New health law posing problem for police

BEND, Ore. — Police in Oregon say a new national privacy law that prohibits the release of medical information sometimes hurts their ability to catch criminals.

Recently, for example, the Redmond Police Department got a tip that a crime victim was at a local hospital. But when officers got to the hospital, they were told that hospital staff members could not confirm or deny whether the alleged victim was there.

The law in question, the Health Insurance Portability and Accountability Act, allows for civil and criminal penalties against health care providers who wrongfully disclose certain medical information.

“It’s not prohibiting us from doing our job but we definitely have to jump through some hoops,” said Bend Chief of Police Andy Jordan.

In the nearly two years since the law’s passage, health care providers are still trying to find a balance between privacy rights and assisting law enforcement.

Under the law, law enforcement can get the information from health care providers when they have a court order or subpoena in hand.

But police say there is not always time to get the documents they need.

Law enforcement agencies are also entitled to limited protected information when they think the patient may be a crime suspect, victim, fugitive, material witness or missing person.

But their requests for this information have received widely varying responses.

“It’s kind of an evolving thing,” said Prineville Police Chief Eric Bush. “Anytime there is a new federal statute regulating communication between local agencies and law enforcement, everybody has their own interpretation of it. The intent of the statute is to protect people’s privacy but, due to fear of lawsuits, it has really stifled communication.”

If health care providers fail to comply with the law’s regulations they can face fines of up to $100 per violation, with a cap of $25,000 in a calendar year. Criminal prosecution can result in fines of up to $250,000 and a maximum of 10 years in prison.

In 2003, Oregon lawmakers did amend state law to require hospitals and other providers to provide specific information about drunken drivers involved in car crashes. The patient’s name, blood-alcohol level and date and time of testing must be given to law enforcement within five days.

“What seemed to be protected before was the blood-alcohol level but now they are required to give it to us, which is a really big help,” said Oregon State Police Lt. Carl Rhodes.