule allows covered entities to disclose protected health information about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence. In this paragraph, references to "individual" should be construed to mean the individual believed to be the victim. The rule allows such disclosure to any governmental authority authorized by law to receive reports of such abuse, neglect, or domestic violence. These entities may include, for example, adult protective or social services agencies, state survey and certification agencies, ombudsmen for the aging or those in long-term care facilities, and law enforcement or oversight.
The final rule specifies three circumstances in which disclosures of protected health information is allowed in order to report abuse, neglect or domestic violence. First, this paragraph allows disclosure of protected health information related to abuse if required by law and the disclosure complies with and is limited to the relevant requirements of such law. As discussed below, the final rule requires covered entities that make such disclosures pursuant to a state's mandatory reporting law to inform the individual of the report.
Second, this paragraph allows covered entities to disclose protected health information related to abuse if the individual has agrees to such disclosure. When considering the possibility of disclosing protected health information in an abuse situation pursuant to this section, we encourage covered entities to seek the individual's agreement whenever possible.
Third, this paragraph allows covered entities to disclose protected health information about an individual without the individual's agreement if the disclosure is expressly authorized by statute or regulation and either: (1) the covered entity, in the exercise of its professional judgment, believes that the disclosure is necessary to prevent serious harm to the individual or to other potential victims; or (2) if the individual is unable to agree due to incapacity, a law enforcement or other public official authorized to received the report represents that the protected health information for which disclosure is sought is not intended to be used against the individual, and that an immediate enforcement activity that depends on the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.
We emphasize that disclosure under this third part of the paragraph also may be made only if it is expressly authorized by statute or regulation. We use this formulation, rather than the broader "required by law," because of the heightened privacy and safety concerns in these situations. We believe it appropriate to defer to other public determinations regarding reporting of this information only where a legislative or executive body has determined the reporting to be of sufficient importance to warrant enactment of a law or promulgation of a regulation. Law and regulations reflect a clear decision to authorize the particular disclosure of protected health information, and reflect greater public accountability (e.g., through the required public comment process or because enacted by elected representatives).
For example, a Wisconsin law (Wis. Stat §46.90(4)) states that any person may report to a county agency or state official that he or she believes that abuse or neglect has occurred. Pursuant to § 164.512(c)(1)(iii), a covered entity may make a report only if the specific type or subject matter of the report (e.g., abuse or neglect of the elderly) is included in the law authorizing the report, and such a disclosure may only be made to a public authority specifically identified in the law authorizing the report. Furthermore, we note that disclosures under this part of the paragraph are further limited to two circumstances. In the first case, a covered entity, in the exercise of professional judgment, must believe that the disclosure is necessary to prevent serious harm to the individual or to other potential victims. The second case addresses situations in which an individual who is a victim of abuse, neglect or domestic violence is unable to agree due to incapacity and a law enforcement or other public official authorized to receive the report represents that the protected health information for which disclosure is sought is not intended to be used against the individual and that an immediate law enforcement activity that depends on the disclosure would be materially and adversely affected by waiting until the individual if able to agree to the disclosure. We note that, in this second case, a covered entity may exercise discretion, consistent with professional judgment as to the patient's best interest, in deciding whether to make the requested disclosure.
The rules governing disclosure in this third set of circumstances are different from those governing disclosures pursuant to § 164.512(f)(3) regarding disclosure to law enforcement about victims of crime and other harm. We believe that in abuse situations – to a greater extent than in situations involving crime victims in general – there is clear potential for abusers to cause further serious harm to the victim or to others, such as other family members in a household or other residents of a nursing home. The provisions allowing reporting of abuse when authorized by state law, as described above, are consistent with principles articulated by the AMA's Council on Ethical and Judicial Affairs, which state that when reporting abuse is voluntary under state law, it is justified when necessary to prevent serious harm to a patient. Through the provisions of § 164.512(c), we recognize the unique circumstances surrounding abuse and domestic violence, and we seek to provide an appropriate balance between individual privacy interests and important societal interests such as preventing serious harm to other individuals. We note that here we are relying on covered entities, in the exercise of professional judgment, to determine what is in the best interests of the patient.
Finally, we require covered entities to inform the individual in all of the situations described above that the covered entity has disclosed protected health information to report abuse, neglect, or domestic violence. We allow covered entities to provide this information orally. We do not require written notification, nor do we encourage it, due to the sensitivity of abuse situations and the potential for the abuser to cause further harm to the individual if, for example, a covered entity sends written notification to the home of the individual and the abuser. Whenever possible, covered entities should inform the individual at the same time that they determine abuse has occurred and decide that the abuse should be reported. In cases involving patient incapacity, we encourage covered entities to inform the individual of such disclosures as soon as it is practicable to do so.
The rule provides two exceptions to the requirement to inform the victim about a report to a government authority, one based on concern for future harm and one based on past harm. First, a covered entity need not inform the victim if the covered entity, in the exercise of professional judgment, believes that informing the individual would place the individual at risk of serious harm. We believe that this exception is necessary to address the potential for future harm, either physical or emotional, that the individual may face from knowing that the report has been made. Second, a covered entity may choose not to meet the requirement for informing the victim, if the covered entity actually would be informing a personal representative (such as a parent of a minor) and the covered entity reasonably believes that such person is responsible for the abuse, neglect, or other injury that has already occurred and that informing that person would not be in the individual's best interests.
| HHS Response to Comments Received Uses and Disclosures For Which an Authorization or Opportunity to Agree or Object is Not Required: Disclosures About Victims of Abuse, Neglect or Domestic Violence |
The NPRM did not include a paragraph specifically addressing covered entities' disclosures of protected health information regarding victims of abuse, neglect, or domestic violence. Rather, the NPRM addressed disclosures about child abuse pursuant to proposed § 164.510(b), which would have allowed covered entities to report child abuse to a public health authority or to another appropriate authority authorized by law to receive reports of child abuse or neglect. We respond to comments regarding victims of domestic violence or abuse throughout the final rule where relevant. (See responses to comments on §§ 164.502(g), 164.510(b), 164.512(f)(3), 164.522, and 164.524.)
Comment: Several commenters urged us to require that victims of domestic violence be notified about requests for or disclosures of protected health information about them, so that victims could take safety precautions.
Response: We agree that, in balancing the burdens on covered entities from such a notification requirement against the benefits to be gained, victims of domestic abuse merit heightened concern. For this reason, we generally require covered entities to inform the individual when they disclose protected health information to authorized government authorities. As the Family Violence Prevention Fund has noted in its Health Privacy Principles for Protecting Victims of Domestic Violence (October 2000), victims of domestic violence and abuse sometimes are subject to retaliatory violence. By informing a victim of abuse or domestic violence of a disclosure to law enforcement or other authorities, covered entities give victims the opportunity to take appropriate safety precautions. See the above preamble discussion of § 164.512(c) for more detail about the requirements for disclosing protected health information about victims of domestic violence.
Comment: Some commenters argued that a consent requirement should apply at a minimum to disclosures involving victims of crime or victims of domestic violence.
Response: We agree, and we modify the proposed rule to require covered entities to obtain an individual's agreement prior to disclosing protected health information in most instances involving victims of a crime or of abuse, neglect, or domestic violence. See the above preamble discussions of § 164.512(c), on disclosures about victims of abuse, neglect, or domestic violence, and § 164.512(f)(3), on disclosures to law enforcement about crime victims.