When police officers work with EMS and MIH teams, people often wonder: Can law enforcement violate HIPAA? Or are officers bound by the same health privacy laws as any other healthcare provider? In this article, we work to provide context and answers.
If the law enforcement officer works directly within a healthcare team, such as a mental health response unit, then the officer is likely bound by HIPAA laws. With that said, if the police officer is only working as an adjunct to the team, they may not be bound by HIPAA laws; however, law enforcement officers typically have their own set of privacy rules.
All in all, police officers are not generally bound by HIPPA laws; however, that does not mean they are free to share patient information at will. We’ll talk about why laws may differ for police officers.
Key Takeaways
- An officer working inside a healthcare team, such as a co-response unit, is usually bound by HIPAA.
- An officer working as an adjunct to the team is generally not, but has separate privacy rules.
- HIPAA has exceptions that let providers share with police in specific situations.
- A high threshold for releasing patient information is what keeps community trust.
If a Police Officer is Working with a Mental Health Co-Response Team, Are They Under HIPAA?
Before we get started, we must address this question’s legal aspect. First, know that laws vary by region, state, and city. We cannot accurately say that what is true for one area is true for all. So, with that said, please do not consider the content of this article as legal advice.
Instead, take this article as a light to help guide you toward answers. Our goal is to help inform and support strong law enforcement behavioral health teams in an ethical and effective way.
Here are a few points to keep in mind about law enforcement and HIPPA:
- Law Enforcement Working Directly Under Healthcare Should Not Violate HIPAA
- There Are Some Instances When HIPAA May Not Apply to Police Officers
- There Are Also Some Instances When Healthcare Providers May Have HIPAA Exceptions
- To Improve Patient Care Law Enforcement Should Strategically Place Officers
- Local Laws May Vary Regarding What Law Enforcement Officers Can Disclose
- A High Threshold for Release of Patient Information is Important to Build Trust
- There are Times When PD is Directly Involved in Patient Care and Needs Information
Now, let’s look at some of these points in more detail.
Why Should Law Enforcement Working Under Healthcare Not Violate HIPAA?
When a law enforcement officer is working directly with a health care team, they should not violate HIPAA laws. For example, suppose an officer is working as an unarmed member of a post overdose response team (PORT). In that case, they should respect the privacy rights of that patient, as they are working in conjunction with a Mobile Integrated Health team.
Note that we use the word should. The specific laws surrounding whether an officer must abide by HIPPA laws while working as a healthcare provider will directly relate to who the officer is working under/for. Some officers will work part-time on the ambulance. In this case, the officer would likely be bound by the same HIPAA laws as any other EMT.
On the other hand, if the officer is just working in support of the team (and not directly under the hospital’s supervision), then the officer may not be bound by HIPAA.
As you’ll see in the next section, there are some instances where even a healthcare provider is not bound by HIPPA; however, even if HIPAA does not bind an officer, they likely have their own privacy standards to adhere to according to law.
Let’s talk about some times when HIPPA may not apply to police officers even when they are working with a mental health crisis team.
When Does HIPAA Not Apply to Police Officers?
In some cases, safety concerns may lead a police officer working as part of a mental health team to share that patient’s information. However, remember that this does not mean there are some times when an officer can “violate” HIPAA, as these instances would be viewed as legal exceptions but in place by HIPAA.
What would these instances be?
First, if there is information that could be harmful to others, then an officer can share this information to prevent further harm. Second, in cases where the person is a direct harm to themselves, the officers may have specific legal precedents to share that person’s information with those not directly related to their care in order to secure the person from themselves.
Finally, there are times when disclosures of patient information will be made in the interest of public health and national safety; however, in these cases, there is a common term: “minimum necessary,” meaning that only the patient information that is needed is used, and nothing else.
So, as you can see, most cases that allow a disclosure of health information surround protecting the safety of those who could be impacted; however, when these disclosures happen, they should only be what’s needed.
When Do Healthcare Providers Have HIPAA Exceptions?
While police officers may or may not be covered by HIPAA in certain cases, for context, it’s essential to know that even healthcare providers may disclose health information in some cases.
For example, areas may allow health providers to disclose information about a patient if they believe there is an imminent threat to others, if some kind of abuse is involved, or when under a court order.
While these circumstances are rare, HIPAA does not mean that health providers cannot say something when they believe there is a threat to themselves, the patient, or others. Now, let’s discuss how police officers can navigate patient care.
How Should Law Enforcement Place Officers to Improve Patient Care?
Police officers should take care of how they place themselves when involved with a mental health crisis. What does this mean? It means that people who are experiencing a negative mental health event should be given room to share, react, and respond without concern or threat of arrest/detainment.
Of course, there are cases when someone who is having a mental health crisis is an immediate threat to themselves or others, and a police officer must react quickly; however, when this is not the case, the police officer should make an effort to allow health professionals to take the lead, only calling for police intervention if needed.
