April 17, 2018

Protected Health Information and Use-of-Force Investigations

By William P. Bozeman, M.D., Jason P. Stopyra, M.D., Patricia Corn, M.S.N., and J.T. Moser

A stock image of a patient medical history form and HIPPA regulations form.

Law enforcement officers sometimes must employ force to protect citizens and apprehend criminal suspects. Such use-of-force events face unprecedented scrutiny, making the investigation and review process more important than ever. Agencies need to ensure compliance with their policies and protect themselves and their officers from accusations of unnecessary or inappropriate use of force.

One of the critical components of the use-of-force investigation involves determining whether suspects suffered serious harm or injury due to police actions. This proves important not just from a public-relations perspective but from regulatory and legal risk-management standpoints.

The National Use-Of-Force Data Collection component of the FBI’s Uniform Crime Reporting Program has begun including all firearm discharges—with or without injury—and all deaths and serious bodily injuries related to any kind of police use of force. The definition used for serious bodily injury is one “that involves a substantial risk of death, unconsciousness, protracted and obvious disfigurement, or protracted loss or impairment of the function of a bodily member, organ, or mental faculty.” The International Association of Chiefs of Police (IACP), Police Executive Research Forum (PERF), and other entities have helped develop these reporting requirements.¹

To this end, agencies must determine not just the possibility of injury that prompts transport of a suspect to an emergency department but the degree of actual harm sustained. This involves a medical determination based not on officer reports or observations of potential injuries, but on a thorough medical evaluation to determine actual wounds.

As emergency physicians and police use-of-force researchers, the authors have seen such incidents result in many potentially serious injuries (e.g., gunshot wounds or canine bites) ultimately deemed minimal and some apparently minor wounds (e.g., scrapes or bruises) that indicated severe or even life-threatening internal injuries.

Further complicating matters, suspects can sustain wounds or conditions not from police use of force, but by their own actions (e.g., self-harm or blunt trauma sustained from a car accident during an attempt to elude officers), other criminal activity (e.g., illicit drug use), or preexisting medical or psychiatric conditions.

Through their research for an upcoming study, the authors found that over 75 percent of suspects taken to an emergency department after police use of force were discharged without serious harm. Most of the remaining individuals admitted to the hospital were taken in for medical or psychiatric reasons unrelated to officers’ actions.² These facts make it clear that persons transported to a medical facility for evaluation or even admission after an incident involving force are not adequate surrogates for the presence of serious bodily injury caused by police.

So, faced with the need to determine whether death or serious bodily harm has occurred due to use of force, what can law enforcement agencies do? Fortunately, they have both hope and a clear answer.

Protected Health Data

In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA). Broadly, it focuses on protecting and allowing for continued health insurance coverage when workers lose or change jobs and presents standards for electronic sharing of health information.³

Several administrative rules promulgated by the U.S. Department of Health and Human Services (HHS) further define protected health information (PHI) and provide for its privacy and security. In general, outside of health care provision and billing, access to someone’s PHI is carefully guarded, and the individual must approve any release of such information.⁴

However, use and disclosure of PHI without individual authorization is allowed for certain “public interest and benefit activities,” such as reporting for public health; victims of abuse, neglect, or domestic violence; health oversight; judicial and administrative proceedings; law enforcement use; organ, eye, or tissue donation; research; serious threats to health or safety; essential government functions; and workers’ compensation.⁵

Each of these areas has specific limitations defined within the rules and further guidance of HHS. Law enforcement agencies can use PHI:

Dr. Bozeman is a SWAT physician, EMS medical director, and use-of-force researcher at Wake Forest School of Medicine in Winston-Salem, North Carolina.

Dr. Stopyra is an EMS medical director and assistant professor at Wake Forest School of Medicine in Winston-Salem, North Carolina.

Ms. Corn, a registered nurse, is chief privacy officer and compliance director at Wake Forest Baptist Medical Center in Winston-Salem, North Carolina.

Mr. Moser, a former police officer, is director of enterprise risk and corporate investigations at Wake Forest Baptist Medical Center in Winston-Salem, North Carolina.

as required by law (e.g., court orders, court-ordered warrants, subpoenas, and administrative requests);
to identify or locate a suspect, fugitive, material witness, or missing person;
in response to a police official’s request for information about a victim or suspected victim of a crime;
to alert law enforcement of a person’s death if the covered entity suspects that criminal activity caused the death;
when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and
if necessary to inform police agencies about the commission and nature of an offense, location of the crime or victims, and perpetrator.⁶

One of the provisions outlined in HIPAA that allows officers to access suspects’ otherwise closely protected medical information involves complying “with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or an administrative request from a law enforcement official [emphasis added].”⁷

Administrative inquiries into police use of force meet this requirement and allow investigators limited access to a suspect’s medical information, including the specific injuries sustained and their cause. They entail a straightforward process to access medical data in cases involving a firearm discharge or a potentially serious injury.

While law enforcement agencies and use-of-force investigators do not need advanced expertise in all of the nuances of these highly complex regulations, they must have general familiarity regarding the HIPAA statute and privacy rules and how to carefully comply with all requirements. Hospitals, ambulance agencies, and other covered entities face stiff penalties for inappropriate disclosures of protected health information. Understandably, they are reluctant to release data unless it proves clearly appropriate and meets the necessary requirements.

Access to the Information

Use-of-force investigators can follow an outline of the process to access medical information in these—fortunately rare—cases. The authors have worked with the National Institute of Justice and law enforcement agencies across the country in performing medical injury epidemiology studies and have had considerable success with this approach.

Guidance from HHS specifically addresses disclosures for law enforcement purposes and states in part:

The Rule permits covered entities to disclose protected health information (PHI) to law enforcement officials, without the individual’s written authorization, under specific circumstances.

