Skip to Main Navigation
Skip to Main Content
The University of Texas at Dallas

HIPAA Privacy Manual

Section 29: Public Safety and Health

Definitions:

“Disclosure” means the release, transfer, provision of access to, or divulgence in any other manner, of information to any organization external to UTD.

“Use” means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within UTD.

Policy: UTD may disclose PHI without a patient authorization:

  • for reporting of abuse, neglect or domestic violence;
  • to avert a serious and imminent threat to the health or safety of a person or the public;
  • to law enforcement officials for law enforcement purposes; and
  • when allowed by law.

ABUSE, NEGLECT OR DOMESTIC VIOLENCE:

Permitted disclosures. Except for reports of child abuse or neglect permitted in this policy, UTD personnel may disclose PHI about an individual whom UTD reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, as authorized or required by law:

  1. To the extent the disclosure is required by law and the disclosure complies with and is limited to the relevant requirements of such law;
  2. If the individual agrees to the disclosure; or
  3. To the extent the disclosure is expressly authorized by statute or regulation and:
  4. UTD, in the exercise of professional judgment, believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or
  5. If the individual is unable to agree because of incapacity, a law enforcement or other public official may authorize to receive the report if:
  6. the PHI sought is not intended to be used against the individual; and
  7. an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.

Informing the individual.

In making a disclosure permitted by paragraph (1), UTD personnel must promptly inform the individual, in the exercise of professional judgment, that such a report has been or will be made, except if:

  1. UTD believes informing the individual would place the individual at risk of serious harm; or
  2. UTD would be informing a surrogate decision maker, and
  3. UTD reasonably believes the surrogate decision maker is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interests of the individual as determined by UTD.

SERIOUS THREAT TO HEALTH OR SAFETY OF PUBLIC

Permitted disclosures. UTD may, consistent with applicable law and standards of ethical conduct, use or disclose PHI, if:

  1. UTD, in good faith believes the use or disclosure:
    1. Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; except a use and disclosure may not be made if the information is learned by UTD:
      1. In the course of treatment which is designed to alter or change the desire to commit the criminal conduct which would be the basis for making a disclosure, or
      2. When an individual initiates or is referred to UTD for treatment, counseling, or therapy
    2. Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or
    3. It is necessary for law enforcement authorities to identify or apprehend an individual:
      1. Because of a statement by an individual admitting participation in a violent crime that UTD reasonably believes may have caused serious physical harm to the victim; or
      2. Where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody.

Limitations and Good Faith related to the Serious Threat

UTD may only release the statement relating to the serious threat and the PHI related to the serious threat. If UTD acts in good faith upon its belief, then UTD will be protected for disclosures related to the serious threat.

LAW ENFORCEMENT PURPOSES

UTD may disclose PHI:

  1. As required by law including laws that require the reporting of certain types of wounds or other physical injuries, except for laws pertaining to public health or domestic abuse; or
  2. In compliance with and as limited by the relevant requirements of
    1. A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer;
    2. A grand jury subpoena; or
    3. An administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law, provided that:
      1. The information sought is relevant and material to a legitimate law enforcement inquiry;
      2. The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and
      3. De-identified information could not reasonably be used. For a more detailed description, see IHOP HIPAA policy, De-identification of PHI.

Permitted disclosures: limited information for identification and location purposes.

Except for disclosures required by law of this section, UTD may disclose PHI in response to a law enforcement official’s request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, provided that UTD may disclose only the following information:

  1. Name and address;
  2. Date and place of birth;
  3. Social security number;
  4. Date and time of treatment

Permitted disclosure: victims of a crime.

Except for disclosures required by law as permitted by this section, UTD may disclose PHI in response to a law enforcement official’s request for such information about an individual who is or is suspected to be a victim of a crime, other than disclosures that are subject to this section, if:

  1. The individual agrees to the disclosure; or
  2. UTD is unable to obtain the individual’s agreement because of incapacity or other emergency circumstance, provided that:
    1. The law enforcement official represents that such information is needed to determine whether a violation of law by a person other than the victim has occurred, and such information is not intended to be used against the victim;
    2. The law enforcement official represents that immediate law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure;
    3. The disclosure is in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.

Permitted disclosure: deceased individuals: UTD will disclose PHI about a deceased individual to law enforcement officials for the purpose of alerting law enforcement of the death of the individual if UTD has a suspicion that such death may have resulted from criminal conduct.

Permitted disclosure: crime on premises: UTD may disclose to a law enforcement official PHI that UTD believes in good faith constitutes evidence of criminal conduct that occurred on UTD premises.

Permitted disclosure: reporting crime in emergencies: A UTD health care provider providing emergency health care in response to a medical emergency, other than such emergency on UTD premises, may disclose PHI to a law enforcement official if such disclosure appears necessary to alert law enforcement to:

  1. The commission and nature of a crime;
  2. The location of such crime or of the victim(s) of such crime; and
  3. The identity, description, and location of the perpetrator of such crime. ii. If a UTD health care provider believes that the medical emergency described in the above paragraph of this section is the result of abuse, neglect, or domestic violence of the individual in need of emergency health care, paragraph (12)(i) above of this section does not apply and any disclosure to a law enforcement official for law enforcement purposes is subject to the policy on abuse, neglect, or domestic violence.

USE & DISCLOSURE AS REQUIRED BY LAW

UTD personnel may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. UTD personnel must meet the requirements pertaining to disclosures relating to: victims of abuse, neglect, or domestic violence; judicial and administrative proceedings; and disclosures for law enforcement purposes.