Skip to page content

GUIDANCE (Nov. 26, 2007)

Patient Information
Patient information means all information about the patient, including name, medical record number, condition, sex, age, physician name, diagnosis, medical unit, and  other treatment information ("PHI").  The fact that a patient is in the medical center is PHI.


Procedures
City, State or Federal Law Enforcement may seek access to a patient or access to patient information.  Before providing access, follow these steps:

1.   Verify the Identity of the Police Officer.

• If law enforcement appears in person, verify the officer's name, badge number or other agency identification, credentials or proof of government status.
• If you receive a request from a law enforcement officer or agency in writing, verify that the request is on the appropriate letterhead.

2.   Identify What Law Enforcement Wants and the Purpose For the Request.

• Identify the reason that the police officer is requesting the information.

3.   Provide Access Only as Follows -- and Only Provide the Minimum Amount of           Information Necessary for the Purpose.


Access to Patients

• General Statement:
• Physician approval: Access to the patient is subject to the physician's opinion that such access would not impede the patient's care.
  
• Patient approval: Upon physician approval, a healthcare provider will ask the patient whether he/she wants to speak to the police.  The patient is not required to speak to police, and UCMC will respect the patient's wishes.  This applies even if the patient is an alleged perpetrator of a crime.
  
• Note: Mental health, HIV/AIDS, and genetic information may not be disclosed without the written consent of the patient or his/her legal representative.
  

• Exception:  If a patient wants to talk to the police but the physician believes his/her medical condition could be affected, alert the patient of the physician's concerns but allow the access.

Access to Health Care Information, Both Oral and Written (i.e. talking to providers)

• General Statement:  A healthcare provider may share patient information with police with the consent of the patient or the patient's legal representative (for example, the parent, spouse, child, or guardian).  Document the patient's consent and the information provided in the patient's medical record.  In addition, there are occasions when the law permits or requires you to share patient information with law enforcement.
  

• Mental Health, HIV/AIDS, and genetic information may not be disclosed without the written consent of the patient or patient's legal representative.

• Directory Information:  You may provide "directory information" to law enforcement personnel if they inquire whether a patient is an inpatient.  You may call the UCMC operator at 2-1000 and ask if the person is a patient.  If the person is a patient, you may disclose the fact that the person is a patient.  Note that if an inpatient has opted out of the inpatient directory, the operator would have no information; however it does not necessarily mean the patient is not here.

• Crime Committed On The Medical Center's Property:  If a crime has occurred on the Medical Center's property, you may share patient information, but only to the extent necessary for the investigation.

• Crime Committed Off The Medical Center's Property:  If the patient is a victim of a crime at a location other than the UCMC, then the patient's information may be shared upon the patient's permission. 
  

• If the patient's permission is not obtainable, then upon written confirmation that the patient information is needed immediately by law enforcement, a healthcare provider may provide the patient information needed to meet the officer's needs.  The healthcare provider must document in the medical record the following elements:

• The healthcare provider cannot obtain the patient's consent because of incapacity or other emergency circumstances; and
• The officer represents that the patient information is needed to determine whether a violation of law by a person other than the victim has occurred and information is not intended to be used against the victim; and
  
• The officer represents that immediate law enforcement activity that depends on the disclosure would be materially and adversely affected by waiting until the patient is capable of giving consent; and
• Disclosure is determined by professional judgment to be in the best interest of the patient. 
  

The Verification of Law Enforcement's Immediate Need of Information About a Patient Victim form can be used to document this information, but it is acceptable to document each of these four elements in the patient's medical record.

• Alleged Perpetrator of a Crime:  If law enforcement is seeking the information of a patient who is an alleged perpetrator of a crime, patient information may be shared if permitted by the patient and only the amount necessary for the investigation.  Alternatively, patient information may be shared if the officer completes the Law Enforcement Official's Request for Protected Health Information. 
  

• DCFS and Its Delegates:  Upon verification by an officer that he/she has been delegated the investigation authority by DCFS, patient information may be disclosed in response to questions that are related to the investigation.  Verification can be made by either receipt of a DCFS assignment form showing the officer requesting the information has investigation authority, by the officer completing the Verification of Law Enforcement's Immediate Need of Information About a Patient Victim form, or Social Services validation of the delegation of the authority.  See below for specific procedures.
  

• Witness to a Crime:  If a patient informs you that he/she is a witness to a crime, tell the patient we are going to notify the University of Chicago Police Department, and ask the patient if they would like to file a report or make a statement to the UCPD.  Patient information is only given to the extent the patient consents.

• Court Order:  You may provide patient information in response to a valid court order after receiving advice and direction from the Office of Legal Affairs.

• Sexual Assault:  A sexual assault survivor's kit may not be disclosed unless:
• An adult sexual assault survivor or a minor sexual assault survivor 13 years of age or older provides written consent.
• Upon the written request of the parent, guardian, investigating law enforcement officer or DCFS for a minor sexual assault survivor under the age of 13.

• Reporting Obligations:  UCMC must report the following facts -- these reports are required by municipal and/or state laws and the reporting requirements are set forth in Administrative Policy 02-04.  The policy also identifies who may report this information.
• An injury by a patient who is a victim of or during the commission of a crime or an injury resulting from a firearm or object used as a weapon.
• A patient's blood alcohol content obtained as part of the patient's medical care for injuries resulting from a motor vehicle accident should be disclosed upon police request. 
  
• Any of the following injuries sustained by a patient:
• Injury resulting from animal or human bite or from poisoning;
• Injury on public property;
• Injury involving a moving motor vehicle;
• Injury of any cause where it is evident that death will probably ensue as a direct result thereof, or when death has resulted.

• Reminder Note:  If a patient comes in under law enforcement authority, law enforcement is responsible for continuous monitoring of the patient.  While law enforcement may be exposed to patient information while monitoring the patient, no additional patient information should be given unless it falls within one of the areas listed above.

 
If you have any questions, call the Administrator on Call (HOA) at 7500#.




1.     The social worker coordinating child protective services for a specific patient         in Comer Hospital will alert the security desk that the Chicago Police will be             coming to investigate allegations of child abuse.

2.     The Chicago Police will provide the Security Officer in Comer with a form                 entitled "Law Enforcement Official's Request for Protected Health
        Information." If the police arrive without a form after hours, the Security
        Officer shall give the police officer/detective a blank form.  If the police                 officer/detective does not have the required form and refuses to complete a             blank form, but has the name of the assigned social worker and the name and         date of birth of the patient, UCMC Security Services shall page that social                 worker.  If the police officer/detective does not know the name of the                     assigned social worker or if it is after hours, Security Services shall page the             on-call pediatric Social Worker at pager 6807, or if not available, then the                 Social Work Manager at pager 6629 or the Director of Social Work at pager 8126.

3.     Once contacted, the social worker, in concert with Security Services, will             coordinate the police officer/detective's site visit.  In particular, Security                 Services or the social worker will call the floor to state that a police                         officer/detective is coming up to floor and floor staff can direct the police             officer/detective to the appropriate room.

4.      The social worker shall document the following in the progress notes:

                   (1) The name and badge number of the police officer/detective;

                   (2) The fact that the police officer/detective came in response to                                 UCMC's report to DCFS; and

                   (3) The identity of the person with whom the police officer/detective                         met.

Back to Guidances

HIPAA Program Office
The University of Chicago Medical Center | 5841 South Maryland Avenue | Chicago, IL 60637
HPOwebmaster@bsd.uchicago.edu