To respond to an administrative request, such as an administrative subpoena or investigative demand or other written request from a law enforcement official. Because an administrative request may be made without judicial involvement, the Rule requires all administrative requests to include or be accompanied by a written statement that the information requested is relevant and material, specific and limited in scope, and de-identified information cannot be used [emphasis added].⁸

This guidance makes it clear that investigators must submit each request in writing and include three key statements.

The information requested is relevant and material to an official investigation into police use of force.
The data is specific and limited in scope to injuries sustained and their severity and cause.
De-identified information that does not specify the suspect or individual evaluated cannot be used.⁹

Investigators typically need to know the extent and severity of injuries, whether they resulted from police use of force or some other cause, and if hospital admission or death occurred due to force-related wounds or preexisting medical or psychiatric conditions. Emergency medical service (EMS) and emergency department records commonly offer the most help in use-of-force investigations, although inpatient records and discharge summaries also may prove essential in some cases.

The authors created a sample memo requesting release of medical information to law enforcement. Any police agency easily can tailor this document and submit it on official letterhead to the involved hospital or EMS agency.

Download Sample Memorandum.pdf — 36 KB

“One of the critical components of the use-of-force investigation involves determining whether suspects suffered serious harm or injury due to police actions.”

Use-of-force investigators must lay the groundwork in advance for submitting these requests. To this end, each hospital or EMS agency has a designated privacy officer (or office), and it proves particularly helpful to contact and coordinate with this official prior to requesting a suspect’s health information. A productive relationship with regular dialog holds importance because the covered entity will release only the minimum necessary health information. Some privacy officers provide the actual medical records, while others offer a summary in response to the questions posed. A quick conversation can clarify the specific data needed.

Upon receipt of summary information or medical records, one more potential hurdle exists—interpreting the data. Much of it may be written in medical jargon or shorthand that investigators find difficult to interpret. At this point, a police department’s on-staff physician can help determine injury severity and cause and whether hospital admission occurred due to a wound resulting from police use of force or unrelated medical or psychiatric causes. If the agency does not already have such a doctor, it can find a volunteer among EMS and emergency physicians in the local community. The IACP Police Physicians Section also can help agencies locate and work with a willing doctor.¹⁰

Investigators do not need to put forth the extra effort involved in accessing medical records in all use-of-force investigations—they can complete most using officer reports and observations alone. Agencies should access protected medical information only in the few cases where death or serious bodily injury may have occurred. In these instances, investigators can use the outlined steps to determine the critical elements of whether serious injuries have occurred and if they were caused by police actions.

Conclusion

As they should, federal regulations require robust protection of individuals’ health information. However, provisions exist that permit law enforcement agencies to access this data under specific circumstances. These allowances can give invaluable assistance in police use-of-force investigations and subsequent reporting.

Law enforcement agencies should use these provisions, along with the outlined approach, while fully complying with modern reporting requirements. By doing so, they can obtain critical information regarding injuries from police use of force and protect communities, agencies, officers, bystanders, and suspects.

“Upon receipt of summary information or medical records, one more potential hurdle exists—interpreting the data.”

Dr. Bozeman can be reached at wbozeman@wakehealth.edu, Dr. Stopyra at jstopyra@wakehealth.edu, Ms. Corn at pcorn@wakehealth.edu, and Mr. Moser at jtmoser@wakehealth.edu.

Endnotes

¹ U.S. Department of Justice, Federal Bureau of Investigation, Uniform Crime Reporting Program, National Use-of-Force Data Collection, accessed December 7, 2017, https://ucr.fbi.gov/use-of-force.
² William P. Bozeman, Jason P. Stopyra, David A. Klinger, Brian P. Martin, Derrel D. Graham, James C. Johnson III, Katherine Mahoney-Tesoriero, and Sydney J. Vail, “Injuries Associated with Police Use of Force,” abstract, Journal of Trauma and Acute Care Surgery 84, no. 3 (March 2018): 466-72, accessed March 6, 2018, https://www.ncbi.nlm.nih.gov/pubmed/29283961. In their study, the authors examined all use-of-force events in several U.S. law enforcement agencies over a 2-year period. Use of force was rare, with just under 900 such events in more than 1 million calls for service and over 110,000 criminal arrests. Significant injuries were uncommon (less than 2 percent) after force was used. Most arrestees taken to an emergency department for medical evaluation were subsequently discharged, and the majority of those admitted to the hospital had medical or psychiatric conditions, not force-related injuries.
³ U.S. Department of Health and Human Services, Summary of the HIPAA Privacy Rule, accessed December 7, 2017, https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html.
⁴ Ibid.
⁵ Ibid.
⁶ Ibid; and U.S. Department of Health and Human Services, Covered Entities and Business Associates, accessed December 8, 2017, https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html.
⁷ U.S. Department of Health and Human Services, Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule: A Guide for Law Enforcement, accessed December 7, 2017, https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/special/emergency/final_hipaa_guide_law_enforcement.pdf.
⁸ U.S. Department of Health and Human Services, When Does the Privacy Rule Allow Covered Entities to Disclose Protected Health Information to Law Enforcement Officials? accessed December 7, 2017, http://www.hhs.gov/hipaa/for-professionals/faq/505/what-does-the-privacy-rule-allow-covered-entities-to-disclose-to-law-enforcement-officials/index.html; and “Using De-identified Health Information to Improve Care: What, How and Why,” Practice Fusion, accessed December 8, 2017, https://www.practicefusion.com/blog/using-de-identified-patient-data-to/.
⁹ Ibid.
¹⁰ “Police Physicians Section,” International Association of Chiefs of Police, accessed December 7, 2017, http://www.iacp.org/Police-Physicians-Section.