Description
Law enforcement PHI disclosure requests come in many forms, and not all of them carry the same disclosure authority. Without a structured documentation process, covered entities risk disclosing PHI without a valid HIPAA basis, failing to apply minimum necessary, or missing the documentation that proves the disclosure was lawful.
The Law Enforcement PHI Disclosure Documentation form is a structured internal record for documenting PHI disclosures to law enforcement under 45 CFR 164.512(f). It captures each step of the disclosure process from officer identity verification through HIPAA permission pathway selection, minimum necessary analysis, transmission details, and accounting of disclosures determination, including accounting suspension documentation when a law enforcement agency requests a delay in accounting.
What Is Included
- Request summary and timeline table capturing request and incident ID, date and time received, officer name and title, agency, badge or ID number, case number, method of request, and identity verification confirmation
- Legal authority and HIPAA permission section with checkboxes covering all six 45 CFR 164.512(f) pathways: required by law, court order or court-ordered warrant, subpoena or judicial summons, grand jury subpoena, administrative request meeting HIPAA conditions, and all limited-information and special-situation pathways for suspect identification, victim information, decedent information, crime on premises, and reporting crime in emergencies
- Administrative request criteria documentation fields for relevance and materiality, specificity and scope, and whether de-identified information could reasonably be used instead
- PHI requested and minimum necessary section with individual identification, requested and disclosed PHI documentation, minimum necessary determination, and limited-information identifier confirmation for suspect and missing person disclosures
- Disclosure details table covering date and time, method, recipient, tracking number, secure transmission confirmation, accounting of disclosures determination, lawful custody basis documentation, and AOD log confirmation
- Accounting suspension request documentation covering oral and written requests, requesting agency, duration and expiration, and oral request statement documentation
- Escalation and special considerations section with checkboxes for Privacy Officer, Security Officer, legal counsel, compliance leadership, and risk management notification
- Attachments and evidence checklist
Who This Is For
Designed for Privacy Officers, compliance staff, and release-of-information personnel at covered entities that respond to law enforcement requests on a recurring basis, including hospitals, emergency departments, laboratories, and health plans. Particularly useful for organizations that receive a high volume of law enforcement contacts and need a consistent, auditable response process.
Regulatory Context: Under 45 CFR 164.512(f), HIPAA permits PHI disclosures to law enforcement without individual authorization in specific circumstances, but the conditions for each pathway differ. The applicable HIPAA permission must be identified, the minimum necessary standard applied unless an exception applies, and for administrative requests, specific criteria must be met before any disclosure is made. Law enforcement requests involving specially protected categories, including substance use disorder records under 42 CFR Part 2, require additional analysis and escalation.
Delivered as an editable Word document (.docx). Download, add your organization header, and put it into use for your next law enforcement contact.
