Health Information Compliance Alert

Published on Fri Oct 17, 2008 PDF

Question: Our front line staff are excellent at calming upset patients, but recently one client became very aggressive. A nurse contacted our security staff, who then escorted the patient out. The security team has asked that we contact the local

police to file a report. Would doing so violate the privacy rule?

Answer: "No," asserts Frank Ruelas, compliance officer for Gila River Health System in Sacaton, AZ. The privacy rule allows you to share patient information with the police if that patient commits a crime on your premises.

You must first be sure that the patient did commit a crime, he stresses. If the patient was loud and disruptive, you could send her a notice stating that she is no longer considered a patient at your facility.

If you determine the patient's actions were criminal -- say, she broke a piece of equipment or injured another patient -- you must abide by the minimum necessary rule for any disclosure. That means you should  share the minimum amount of

information needed by the officer to handle your complaint, Ruelas says.

The bottom line: If a patient becomes aggressive with your staff members, the privacy rule does not prohibit you from involving law enforcement. However, you must be confident that the patient's actions were criminal before you share her PHI.