Utah Nurse Arrest Highlights Need For HIPAA Understanding
We’ve all seen the video, released a few weeks ago, of a nurse in a Utah hospital emergency room being forcibly detained by a detective as other law enforcement officers and hospital personnel look on. The video caused quite the outcry around the nation as advocacy groups called for the support of the nurse, the termination of the arresting detective, and change to procedures for handling such situations. What gave rise to the situation to begin with? The detective, along with other law enforcement personnel, entered the emergency room to request a blood sample of a patient who had been involved in a motor vehicle accident. The nurse in question refused to provide such, stating that the patient was unconscious and it was against hospital policy to take blood from an unconscious or non-consenting patient, absent the patient being under arrest. The nurse even went as far as printing out the hospital policy to show the detective, and have the detective speak to a hospital administrator via cell phone, to no avail. So who was in the wrong?
Under the HIPAA Privacy Rule, disclosure of protected health information (PHI) to law enforcement officials is allowed in certain situations. Entities involved in the intake, storage, and transmission of PHI must have policies and procedures in place to meet their HIPAA obligations. In this unfortunate situation, the detective was attempting to use HIPAA to obtain the blood sample he wanted, and the nurse was attempting to comply with HIPAA and the hospital’s policy by refusing such blood sample to the detective. The standoff between the two created quite the conundrum, as well as a rift between the hospital and law enforcement, which had otherwise enjoyed a strong working relationship. Ultimately, it seems that the detective was in the wrong, as he did not have a warrant as required by HIPAA in that circumstance, and no other HIPAA provision seemed to apply. Needless to say, the nurse was released from custody shortly after her arrest, and faced no charges.
Incidents such as this underscore the need for a strong understanding of HIPAA’s requirements, by all parties who have or may lawfully come into possession of PHI. The hospital in this case had policies in place to guard against disclosures that would violate HIPAA, and those policies were clearly known by its staff as illustrated by the nurse at issue. Furthermore, the hospital claims that its policy was developed in conjunction with the law enforcement agency involved, meaning that the arresting detective should have been more familiar with his ability to lawfully demand the blood sample. In order to avoid situations such as this, the Department of Health and Human Service’s Office of Civil Rights (OCR) has released a Frequently Asked Questions document. This document provides guidance to hospitals and other providers for their own policies and requirements, which should be shared with law enforcement agencies in order to maintain positive working relationships.
The OCR FAQ can be accessed here: FAQ on HIPAA Disclosure to Law Enforcement