Understanding Health Privacy Beyond HIPAA

Health Privacy Beyond HIPAA Natalie Ram Professor of Law University of Maryland Carey School of Law June 2025

(f) Standard: Disclosures for law enforcement purposes. (1) Permitted disclosures: Pursuant to process and as otherwise required by law. A covered entity may disclose protected health information: (ii) In compliance with and as limited by the relevant requirements of: (A) A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer; (B) A grand jury subpoena; or (C) An administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law .

Certificates of Confidentiality Any person to whom a certificate is issued under subparagraph (A) to protect the privacy of an individual described in such subparagraph shall not, in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding, disclose or provide the name of such individual or any such information, document, or biospecimen that contains identifiable, sensitive information about the individual and that was created or compiled for purposes of the research, except [with the consent of the individual to whom the information, document, or biospecimen pertains]. 42 U.S.C. 241(d)(1)(D)

Certificates of Confidentiality Identifiable, sensitive information protected under [a Certificate of Confidentiality], and all copies thereof, shall be immune from the legal process, and shall not, without the consent of the individual to whom the information pertains, be admissible as evidence or used for any purpose in any action, suit, or other judicial, legislative, or administrative proceeding. 42 U.S.C. 241(d)(1)(E)

State statutory privileges State Statute Data Protected Arkansas Colorado Ark. Code Ann. 11-14-109 Colo. Rev. Stat. Ann. 25-1-122 Employee drug testing records Dept of Public Health investigation data on communicable diseases, STD s, cancer, and morbidity and mortality Dept of Public Health maternal mortality data (NBS statute cross-refs to this too) Dept of Health statistics and data with personally identifiable information Healthcare review committee records Medical research records with personally identifiable information Office of Public Health morbidity, mortality, and health condition cause investigation records Communicable disease and drug overdose records with personally identifiable information Confidential healthcare communications Mental health provider notes on group therapy sessions for police officers and first responders Doctor medical findings supporting decision to perform abortion on minor Medical records with personally identifiable information Communicable disease data held by local health departments Healthcare review committee records Connecticut Conn. Gen. Stat. Ann. 19a-25 Illinois 410 Ill. Comp. Stat. Ann. 520/5 Indiana Louisiana Ind. Code Ann. 27-13-31-3 La. Stat. Ann. 44:7 Louisiana La. Stat. Ann. 40:3.1 Nevada Nev. Rev. Stat. Ann. 441A.220 Rhode Island Tennessee 5 R.I. Gen. Laws Ann. 5-37.3-6 Tenn. Code Ann. 10-7-504 Texas Tex. Fam. Code Ann. 33.002 Utah Utah Code Ann. 26-3-9 Utah Utah Code Ann. 26-6-27 Wyoming Wyo. Stat. Ann. 26-34-130 (d)

Thank you!