A Guide to Privacy Laws for Hospital-Based Violence Intervention Programs in Kansas

Hospital-based violence intervention programs (HVIPs) support patients affected by violence, often by connecting hospital care with community services. The privacy rules that apply depend on who holds the information, who is providing the service, and why information would be shared.

For an HVIP, the key questions are whether information is protected health information (PHI), whether a sharing pathway is permitted by law, and whether the program’s staff and partners are authorized to receive it. Kansas law and HIPAA do not make every record or every disclosure subject to the same rules.

How HIPAA applies to hospital-based violence intervention programs

HIPAA applies to covered entities, including qualifying hospitals and health care providers, and to business associates that handle PHI on a covered entity’s behalf. An HVIP does not become covered by HIPAA simply because it works with a hospital; its legal status and access depend on its relationship with the hospital and its role with the information.

Hospital employees working on the program may access records as part of the hospital workforce when their duties authorize that access. A separate organization that handles PHI for the hospital may be a business associate and generally needs a written agreement defining permitted uses and safeguards. A community partner that is neither workforce nor a business associate does not automatically gain access to the hospital record. HHS guidance on business associates

Use role-based access and disclose only what is appropriate for the purpose. HIPAA’s minimum-necessary standard generally applies to many uses and disclosures, though it does not apply to provider-to-provider disclosures for treatment. A hospital should define access, documentation, and partner-sharing procedures in its own policies. HHS minimum-necessary guidance

When can providers disclose information for treatment or legal obligations?

HIPAA generally allows a covered provider to share PHI with another health care provider for treatment without the patient’s written authorization. That may support care coordination when the recipient is a provider involved in the patient’s treatment. It does not mean every referral to an HVIP or community organization is automatically a treatment disclosure; the provider should confirm the recipient’s role and the applicable authorization, agreement, or other legal basis. HHS treatment, payment, and health care operations guidance

Providers may also disclose information when a law requires them to do so, subject to the law’s scope. A request from law enforcement or another agency is not, by itself, a blanket right to the patient’s record. Court orders, subpoenas, and other legal processes have distinct HIPAA requirements, and a disclosure must follow the conditions that apply to the specific request. HHS guidance on disclosures required by law and HHS guidance on court orders and subpoenas

Patients may ask a covered entity to restrict certain uses or disclosures, but providers generally are not required to agree, except in a limited case involving information about a service paid for in full out of pocket and disclosures to a health plan for payment or health care operations. If a provider agrees to a restriction, it generally must honor it, subject to specific exceptions. HHS guidance on HIPAA restriction requests

How to request limits on sharing through a Kansas health information exchange

Kansas patients can submit an opt-out request to limit electronic information sharing through Kansas-certified health information exchanges (HIEs), also called health information organizations (HIOs). The Kansas HIE portal provides electronic and mail opt-out options, and patients may revoke an opt-out later.

The state’s opt-out applies only to sharing by Kansas-certified HIEs. If a provider or organization uses a non-certified HIE, the patient must contact that organization about its separate process. An HIE opt-out does not erase the medical record held by the treating provider or automatically prevent other disclosures permitted or required by law. Kansas Health Information Technology patient opt-out information

Who can access medical records for minors in Kansas?

Under HIPAA, a parent or guardian is generally a minor’s HIPAA personal representative when state law authorizes that person to make health care decisions for the child. That usually allows the personal representative to exercise access rights for relevant records. Exceptions may apply when the minor lawfully consented to a particular service, another person was authorized to consent, the parent agreed to confidentiality, or a provider determines that treating the parent as the representative could endanger the child. HHS guidance on personal representatives and minors

Kansas law permits minor consent to medical treatment in certain situations. For example, a minor age 16 or older may consent to hospital, medical, or surgical treatment when no parent or guardian is immediately available. Minors under 18 may consent to examination and treatment for sexually transmitted infections; a physician may inform a parent about that care, but is not required to do so. Kansas law also allows minors to consent to treatment for drug abuse, misuse, or addiction. These service-specific consent rules do not automatically answer whether a parent may access every part of the record, so providers should assess the service and applicable confidentiality rules separately. Kansas statute on consent by a minor age 16 or older, Kansas statute on minor STI examination and treatment, and Kansas statute on minor drug-treatment consent

In a violence intervention setting, staff should also consider whether giving a parent access could put the minor at risk. HIPAA permits a covered provider, in specified circumstances and using professional judgment, not to treat a person as a personal representative if doing so would not be in the minor’s best interests.

