When a patient escapes or elopes from the Colorado Mental Health Institute at Pueblo, what can the hospital tell the police, the media, and local schools without violating HIPAA or state confidentiality law?

Opinion 11-02: When patients escape or elope from CMHIP, the disclosures the hospital can make turn on whether the patient is forensic or civil and on whether there is an imminent threat

Plain-English summary

Two things are true at once. The HIPAA Privacy Rule sets a federal floor on what a "covered entity" can disclose about a patient's protected health information, with specific exceptions for law enforcement, imminent threats, and missing persons (45 C.F.R. § 164.512). Colorado's mental health confidentiality statute (§ 27-65-121) sets stricter privacy protections for information obtained or records prepared in the course of providing mental health services, but with a key carve-out: there is no privilege for "criminal behavior committed upon the premise" except for written medical records or testamentary privileges (§ 27-65-121(3)).

The two layers interact through HIPAA's preemption rule (45 C.F.R. § 160.203): state law controls when it provides "more stringent" privacy protection. So the AG's analysis was: read federal and state law together, find the most restrictive permission rule, and apply it.

For forensic patients (those at CMHIP through the criminal court process), the absence is itself the crime of escape under § 18-8-208(6). That criminal-act-on-the-premises trigger lifts the state confidentiality statute, which means CMHIP can disclose information about the escape, subject to HIPAA limits: (a) law-enforcement disclosure to identify or apprehend an escapee under 45 C.F.R. § 164.512(j)(1)(ii)(B); (b) disclosure to anyone reasonably able to prevent or lessen an imminent health-or-safety threat under § 164.512(j)(1)(i); (c) limited disclosures to law enforcement for missing-person identification under § 164.512(f)(2), restricted to specific descriptive data points like name, address, height, weight, scars.

For civil patients, elopement is not a crime, so the state confidentiality statute's privilege remains intact unless the patient is also observed engaging in on-premises criminal conduct. CMHIP can still disclose under HIPAA's imminent-threat and missing-person provisions, but not under the law-enforcement-escape exception.

The state Duty to Warn statute (§ 13-21-117) and the Interstate Compact on Mental Health (§ 24-60-1001) supply additional disclosure authority when a patient (forensic or civil) has communicated a serious threat of imminent physical violence against a specific person, or escapes while dangerous or potentially dangerous.

Currency note

This opinion was issued in 2011. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Background and statutory framework

CMHIP houses both forensic and civil patients. A forensic patient is one referred through the criminal court process (typically incompetency or insanity adjudications). A civil patient is one referred through voluntary commitment or the civil court process. A forensic patient's unauthorized departure is an "escape" and is criminal under § 18-8-208(6). A civil patient's unauthorized departure is an "elopement" and is not, in itself, criminal.

HIPAA covers CMHIP as a "covered entity" under 45 C.F.R. § 160.102. The Privacy Rule (45 C.F.R. § 164.502) presumptively prohibits disclosure of protected health information, with exceptions in § 164.512 for public-interest disclosures. Section 164.512(j) addresses imminent threats; § 164.512(f) addresses law enforcement; § 164.512(j)(1)(ii) addresses individuals who escaped from correctional institutions or lawful custody.

Colorado's mental health confidentiality statute (§ 27-65-121(1)) declares that all information obtained and records prepared in the course of providing mental health services are confidential and privileged. But § 27-65-121(3) creates a carve-out: there is no privilege for information about observed criminal behavior on the premises (other than written medical records or testamentary-privilege-covered communications).

The Duty to Warn statute (§ 13-21-117) requires mental health providers to make reasonable efforts to warn or protect specific persons threatened by a patient. The Interstate Compact on Mental Health (§ 24-60-1001) requires party states to "promptly notify all appropriate authorities within and without the jurisdiction of the escapee" when a dangerous or potentially dangerous patient escapes.

What the AG concluded at the time

HIPAA preemption framework

Under 45 C.F.R. § 160.203, state law preempts HIPAA only if it provides more stringent privacy protection. Colorado's mental health confidentiality statute does provide more stringent protection in many respects, but where state and federal law both permit disclosure, the disclosing entity can disclose. Where state and federal law are not contrary, both are read together.

Forensic patients: broader disclosure

Because escape is a crime under § 18-8-208(6) committed on CMHIP premises, § 27-65-121(3)'s carve-out lifts the state confidentiality statute's bar. CMHIP can disclose escape-related information, subject to HIPAA's permitted use and disclosure provisions:

• Law enforcement disclosure under 45 C.F.R. § 164.512(j)(1)(ii)(B) to identify or apprehend an individual who has escaped from a correctional institution or from lawful custody.
• Imminent-threat disclosure under § 164.512(j)(1)(i)(A) and (B) to anyone reasonably able to prevent or lessen an imminent threat to health and safety.
• Missing-person disclosure under § 164.512(f)(2) to law enforcement for identification or location, limited to specific data points: name, address, date and place of birth, social security number, blood type, type of injury, treatment dates, death date, and physical descriptors (height, weight, gender, race, hair and eye color, facial hair, scars, tattoos). 65 Fed. Reg. 82,531-82,532 (Dec. 28, 2000) clarified that these missing-person disclosures may also be made to a person making a request on behalf of law enforcement, including a media organization conducting an emergency identification appeal.

