Here at the School of Government, we get a lot of questions about disclosing medical records or information to law enforcement officials. Often the question arises when a law enforcement official appears at a health care facility and presents a search warrant or court order for the information, a situation my colleague Jeff Welty has written about on the SOG’s North Carolina Criminal Law blog. But disclosure of medical information is not always initiated by law enforcement. Sometimes a health care provider treats a patient for an injury or illness, such as a gunshot or stab wound, that suggests a violent crime has occurred. Law enforcement may not be aware of these situations unless someone tells them. Therefore, North Carolina has a statute (G.S. 90-21.20) that requires health care providers to notify local law enforcement officials when they treat patients with particular injuries or illnesses.
The statute has two subsections that address the types of injuries and illnesses that must be reported—one that applies to all patients, and one that applies only to patients who are minor children. Subsection (b) identifies the injuries and illnesses that must be reported regardless of the patient’s age. Subsection (c1) describes the additional circumstances in which a report is required if the patient is a minor child. This post summarizes the provisions of each section and then addresses some frequently asked questions.
Injury or Illness Potentially Caused by a Criminal Act [G.S. 90-21.20(b)]
A physician or administrator of a health care facility must report:
The report must be made to local law enforcement officials—the police department for the city in which the treatment occurred, or if the treatment occurs outside city limits, the county sheriff’s department. The law does not specify how the report is to be made, but it requires that the report be made “as soon as it becomes practicable before, during or after completion of treatment.” This suggests to me that a telephone call would be both appropriate and preferable to a written report. The information to be reported is specified (and limited to): the patient’s name (if known), age, sex, race, residence or present location (if known), and the character and extent of the patient’s injuries.
A physician or administrator who makes a report required by this section in good faith is immune from any civil or criminal liability that might otherwise arise under state law as a result of the disclosure of information.
Nonaccidental Recurrent Illness or Serious Physical Injury to a Child [G.S. 90-21.20(c1)]
The reports required by subsection (b) apply to all patients regardless of age. Subsection (c1) imposes an additional reporting requirement that applies only if the patient is a child under the age of 18. This subsection requires a physician or administrator to make a report if a child who is treated has a recurrent illness or serious physical injury that, in the physician’s professional judgment, is the result of nonaccidental trauma.
The report must be made to local law enforcement officials—the police department for the city in which the treatment occurred, or if the treatment occurs outside city limits, the county sheriff’s department. The law does not specify how the report is to be made, but like the reporting requirement of subsection (b), it requires that the report be made as soon as practicable. The content of the report is not specified.
The law specifies that the report to law enforcement must be made in addition to any report that is made to the department of social services pursuant to G.S. 7B-301 (requiring all persons to report cause to suspect a child is abused, neglected, dependent, or has died as a result of maltreatment). In other words, a report to DSS alone does not suffice; the physician or facility administrator must also report to law enforcement.
A physician or administrator who makes a report required by this section in good faith is immune from any civil or criminal liability that might otherwise arise under state law as a result of the disclosure of information.
Frequently Asked Questions
The statute gives the required reporters immunity from liability under state law. What about HIPAA, a federal law?
The HIPAA privacy rule specifically permits reports to law enforcement that are required by law, including reports of wounds and injuries. 45 C.F.R. 164.512(f). HIPAA defines “required by law” to include state statutes that require disclosures of information, which captures G.S. 90-21.20. So long as the disclosure complies with the terms of the statute—is made in good faith, reports an injury or illness that is required to be reported, etc.—the disclosure is permitted by HIPAA.
What constitutes “grave bodily harm” or “grave illness” for purposes of the reports required by subsection (b)?
Those terms are undefined and no court of record has interpreted them. In practice, physicians exercise their clinical judgment in determining whether an illness or injury falls into this category. In my experience, they are generally comfortable with their determinations that a patient has suffered bodily harm or an illness, but they sometimes ask what is meant by “grave.” Merriam-Webster defines the adjective “grave” as (among other things) “likely to produce great harm or danger.” Grave bodily harm or illness must be reported only if the treating physician believes it resulted from a “criminal act of violence,” another undefined term, but one that causes less angst. If the physician believes in good faith that the grave harm was the result of intentional violence, I think that is sufficient to trigger the duty to report.
Similarly, what constitutes “recurrent illness” or “serious physical injury” for purposes of the reports about children required by subsection (c1)?
