# Doctor/patient confidentiality and law enforcement **URL:** \ **Category:** Factual Questions\ **Created:** [January 13, 2006, 2:13am UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758 "2006-01-13T02:13:45Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![sunfish](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sunfish](https://boards.straightdope.com/u/sunfish)\ **Post date:** [January 13, 2006, 2:13am UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/1 "2006-01-13T02:13:45Z")
Yesterday I went to a new doctor for the first time. Along with my copy of the Patients’ Bill of Rights (NYS Hospital Code Sec. 405.7), I got a lengthy description of the “Notice of Privacy Practice” followed by the doctor’s affiliated hospital. Given what I’ve heard about HIPAA protections for a patient’s medical information, I was a little surprised to see that the notice details 24 general circumstances under which they would share personally identifiable medical information. Many of these exceptions have to do with billing issues and public health concerns. I’m curious about a couple relating to law enforcement. First: [QUOTE] **Law Enforcement**. We may disclose your health information to law enforcement officials for the following reasons: [ul] [li] To assist law enforcement officers with identifying or locating a suspect, fugitive, witness or missing person;[/li][li] \[/ul][/li][/QUOTE] Okay, it’s entirely possible that I’ve watched way too many episodes of _Law & Order,_ but… it was my understanding that doctor/patient confidentiality would obligate a doctor not to reveal any medical information, for the reason given above, without the express written consent of the person in question or their legal guardian (if that circumstance applied). Is that sort of confidentiality actually a dramatic device only? Second: > [@](#): > > **National Security and Intelligence Activities or Protective Services.** We may disclose your health information to authorized federal officials who are conducting national security and intelligence activities or providing protective services to the President or other important officials. How is this to be interpreted - as, e.g., “we know Osama has kidney problems and we’re trying to figure out how bad/when he needs treatment/etc.”? As “we’re looking for this individual, and we want to know if he has any medical conditions that will help us flush him out, so tell us”? Both? Just curious. ---
**Author:** ![sunfish](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sunfish](https://boards.straightdope.com/u/sunfish)\ **Post date:** [January 13, 2006, 2:15am UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/2 "2006-01-13T02:15:49Z")
Rats, this was meant to be a GQ, but if folks find something they want to debate in the OP, feel free to have at it. ---
**Author:** ![DoctorJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/doctorj/32/2904_2.png) [@DoctorJ](https://boards.straightdope.com/u/DoctorJ)\ **Post date:** [January 13, 2006, 3:25am UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/3 "2006-01-13T03:25:35Z")
Doctor/patient confidentiality is nothing at all like, say, attorney/client privilege. There are rules about with whom I can share your information, but if a good enough reason is there, your records can be subpoenaed. Most docs will do what they can to make sure the request is legit and will do anything possible to prevent any release that might be damaging, but the fact that it was communication between doctor and patient doesn’t mean it can be withheld. This is not true of mental health professionals and psychiatrists, for whom a stronger privilege exists. ---
**Author:** ![Lissa](https://avatars.discourse-cdn.com/v4/letter/l/85f322/32.png) [@Lissa](https://boards.straightdope.com/u/Lissa)\ **Post date:** [January 13, 2006, 6:27pm UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/4 "2006-01-13T18:27:22Z")
**Doctor J** can they comb through the records looking for a match for a description? As an example, if they’re looking for a suspect they know is of Chinese heritage and from blood left at the scene, is HIV positive. Can they use your records to find him? ---
**Author:** ![Gfactor](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Gfactor](https://boards.straightdope.com/u/Gfactor)\ **Post date:** [January 13, 2006, 7:42pm UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/5 "2006-01-13T19:42:01Z")
HIPAA is a floor for confidentiality rights, not a ceiling. If state privilege law prevents disclosure to law enforcement (and most states’ laws do, with some exceptions) then HIPAA does not change that. [http://www.cdphe.state.co.us/HIPAA/Countyhealthtrain.pdf](http://www.cdphe.state.co.us/HIPAA/Countyhealthtrain.pdf) (pdf). > [@](#): > > state laws that are contrary to and more stringent than the Privacy Rule are generally not preempted. A state law is more stringent if the state law provides more protections, or, in other words, has the specific purpose of protecting the privacy of health information or affects the health information in a direct, clear, and substantial way. [http://www.abanet.org/health/esource/vol2no1/camin.html](http://www.abanet.org/health/esource/vol2no1/camin.html) Here is an interesting chart comparing New York laws and HIPAA: [http://www.omh.state.ny.us/omhweb/hipaa/preemption\_html/MHLARTICLE31-33-43.htm](http://www.omh.state.ny.us/omhweb/hipaa/preemption_html/MHLARTICLE31-33-43.htm) ---