Civil patients: narrower disclosure

Elopement is not a crime, so § 27-65-121(3) does not lift the privilege unless the patient is independently observed in criminal conduct on the premises. Without that, only two of the HIPAA exceptions are available: imminent-threat disclosure (45 C.F.R. § 164.512(j)) and missing-person disclosure (45 C.F.R. § 164.512(f)(2)). The law-enforcement-escape exception in § 164.512(j)(1)(ii)(B) does not apply because the elopement is not an escape from a correctional institution.

Duty to Warn applies regardless of patient status

When a patient (forensic or civil) has communicated a serious threat of imminent physical violence against a specific person, § 13-21-117 requires CMHIP to warn or protect the target and notify an appropriate law enforcement agency, or take other appropriate action. "Other appropriate action" can include media or school notification when targeted at warning or protecting the threatened person.

Interstate Compact provides parallel authority

Article V of the Interstate Compact on Mental Health (§ 24-60-1001) requires CMHIP to "promptly notify all appropriate authorities within and without the jurisdiction of the escapee" when a dangerous or potentially dangerous patient escapes. The Compact applies to forensic and civil patients alike. The terms "dangerous" and "appropriate authorities" should be construed in the context of HIPAA (the Compact provides nationwide standards for transfers; HIPAA provides nationwide standards for PHI privacy), so "dangerous" maps onto HIPAA's serious-threat-to-health-or-safety standard and "appropriate authorities" maps onto law enforcement and persons reasonably able to prevent or lessen the threat.

Threat assessments raise their own privilege issues

To know whether disclosure is authorized, CMHIP must make threat assessments. But those threat assessments are usually informed by treatment information, which is independently confidential under § 12-43-218 (mental health professional confidentiality) and § 13-90-107 (testamentary privileges). So while CMHIP can use treatment-derived information internally to decide whether the imminent-threat exception is triggered, disclosing the basis for the threat assessment to the public is generally contrary to law or ethics. The exception is the Duty to Warn statute's specific-target-and-law-enforcement disclosure, which is expressly authorized.

Common questions

Can CMHIP confirm to a media outlet that a forensic patient has escaped?

Yes, in principle. The escape is a criminal event on the premises, so the state confidentiality statute does not bar disclosure of the fact of escape. Under HIPAA, the missing-person exception in § 164.512(f)(2) authorizes specific descriptive disclosures (name, physical description) to assist in identification, including disclosures made to media organizations on behalf of law enforcement. But CMHIP cannot disclose treatment information beyond what the missing-person exception lists.

What about a civil patient elopement, can CMHIP confirm that to media?

Generally, no, unless there is an imminent threat to health or safety or unless the eloping patient also engaged in observable on-premises criminal conduct. The state confidentiality statute remains intact and bars disclosure of the basic fact of elopement absent one of the HIPAA exceptions plus a parallel state-law authorization.

What happens if a forensic patient escapes and may target a specific person?

The Duty to Warn statute (§ 13-21-117) imposes an affirmative obligation to warn the target and notify law enforcement, plus take other appropriate action. The HIPAA imminent-threat exception authorizes the disclosure on the federal side. The two operate together.

Does this opinion say schools must be notified when a patient escapes near them?

The opinion identifies notification of public schools as one possible "appropriate action" when the Duty to Warn statute is triggered (a specific threat against a specific person located at or near the school). It does not require routine school notification of all escapes; it allows it when warranted by the specific-threat or imminent-threat triggers.

Can CMHIP rely on the Compact's notification language as a stand-alone authority to disclose, even if HIPAA would not?

The opinion reads the Compact and HIPAA together. The Compact mandates notification of "appropriate authorities" when a dangerous or potentially dangerous patient escapes; HIPAA's imminent-threat exception provides the federal disclosure authority. The two are construed to give effect to both. The Compact would not authorize a disclosure that HIPAA prohibits, but in practice the two overlap when a threat is serious.

Citations

• C.R.S. § 18-8-208(6) — making forensic-patient escape a crime.
• C.R.S. § 27-65-121(1) — confidentiality and privilege for mental health treatment information.
• C.R.S. § 27-65-121(3) — no privilege for criminal behavior committed on the premises.
• C.R.S. § 13-21-117 — Duty to Warn statute.
• C.R.S. § 24-60-1001 — Interstate Compact on Mental Health.
• C.R.S. § 12-43-218; § 13-90-107 — confidentiality of communications with mental health professionals; testamentary privileges.
• 45 C.F.R. § 160.203 — HIPAA preemption rule (state law controls if more stringent).
• 45 C.F.R. § 164.502 — general HIPAA disclosure prohibition.
• 45 C.F.R. § 164.512(f)(2) — limited law-enforcement disclosure for missing-person identification.
• 45 C.F.R. § 164.512(j) — imminent-threat exception.
• 45 C.F.R. § 164.512(j)(1)(ii)(B) — law-enforcement disclosure to identify or apprehend an escapee from a correctional institution or lawful custody.