Strategies like this can reduce the number of negative interactions between people with mental health conditions and police officers, ultimately building trust within a community.
How Do Local Laws Change What Officers Can Disclose?
Some areas may differ in what a police officer is or is not allowed/required to share. Under no circumstances should a police officer share patient information that could be a detriment to the patient unless that disclosure is necessary.
If your area is building a mental health crisis response team, then it’s wise to look into local laws about police officers and patient privacy. Knowing your laws will help the patient, the police, and the team.
Now, let’s talk about trust.
Why Does a High Threshold for Releasing Patient Information Build Trust?
As we briefly mentioned in the last section, regardless of the law, police officers who are involved in the care of someone during a mental health emergency should maintain the utmost professionalism when it comes to sharing any details about the encounter. That’s just the right thing to do.
However, these ethical standards go beyond just “being the right thing to do”; they also help build a team that trusts each other and a community that trusts their providers. If people who are experiencing mental health crises know that they are not under threat of arrest or legal burden, they are much more likely to reach out.
All this works together to create a healthy law enforcement behavioral program that leads to real results within a community.
If you’re curious, read this article on how software tools support care.
When Does the Police Department Need Patient Information?
Not only are there cases when police officers may share patient information, but there may also be some cases when a police officer needs information from a mental health event. In these cases, the medical professional should make every effort to ensure that the release of this information is authorized. Then, they should ensure they release that information via a secure route.
For the safe and reliable transfer of patient data among health teams, Julota provides a HIPAA-compliant platform that allows for the seamless collaboration of core crisis response teams. Be sure that your team uses a platform that keeps patient information safe.
How Can Police and Mental Health Teams Share Data While Staying HIPAA and CJIS Compliant?
Police and mental health teams can share client information legally when three things are in place: a written data-sharing agreement that names what each agency may see, a consent or treatment-purpose basis under HIPAA for the health side, and a system that keeps criminal justice records under CJIS security rules while health records stay under HIPAA. In practice that means role-based access, so an officer sees the safety plan and the clinician sees the treatment history, with an audit trail on every view. The FBI’s CJIS Security Policy sets the standard for the criminal justice side. Julota is built to hold both record types in one platform with those controls, which is how co-responder programs close the loop without either agency breaking its own rules.
How Do Police and Mental Health Agencies Set Up an Information-Sharing Agreement?
The agreement usually takes the form of a memorandum of understanding, or MOU, signed by the police department, the behavioral health provider, and any hospital or crisis center involved. It names the purpose of the sharing, the specific data elements each partner may see, the legal basis for each one (HIPAA treatment and public safety exceptions, state law, and the person’s written consent), who at each agency holds which role-based access, how long records are kept, and what happens after a breach. A planning committee with legal counsel from each side drafts it, and the technical setup follows the paper: role-based permissions, audit logs, encryption in transit and at rest, and CJIS-level security for anything that touches criminal justice information. The Bureau of Justice Assistance’s Police-Mental Health Collaboration toolkit includes sample MOUs and information-sharing protocols.
Conclusion: HIPAA Laws and Police Officers During Mental Health Care
Police officers who work as part of a health team and directly under the supervision of a hospital are likely required to abide by HIPAA rules (especially if they are working “off duty” as a police officer). However, there are some cases when police officers may be allowed to share patient information, such as if the patient presents a threat to themselves or others.
Last, keep in mind that even if it’s allowed, under no circumstances should officers or health providers release more information than is minimally needed to keep people safe.
Contact Julota for more information on how their software platforms can help you safely document and responsibly share information within your team.
Frequently Asked Questions
Are police bound by HIPAA?
Not usually. HIPAA binds covered entities such as healthcare providers, health plans, and clearinghouses. A police department is not a covered entity, so officers are generally not bound by HIPAA directly. The picture changes when an officer is embedded in a healthcare team, where the team’s obligations can extend to what the officer learns.
Can law enforcement violate HIPAA?
An officer cannot violate a rule that does not apply to them. What can happen is a healthcare provider improperly disclosing protected health information to police, which is the provider’s violation, not the officer’s. When police work directly under a healthcare umbrella such as a mental health response unit, they should treat patient information as protected.
Does HIPAA apply to law enforcement investigations?
HIPAA has specific carve-outs that let providers disclose limited information to law enforcement, including responses to court orders, warrants, and subpoenas, and identification of a suspect or missing person. These are exceptions with conditions, not open access, and the threshold for releasing patient information should stay high.
When can healthcare providers share patient information with police?
Providers may disclose in narrow circumstances such as a valid court order, a serious and imminent threat to health or safety, or when required by state reporting law. State rules vary and some are stricter than HIPAA, so co-responder programs should confirm local requirements rather than assuming the federal floor is the ceiling.