These terms are also undefined and uninterpreted, so physicians exercise their clinical judgment. Going back to the dictionary, it’s easy to conclude that a “recurrent illness” is an illness that returns or occurs repeatedly. Whether a physical injury is serious may be a more difficult determination, but I think it is useful to bear in mind that “serious physical injury” is also the term used in the N.C. juvenile code’s definition of “abused juveniles” for purposes of determining whether a child is in need of protective services. See G.S. 7B-101(1). In my opinion, if a nonaccidental physical injury triggers the duty to make a report of suspected child abuse to DSS, a physician likely has good-faith cause to believe the injury is serious enough to trigger this separate duty to report to law enforcement.
Are health care providers required to report domestic violence to law enforcement?
It depends on the nature of the victim’s injuries. Some states have laws that specifically require health care providers to report domestic violence. North Carolina does not have a law that requires reports of domestic violence per se, but some domestic violence cases result in injuries that fall under the reporting requirements of G.S. 90-21.20. If a domestic violence victim suffers an injury or illness described in the bulleted list above, the physician or facility administrator must report the injury to law enforcement.
Suppose a health care provider makes a report to law enforcement that is required by G.S. 90-21.20. Law enforcement officials determine they need additional information for their investigation. May the health care provider respond to law enforcement requests for additional information?
G.S. 90-21.20 does not authorize any further disclosures to law enforcement officials. It is possible further disclosures may be made, but authority for such disclosures must come from some source other than this statute, and it must be permitted by HIPAA as well. That’s a whole other blog post, but you can read my outline summary of when local health departments may disclose information to law enforcement officials here.
Coates’ Canons NC Local Government Law
Here at the School of Government, we get a lot of questions about disclosing medical records or information to law enforcement officials. Often the question arises when a law enforcement official appears at a health care facility and presents a search warrant or court order for the information, a situation my colleague Jeff Welty has written about on the SOG’s North Carolina Criminal Law blog. But disclosure of medical information is not always initiated by law enforcement. Sometimes a health care provider treats a patient for an injury or illness, such as a gunshot or stab wound, that suggests a violent crime has occurred. Law enforcement may not be aware of these situations unless someone tells them. Therefore, North Carolina has a statute (G.S. 90-21.20) that requires health care providers to notify local law enforcement officials when they treat patients with particular injuries or illnesses.
The statute has two subsections that address the types of injuries and illnesses that must be reported—one that applies to all patients, and one that applies only to patients who are minor children. Subsection (b) identifies the injuries and illnesses that must be reported regardless of the patient’s age. Subsection (c1) describes the additional circumstances in which a report is required if the patient is a minor child. This post summarizes the provisions of each section and then addresses some frequently asked questions.
Injury or Illness Potentially Caused by a Criminal Act [G.S. 90-21.20(b)]
A physician or administrator of a health care facility must report:
The report must be made to local law enforcement officials—the police department for the city in which the treatment occurred, or if the treatment occurs outside city limits, the county sheriff’s department. The law does not specify how the report is to be made, but it requires that the report be made “as soon as it becomes practicable before, during or after completion of treatment.” This suggests to me that a telephone call would be both appropriate and preferable to a written report. The information to be reported is specified (and limited to): the patient’s name (if known), age, sex, race, residence or present location (if known), and the character and extent of the patient’s injuries.
A physician or administrator who makes a report required by this section in good faith is immune from any civil or criminal liability that might otherwise arise under state law as a result of the disclosure of information.
Nonaccidental Recurrent Illness or Serious Physical Injury to a Child [G.S. 90-21.20(c1)]
The reports required by subsection (b) apply to all patients regardless of age. Subsection (c1) imposes an additional reporting requirement that applies only if the patient is a child under the age of 18. This subsection requires a physician or administrator to make a report if a child who is treated has a recurrent illness or serious physical injury that, in the physician’s professional judgment, is the result of nonaccidental trauma.
The report must be made to local law enforcement officials—the police department for the city in which the treatment occurred, or if the treatment occurs outside city limits, the county sheriff’s department. The law does not specify how the report is to be made, but like the reporting requirement of subsection (b), it requires that the report be made as soon as practicable. The content of the report is not specified.
The law specifies that the report to law enforcement must be made in addition to any report that is made to the department of social services pursuant to G.S. 7B-301 (requiring all persons to report cause to suspect a child is abused, neglected, dependent, or has died as a result of maltreatment). In other words, a report to DSS alone does not suffice; the physician or facility administrator must also report to law enforcement.
A physician or administrator who makes a report required by this section in good faith is immune from any civil or criminal liability that might otherwise arise under state law as a result of the disclosure of information.
