HIPAA GENERAL OPERATING POLICY #17
DISCLOSURES ABOUT VICTIMS OF ABUSE,
NEGLECT OR DOMESTIC VIOLENCE
I. General Rule
Except as otherwise provided in HIPAA General Operating Policies 8, 44 and 45, and except for reports of child abuse or neglect permitted by HIPAA General Operating Policy 18, a HCC may disclose PHI without an authorization about an individual who it reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority authorized by law to receive reports of such abuse, neglect, or domestic violence:
a. To the extent the disclosure is required by law and complies with and is limited according to that law;
b. If the individual agrees to the disclosure; or
c. To the extent the disclosure is expressly authorized by statute or regulation and:
i. The HCC believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or
ii. If the individual is unable to agree due to incapacity and a law enforcement or other public official authorized to receive a report represents that the PHI to be disclosed is not intended to be used against the individual and an immediate enforcement activity depends on the disclosure and would be adversely affected by waiting.
A HCC that makes a disclosure permitted above must promptly inform the individual that such a report has been made unless informing the individual would place the individual at risk of serious harm or the HCC would be informing a personal representative and reasonably believes that the personal representative is responsible for the abuse, neglect or injury.
Revised 09/04/03