HIPAA Compliance Requirements for Hospital-Based Violence Intervention Programs

What information does HIPAA protect in a hospital-based violence intervention program?

For a hospital-based violence intervention program (HVIP), the HIPAA Privacy Rule protects protected health information (PHI): individually identifiable information about a person’s physical or mental health, health care, or payment for health care when it is held or transmitted by a HIPAA covered entity or its business associate. A hospital program’s records can therefore contain PHI when they connect an identifiable participant with care, an injury, a referral, or other health information. HHS’s Summary of the HIPAA Privacy Rule

HIPAA does not automatically cover every record held by every community organization. Whether a record is subject to HIPAA depends on who holds it and the organization’s role; other federal or state confidentiality rules may still apply. A hospital should identify which HVIP records are part of its covered-entity records and which outside partners may act as business associates. HHS guidance on business associates

When can providers share information for treatment without patient authorization?

A covered health care provider may generally use or disclose PHI for treatment without obtaining a patient’s authorization. Treatment includes the provision, coordination, or management of health care by one or more providers, including consultations between providers about a patient. HHS guidance on treatment disclosures

This treatment disclosure permission is not a blanket permission to share hospital records with any violence intervention partner. It applies when the disclosure is for treatment activities of a health care provider. A community-based organization is not automatically a health care provider simply because it supports a participant; the hospital should assess the partner’s role and the purpose of the exchange before relying on this exception.

What authorization is needed to share information with community partners?

If a disclosure to a community partner is not otherwise permitted by HIPAA, the hospital generally needs a valid patient authorization before sharing PHI. A valid authorization should meaningfully describe the information, identify who may disclose it and who may receive it, state the purpose, include an expiration date or event, and be signed and dated by the patient or an authorized personal representative. HHS guidance distinguishing consent from authorization and HHS authorization FAQs

Use an authorization that clearly names the community partner and describes the categories of information and purpose of the disclosure. General consent to participate in an HVIP is not necessarily a HIPAA authorization. If the partner performs services on the hospital’s behalf that involve PHI, the hospital should also determine whether the partner is a business associate and, if so, establish the required written business associate arrangement. That arrangement does not, by itself, authorize every disclosure; the hospital still needs a permitted HIPAA basis for sharing the information. HHS guidance on business associates

How should HVIPs limit disclosures to the information necessary?

For disclosures where the minimum necessary standard applies, covered entities must make reasonable efforts to limit PHI to what is needed for the intended purpose. HVIPs can put this into practice by defining approved purposes, limiting access by role, and using program procedures for reviewing non-routine requests and disclosures. HHS guidance on the minimum necessary requirement

There are important exceptions: the minimum necessary standard does not apply to disclosures to or requests by a health care provider for treatment, or to disclosures made pursuant to a valid patient authorization. When the standard does apply, staff should avoid sending a full hospital record if a limited set of information will accomplish the purpose. HHS explanation of the standard and its exceptions

When may HIPAA allow disclosures to law enforcement?

HIPAA does not give law enforcement routine access to HVIP or hospital records. A covered entity may disclose PHI without authorization only in specified circumstances, such as when a disclosure is required by law, in response to certain court orders or legal process, or under particular law enforcement provisions. The conditions differ by circumstance, so staff should verify the request and its legal basis before disclosing. HHS guidance on law-enforcement disclosures

HIPAA also permits a covered entity, consistent with applicable law and ethical standards, to disclose PHI when it has a good-faith belief that sharing is necessary to prevent or lessen a serious and imminent threat to someone’s health or safety, and the recipient is reasonably able to help address the threat. This serious and imminent threat exception is not a general permission to report past violence or provide law enforcement with a participant’s program records. HHS guidance on serious and imminent threats

For any permitted law-enforcement disclosure, confirm the applicable legal provision and limit the information as required. For example, HIPAA sets specific conditions and limits for certain requests to identify or locate a suspect, fugitive, material witness, or missing person. HHS’s summary of law-enforcement disclosure conditions

How do state laws and program rules add confidentiality protections?

HIPAA is a federal privacy baseline, and a more stringent state privacy law may provide greater protections or rights. When a state privacy requirement is more stringent and otherwise applies, it may take precedence over a conflicting HIPAA rule; covered entities must comply with both laws when they do not conflict. HHS guidance on more stringent state laws and HHS guidance on HIPAA preemption

Before sharing information, HVIPs should check applicable state victim confidentiality statutes and other relevant state requirements, including rules that may affect injury reporting, minors’ records, or behavioral health information. State laws can also require particular reports; HIPAA permits disclosures required by law, subject to the applicable legal limits. Because these rules vary by state and situation, hospitals should involve their privacy officer or counsel when designing local procedures. HHS guidance on state-law exceptions

In short, protect PHI within the hospital’s HIPAA processes, use treatment disclosures only when the exchange is genuinely for provider treatment, and obtain a valid authorization or identify another applicable permission before sharing with community partners. Keep law-enforcement disclosures within HIPAA’s specific exceptions and check state confidentiality rules alongside federal requirements.

FAQs

Can an HVIP share patient information with a community-based organization without authorization?

Sometimes, but not simply because the organization partners with the HVIP. A disclosure may be permitted without authorization if a specific HIPAA exception applies—for example, a treatment disclosure to a health care provider for that provider’s treatment activities. Otherwise, the hospital generally needs a valid patient authorization. If the organization is acting as the hospital’s business associate, the required written arrangement and a HIPAA-permitted basis for the disclosure must also be in place. HHS treatment-disclosure guidance and HHS business-associate guidance

Does HIPAA require authorization for information sharing between providers for treatment?

Generally, no. Covered health care providers may share PHI for treatment without patient authorization. The treatment exception applies to the treatment activities of providers; it should not be assumed to cover every exchange with a community organization. HHS guidance on treatment disclosures

What information may an HVIP disclose to law enforcement?

Only information that is permitted or required under a specific HIPAA provision and applicable law. Depending on the circumstances, this may include information required by law, information responsive to qualifying legal process, or information needed to address a serious and imminent threat. Some provisions limit the categories of information that may be disclosed. The hospital should verify the request, apply the relevant conditions, and avoid treating an officer’s request alone as permission to release a participant’s records. HHS guidance on law-enforcement disclosures

Can state law impose stricter confidentiality rules on HVIP records?

Yes. A state law may provide greater privacy protections or rights than HIPAA, and a more stringent applicable state requirement can prevail over a conflicting HIPAA provision. The hospital should assess the specific state law and record type because protections and reporting obligations vary. HHS guidance on more stringent state laws