The Long Arm of the Law: HIPAA’s Protections in the Face of Criminal Investigations

• December 05, 2025

• Christopher J. Tellner , Kaufman Dolowich LLP
• Abbye E. Alexander , Kaufman Dolowich LLP
• Henry E. Norwood , Kaufman Dolowich LLP

The Health Insurance Portability and Accountability Act (HIPAA) safeguards protected health information (PHI) from disclosure by covered entities without a patient’s consent. The protections of HIPAA, however, are not absolute, and there are exceptions to the restriction on disclosure of PHI. An important question arises as to whether covered entities may disclose PHI to law enforcement to aid in an ongoing criminal investigation. Health care providers may have critical knowledge relevant to criminal investigations in the course of providing care to victims or suspects of criminal misconduct and may subsequently face the difficult question of whether to disclose PHI when requested by law enforcement. Fortunately, the HIPAA regulations do provide for the circumstances under which covered entities may disclose PHI to law enforcement, which should be understood by all providers, patients, law enforcement, and legal counsel to ensure compliance.

ARTICLE TAGS

• Health Care Liability and Litigation Practice Group
• Health Information