When may providers disclose information about a serious and imminent threat?

HIPAA permits a covered entity to disclose PHI when it has a good-faith belief that disclosure is necessary to prevent or lessen a serious and imminent threat to someone’s health or safety, and the recipient can reasonably help prevent or lessen that threat. Depending on the circumstances, the recipient might be law enforcement, a family member, the person threatened, or another appropriate party.

This serious and imminent threat disclosure is permission under HIPAA, not a general requirement to notify a particular person. Any disclosure must also be consistent with applicable law and professional ethical standards. Share information relevant to addressing the threat, and follow the hospital’s safety and escalation policies. HHS guidance on serious and imminent threats

What confidentiality rules apply to Kansas batterer intervention records?

HVIP records and batterer intervention program records are not necessarily the same records, and HIPAA applies to a batterer intervention provider only if the provider is a covered entity or business associate in the relevant context. Kansas separately regulates certified batterer intervention programs through the Kansas batterer intervention certification unit in the Attorney General’s Office.

Certified programs must maintain service records for two years and make compliance records available for inspection by the Attorney General. Information and copies obtained by the Attorney General under the statute are not public and are not subject to disclosure under the Kansas Open Records Act. Kansas statute on batterer intervention program records and confidentiality

Program standards also address confidentiality limits, victim safety, and the use of victim-provided information. They do not establish that every program record is absolutely confidential: a provider should explain applicable limits to participants and follow the program’s governing standards, valid releases, and other relevant laws. Kansas Attorney General’s Batterer Intervention Program resources and Kansas Essential Elements and Standards for Batterer Intervention Programs

In short, an HVIP should identify who legally holds each record, confirm each staff member’s authority to access it, and use a valid legal basis before sharing. HIPAA treatment permissions, Kansas HIE opt-out procedures, minor-consent rules, threat disclosures, and batterer intervention confidentiality standards address different situations and should not be treated as interchangeable.

FAQs.

Can a hospital-based violence intervention program share information without patient consent?

Sometimes. HIPAA may allow a covered provider to share PHI for treatment or under another permitted disclosure pathway without written authorization. Whether HVIP staff or a partner may receive information depends on their role, the purpose, and any required business associate agreement or other legal basis. A hospital-based program should not assume that every community referral permits sharing a full record.

Can a Kansas patient request that records not be shared through a health information organization?

Yes. Patients can use Kansas’s opt-out process to limit sharing through Kansas-certified HIEs. The request does not apply to non-certified exchanges, so patients may need to contact those organizations separately. The opt-out limits exchange sharing; it does not delete the source provider’s records. Kansas HIE opt-out instructions

When can a parent access a minor’s medical records in Kansas?

A parent is generally the minor’s HIPAA personal representative when authorized by law to make health care decisions, but exceptions can apply to services for which the minor lawfully consented, or when access could endanger the child. Kansas has specific minor-consent laws, including for certain STI and substance-use treatment, and the STI statute allows a physician to inform a parent without requiring it. A provider should evaluate the particular service and record rather than presume that a parent can access every item. HHS guidance on parents and minors

When may providers disclose information to address a serious and imminent threat?

A covered entity may disclose PHI when it has a good-faith belief that sharing is necessary to prevent or lessen a serious and imminent threat to health or safety and the recipient can reasonably help address it. The disclosure must also comply with applicable law and ethical standards. HHS guidance on threat disclosures