2 ms·

Well, tying back to the original topic, if I as a healthcare provider am not allowed to "volunteer information about you" to LE if you're in a car accident or i

Well, tying back to the original topic, if I as a healthcare provider am not allowed to "volunteer information about you" to LE if you're in a car accident or incident or similar, then why is a pharmacy allowed to, when the medications you take have a 1:1 or 1:few correlation to your healthcare? Silly specific example in this case, as a healthcare provider, I can't tell a cop you have high blood pressure, because HIPAA. A pharmacy can tell a cop you take lisinopril/HCTZ, which is only prescribed for high blood pressure, because ... shrug.

kube-system 3y ago
The difference is likely the opinion of your organization's legal guidance and the specificity and relevance of the request. HIPAA allows disclosures to subpoena requests. https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe...
- FireBeyond 3y ago
  Not quite that simple. I'm well acquainted with the Privacy Rule, for a whole multitude of reasons (you weren't implying I wasn't)... > To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena. Emphasis mine. From the article: > Instead, all the pharmacies hand over such information with nothing more than a subpoena, which can be issued by government agencies and does not require review or approval by a judge. Emphasis also mine. Police officers are not considered judicial officers, though they are officers of the court. "Judicial officers are typically categorized as judges, magistrates, puisne judicial officers such as justices of the peace or officers of courts of limited jurisdiction; and notaries public and commissioners of oaths. The powers of judicial officers vary and are usually limited to a certain jurisdiction." It seems to me that there's an extrapolation here that is not covered by HIPAA. HIPAA only refers to subpoenas issued by or reviewed by judicial officers, not a blanket allowance.
  - kube-system 3y ago
    There’s another exception for non-judicial requests too. The provision that pharmacies are using is, I believe, this one: > To respond to an administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law, provided that: the information sought is relevant and material to a legitimate law enforcement inquiry; the request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought, and de-identified information could not reasonably be used (45 CFR 164.512(f)(1)(ii)(C)).
    - FireBeyond 3y ago
      Good point. The challenge I see with that is: > the information sought is relevant and material to a legitimate law enforcement inquiry Your average PharmTech at CVS isn't assessing the legitimacy of the inquiry or its relevancy, but is instead blindly acquiescing (or being told to do so). The other part that is a problem is the use of "and": > and de-identified information There's no de-identified information in "Show me all the prescriptions you filled for Mr XYZ." But what there is is enough plausible deniability for the corporations to say they were following their interpretation of the law.
      - kube-system 3y ago
        It's a bit wordy, but it's not really asking for anything too special. Something like "I'm a police officer with ABC department, and I need to know which drugs Mr. XYZ has purchased between [x] and [y] in regards to a criminal drug trafficking investigation I am investigating" seems to satisfy all of the requirements. * "administrative request": the officer is asking * "the information sought is relevant and material to a legitimate law enforcement inquiry": they are real police, and they are investigating a crime regarding this person and these drugs. * "the request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought": It is about Mr XYZ, and it is about drugs he purchased, the crime being investigated is about the same. * "and de-identified information could not reasonably be used": because it is specifically about Mr XYZ

kube-system 3y ago

The difference is likely the opinion of your organization's legal guidance and the specificity and relevance of the request. HIPAA allows disclosures to subpoena requests. https://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe...

FireBeyond 3y ago
Not quite that simple. I'm well acquainted with the Privacy Rule, for a whole multitude of reasons (you weren't implying I wasn't)... > To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena. Emphasis mine. From the article: > Instead, all the pharmacies hand over such information with nothing more than a subpoena, which can be issued by government agencies and does not require review or approval by a judge. Emphasis also mine. Police officers are not considered judicial officers, though they are officers of the court. "Judicial officers are typically categorized as judges, magistrates, puisne judicial officers such as justices of the peace or officers of courts of limited jurisdiction; and notaries public and commissioners of oaths. The powers of judicial officers vary and are usually limited to a certain jurisdiction." It seems to me that there's an extrapolation here that is not covered by HIPAA. HIPAA only refers to subpoenas issued by or reviewed by judicial officers, not a blanket allowance.
- kube-system 3y ago
  There’s another exception for non-judicial requests too. The provision that pharmacies are using is, I believe, this one: > To respond to an administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law, provided that: the information sought is relevant and material to a legitimate law enforcement inquiry; the request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought, and de-identified information could not reasonably be used (45 CFR 164.512(f)(1)(ii)(C)).
  - FireBeyond 3y ago
    Good point. The challenge I see with that is: > the information sought is relevant and material to a legitimate law enforcement inquiry Your average PharmTech at CVS isn't assessing the legitimacy of the inquiry or its relevancy, but is instead blindly acquiescing (or being told to do so). The other part that is a problem is the use of "and": > and de-identified information There's no de-identified information in "Show me all the prescriptions you filled for Mr XYZ." But what there is is enough plausible deniability for the corporations to say they were following their interpretation of the law.
    - kube-system 3y ago
      It's a bit wordy, but it's not really asking for anything too special. Something like "I'm a police officer with ABC department, and I need to know which drugs Mr. XYZ has purchased between [x] and [y] in regards to a criminal drug trafficking investigation I am investigating" seems to satisfy all of the requirements. * "administrative request": the officer is asking * "the information sought is relevant and material to a legitimate law enforcement inquiry": they are real police, and they are investigating a crime regarding this person and these drugs. * "the request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought": It is about Mr XYZ, and it is about drugs he purchased, the crime being investigated is about the same. * "and de-identified information could not reasonably be used": because it is specifically about Mr XYZ