Frequently Asked Questions
The statute gives the required reporters immunity from liability under state law. What about HIPAA, a federal law?
The HIPAA privacy rule specifically permits reports to law enforcement that are required by law, including reports of wounds and injuries. 45 C.F.R. 164.512(f). HIPAA defines “required by law” to include state statutes that require disclosures of information, which captures G.S. 90-21.20. So long as the disclosure complies with the terms of the statute—is made in good faith, reports an injury or illness that is required to be reported, etc.—the disclosure is permitted by HIPAA.
What constitutes “grave bodily harm” or “grave illness” for purposes of the reports required by subsection (b)?
Those terms are undefined and no court of record has interpreted them. In practice, physicians exercise their clinical judgment in determining whether an illness or injury falls into this category. In my experience, they are generally comfortable with their determinations that a patient has suffered bodily harm or an illness, but they sometimes ask what is meant by “grave.” Merriam-Webster defines the adjective “grave” as (among other things) “likely to produce great harm or danger.” Grave bodily harm or illness must be reported only if the treating physician believes it resulted from a “criminal act of violence,” another undefined term, but one that causes less angst. If the physician believes in good faith that the grave harm was the result of intentional violence, I think that is sufficient to trigger the duty to report.
Similarly, what constitutes “recurrent illness” or “serious physical injury” for purposes of the reports about children required by subsection (c1)?
These terms are also undefined and uninterpreted, so physicians exercise their clinical judgment. Going back to the dictionary, it’s easy to conclude that a “recurrent illness” is an illness that returns or occurs repeatedly. Whether a physical injury is serious may be a more difficult determination, but I think it is useful to bear in mind that “serious physical injury” is also the term used in the N.C. juvenile code’s definition of “abused juveniles” for purposes of determining whether a child is in need of protective services. See G.S. 7B-101(1). In my opinion, if a nonaccidental physical injury triggers the duty to make a report of suspected child abuse to DSS, a physician likely has good-faith cause to believe the injury is serious enough to trigger this separate duty to report to law enforcement.
Are health care providers required to report domestic violence to law enforcement?
It depends on the nature of the victim’s injuries. Some states have laws that specifically require health care providers to report domestic violence. North Carolina does not have a law that requires reports of domestic violence per se, but some domestic violence cases result in injuries that fall under the reporting requirements of G.S. 90-21.20. If a domestic violence victim suffers an injury or illness described in the bulleted list above, the physician or facility administrator must report the injury to law enforcement.
Suppose a health care provider makes a report to law enforcement that is required by G.S. 90-21.20. Law enforcement officials determine they need additional information for their investigation. May the health care provider respond to law enforcement requests for additional information?
G.S. 90-21.20 does not authorize any further disclosures to law enforcement officials. It is possible further disclosures may be made, but authority for such disclosures must come from some source other than this statute, and it must be permitted by HIPAA as well. That’s a whole other blog post, but you can read my outline summary of when local health departments may disclose information to law enforcement officials here.
All rights reserved. This blog post is published and posted online by the School of Government to address issues of interest to government officials. This blog post is for educational and informational use and may be used for those purposes without permission by providing acknowledgment of its source. Use of this blog post for commercial purposes is prohibited. To browse a complete catalog of School of Government publications, please visit the School’s website at www.sog.unc.edu or contact the Bookstore, School of Government, CB# 3330 Knapp-Sanders Building, UNC Chapel Hill, Chapel Hill, NC 27599-3330; e-mail sales@sog.unc.edu; telephone 919.966.4119; or fax 919.962.2707.
Copyright © 2009 to Present School of Government at the University of North Carolina.November 10, 2011 The Penn State sexual abuse scandal has prompted me to ponder this (thankfully hypothetical) question: What if the acts described in the grand jury report occurred on a health care provider’s premises–would confidentiality laws permit a report to law enforcement? The answer is clearly yes. It’s possible the report would be required by the law described in this post, if the victim suffered one of the injuries that must be reported under subsection (b) or (c1). But even if there were no such injury, the health care provider could make a report to law enforcement under a provision of HIPAA that specifically addresses reports to law enforcement about crimes on the provider’s premises. 45 CFR 164.512(f)(5) expressly permits a HIPAA-covered entity to disclose patient information if the covered entity believes in good faith that the information constitutes evidence of criminal conduct that occurred on the covered entity’s premises.
Comments are closed.Knapp-Sanders Building
Campus Box 3330
UNC Chapel Hill
Chapel Hill, NC 27599-3330
T: 919.600.7874