In the State of New Hampshire, law enforcement officers may request medical records from a hospital under specific circumstances, which must comply with both federal HIPAA regulations and New Hampshire state law.
¶ HIPAA Regulations (Health Insurance Portability and Accountability Act)
Under HIPAA, medical records are considered protected health information (PHI), and hospitals are generally prohibited from disclosing this information without the patient's consent. However, 45 CFR § 164.512 provides certain exceptions for law enforcement purposes where PHI can be disclosed without patient authorization.
Key provisions under HIPAA include:
- Disclosure with a Court Order, Subpoena, or Warrant (45 CFR § 164.512(f)(1)(ii)):
- A hospital may disclose medical records in response to a court order, subpoena, or search warrant. Law enforcement officers can obtain the records after presenting a valid legal process.
- NOTE: Within the State of New Hampshire, when law enforcement is issued a search warrant for medical records the New Hampshire Circuit Court will issue a special order for production of medical records. The records must be sealed and delivered directly to the court, who will examine (conduct an in-camera review) the records and release only those portions of the records which the court believes are relevant to the investigation.
- Disclosure of Certain Injuries (45 CFR § 164.512(f)(1)(i)):
- Such as those injuries which are required to be reported by law, including suspected abuse of a minor child pursuant to NH RSA 169-C:29 or under NH RSA 631:6, which requires any person who treats an individual to report such injury to law enforcement if:
- The injury was caused as a result of a crime, unless the patient objects.
- This does not apply to juvenile patients, or those who have suffered a gunshot wound or other serious bodily injury.
- Disclosure to Prevent Harm (45 CFR § 164.512(j)(1)(i)(a):
- Medical information can be released to law enforcement if it is necessary to prevent a serious threat to health or safety. For example, if an officer needs information to prevent an immediate danger to the patient or the public, the hospital may provide it.
- A sample letterhead request for emergency information is available here.
- Disclosure for Identification and Location (45 CFR § 164.512(f)(2)(i)):
- Hospitals can disclose limited information to law enforcement when the officer is trying to identify or locate a suspect, fugitive, material witness, or missing person. This disclosure is limited to:
- Name and address.
- Date and place of birth.
- Social security number.
- Blood type and RH factor.
- Date and time of treatment, date and time of death (if applicable), and description of the injuries.
- A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or mustache), scars, and tattoos.
- A sample letterhead request for such information is available here.
- Disclosures in Cases of Death (45 CFR § 164.512(f)(4)):
- If law enforcement is investigating a death and suspects it may have resulted from criminal activity, the hospital can disclose PHI without a warrant or subpoena.
- Disclosure Related to a Crime on the Premises (45 CFR § 164.512(f)(5)):
- Hospitals may disclose PHI if the information is necessary to inform law enforcement about a crime that occurred on the hospital premises.
In addition to HIPAA,Detectives must adhere to New Hampshire state laws that govern medical record disclosure.
- NH RSA 329:26 – Confidentiality of Medical Information:
- This statute ensures patient confidentiality and requires the patient’s consent to release medical records, except under specific legal circumstances, such as court orders or investigations related to criminal acts.
- NH RSA 611-B:21 – Medical Records in Death Investigations:
- This statute allows medical records obtained by the Office of the Chief Medical Examiner in New Hampshire to be provided to law enforcement when investigating a death that may be the result of criminal activity or other suspicious circumstances.
- With a Subpoena or Court Order:
- To request medical records for a criminal investigation, law enforcement officers generally need to obtain a subpoena or court order, such as a search warrant. This is the most common and secure way to ensure that HIPAA regulations are complied with.
- For the purpose of this section, a subpoena for medical records should only be issued by the Carroll County Grand Jury. Ideally, a search warrant should be obtained along with an order for in-camera review and inspection of such records by the court.
- NOTE: Ensure to request an order for medical records when submitting your request to the New Hampshire Circuit Court warrant team for review of a medical records search warrant.
- With Patient Consent:
- Law enforcement can request medical records directly from the hospital if the patient signs a HIPAA-compliant release form authorizing the disclosure of their health information to law enforcement.
- For Memorial Hospital and MaineHealth owned hospitals, please use the medical records release form. This is the only release their legal department will accept.
- In Emergency Situations:
- When there is an imminent threat to public safety or the safety of the patient, law enforcement can request limited medical information without a subpoena, under the emergency circumstances exception of HIPAA.
- It is recommended that you both contact the hospital by phone to speak with their legal department about your request, as well as submit the letterhead request listed above.