**Author:** ![Gfactor](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Gfactor](https://boards.straightdope.com/u/Gfactor)\ **Post date:** [January 13, 2006, 7:55pm UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/6 "2006-01-13T19:55:12Z")
Here is a link to the New York privilege statute: [http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAWS+&QUERYDATA=$$CVP4504$$@TXCVP04504+&LIST=LAW+&BROWSER=50681523+&TOKEN=44118885+&TARGET=VIEW](http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAWS+&QUERYDATA=%24%24CVP4504%24%24@TXCVP04504+&LIST=LAW+&BROWSER=50681523+&TOKEN=44118885+&TARGET=VIEW) The chart that I cited above seems to cover most of the exceptions. ---
**Author:** ![MEBuckner](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mebuckner/32/2896_2.png) [@MEBuckner](https://boards.straightdope.com/u/MEBuckner)\ **Post date:** [January 13, 2006, 9:07pm UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/7 "2006-01-13T21:07:49Z")
**Moderator’s Note:** Referring thread to GQ. ---
**Author:** ![sunfish](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sunfish](https://boards.straightdope.com/u/sunfish)\ **Post date:** [January 13, 2006, 9:54pm UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/8 "2006-01-13T21:54:58Z")
Interesting links, **Gfactor** , thanks. The outline of the privacy notice matches pretty well with the NY-HIPAA comparison chart. NYS doesn’t actually appear to restrict law enforcement access to patient health information very much at all, since compliance with a court order doesn’t seem to be required in all cases - just the approval of an “appropriate Commissioner.” I’m still wondering what exactly is meant by the second privacy exception I mentioned in the OP - does anyone know of any concrete examples of such an exception being used? And **Lissa** poses an interesting question about whether law enforcement (fed or local) can essentially go fishing through health records to identify an unknown person with a particular biomedical profile… I’m curious about that as well. ---
**Author:** ![Gfactor](https://avatars.discourse-cdn.com/v4/letter/g/9de053/32.png) [@Gfactor](https://boards.straightdope.com/u/Gfactor)\ **Post date:** [January 14, 2006, 3:27am UTC](https://boards.straightdope.com/t/doctor-patient-confidentiality-and-law-enforcement/339758/9 "2006-01-14T03:27:04Z")
Ok. Clarification. All of those exceptions are mental health related. And if you look at the code sections cited, the exceptions are really pretty limited. General medical information is generally confidential, subject to some other common exceptions, for example: > [@](#): > > § 265.25 Certain wounds to be reported. > Every case of a bullet wound, gunshot wound, powder burn or any other > injury arising from or caused by the discharge of a gun or firearm, and > every case of a wound which is likely to or may result in death and is > actually or apparently inflicted by a knife, icepick or other sharp or > pointed instrument, shall be reported at once to the police authorities > of the city, town or village where the person reporting is located by: > (a) the physician attending or treating the case; or (b) the manager, > superintendent or other person in charge, whenever such case is treated > in a hospital, sanitarium or other institution. Failure to make such > report is a class A misdemeanor. This subdivision shall not apply to > such wounds, burns or injuries received by a member of the armed forces > of the United States or the state of New York while engaged in the > actual performance of duty. [http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAWS+&QUERYDATA=$$PEN265.25$$@TXPEN0265.25+&LIST=SEA2+&BROWSER=07794312+&TOKEN=59779972+&TARGET=VIEW](http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAWS+&QUERYDATA=%24%24PEN265.25%24%24@TXPEN0265.25+&LIST=SEA2+&BROWSER=07794312+&TOKEN=59779972+&TARGET=VIEW) > [@](#): > > § 265.26 Burn injury and wounds to be reported. > Every case of a burn injury or wound, where the victim sustained > second or third degree burns to five percent or more of the body and/or > any burns to the upper respiratory tract or laryngeal edema due to the > inhalation of super-heated air, and every case of a burn injury or wound > which is likely to or may result in death, shall be reported at once to > the office of fire prevention and control. The state fire administrator > shall accept the report and notify the proper investigatory agency. A > written report shall also be provided to the office of fire prevention > and control within seventy-two hours. The report shall be made by (a) > the physician attending or treating the case; or (b) the manager, > superintendent or other person in charge, whenever such case is treated > in a hospital, sanitarium, institution or other medical facility. > The intentional failure to make such report is a class A misdemeanor. [http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAWS+&QUERYDATA=$$PEN265.26$$@TXPEN0265.26+&LIST=SEA2+&BROWSER=50601118+&TOKEN=59779972+&TARGET=VIEW](http://public.leginfo.state.ny.us/LAWSSEAF.cgi?QUERYTYPE=LAWS+&QUERYDATA=%24%24PEN265.26%24%24@TXPEN0265.26+&LIST=SEA2+&BROWSER=50601118+&TOKEN=59779972+&TARGET=VIEW) Other than that, law enforcement officials would need a warrant. Could they get one? On that subject I defer to **Bricker**. [How Probable does Cause have to be?](http://boards.straightdope.com/sdmb/showthread.php?t=351649) (A warrant should probably not be issued, but if it was, the evidence found would probably be admissible).