Source

• Landing page: https://coag.gov/attorney-general-opinions/
• Original PDF: https://coag.gov/app/uploads/2019/08/No.-11-2-The-Extent-to-Which-Federal-Law-Allows-the-Colorado-Mental-Health-Institute-at-Pueblo-to-Notify-Outside-Authorities-Including-Media-and-Public-Schools-When-Foresic-Patients-Escape-or-El.pdf

Original opinion text

STATE OF COLORADO

John W. Suthers
Attorney General

DEPARTMENT OF LAW

Cynthia H. Coffman
Chief Deputy Attorney General

Office of the Attorney General
State Services Building
1525 Sherman Street - 7th Floor
Denver, Colorado 80203
Phone (303) 866-4500

Daniel D. Domenico
Solicitor General

FORMAL OPINION OF JOHN W. SUTHERS Attorney General

No. 11-02
AG Alpha No. HS SH AGBDJ
March 24, 2011

Ken Cole, Director, Mental Health Institutes, Colorado Department of Human Services, Office of Behavioral Health and Housing, requested an opinion from this office concerning the extent to which federal law allows the Colorado Mental Health Institute at Pueblo ("the Institute") to notify outside authorities, including media and public schools, when forensic patients escape or when civil patients elope, and to what extent the Institute can provide current threat assessments when patients escape or elope.

QUESTIONS PRESENTED AND CONCLUSIONS

Question 1: To what extent does federal law allow the Institute to notify outside authorities, including the media and public schools, when forensic patients escape and when civil patients elope?

Answer 1: State and federal law must be read together to determine when the Institute may notify outside authorities, including the media, public schools and law enforcement, that a civil or forensic patient has eloped or escaped. The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), sets a minimum level of individual protection against disclosure of personally identifiable health information by covered entities. State law adds to these protections, but also contains mandatory reporting requirements that are consistent with the requirements of the HIPAA Privacy Rule.

Question 2: To what extent does federal law allow the Institute to provide current threat assessments when forensic and civil patients escape or elope?

Answer 2: The Institute will necessarily be making threat assessments in order to determine whether certain disclosure provisions are triggered. However, to the extent that a threat assessment is based on the information learned in the course of treatment, such disclosure generally would be contrary to law or ethical standards. One exception is for disclosure of a threat to a specific person or persons under the State's duty to warn statute.

DISCUSSION

Question 1. To what extent does federal law allow the Institute to notify outside authorities, including the media and public schools, when forensic patients escape and when civil patients elope.

For purposes of this opinion, "forensic patient" means a patient who was referred to the Institute through the criminal court process. A "civil patient" means a person who has been referred to the Institute through voluntary commitment or through the civil court process. A forensic patient's disappearance from the Institute is referred to as an "escape", and the disappearance constitutes a crime. § 18-8-208(6), C.R.S. A civil patient's disappearance is referred to as an "elopement" and does not constitute a crime. It is necessary to distinguish between forensic and civil patient disappearances because Federal law permits broader disclosures of PHI if the patient has committed a crime. The Interstate Compact on Mental Health, section 24-60-1001, C.R.S., does not make this distinction, referring to both types of disappearance as escapes.

The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), governs release of patient-related information by the Institute to outside authorities. Pub. L. No. 104-191, codified at 42 U.S.C. § 1320d - 1320d-8. The United States Department of Health and Human Services ("HHS") adopted the HIPAA Privacy Rule to implement HIPAA requirements. U.S. C.F.R., Parts 160, 162 and 164. The Privacy Rule establishes certain minimum standards for the use and disclosure of individually identifiable health information, known as protected health information or PHI, for covered entities.

The Institute is a "covered entity" under the Privacy Rule. A covered entity means, among other things, a health care provider who transmits any health information in electronic form in connection with transactions covered by the HIPAA regulations. 45 C.F.R. § 160.102. The Privacy Rule provides that covered entities may not use or disclose PHI except as permitted by the Rule. 45 C.F.R. § 164.502. Certain disclosures require authorization by the individual whose PHI is being sought, others do not. PHI disclosures concerning escapes or elopements fall within the regulations authorizing public interest disclosures for which no authorization is required. 45 C.F.R. § 164.512.

A. HIPAA Preemption

HIPAA must be read in conjunction with State law requirements. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply. 45 C.F.R. § 160.202. "Contrary" means that it would be impossible for a covered entity to comply with both the State and federal requirements or State law presents an obstacle to the objectives of the federal requirements. 45 C.F.R. § 160.202. When the provisions at issue are not contrary, the State and federal laws applicable to disclosure should be construed so as to give effect to both. However, State law controls when it provides more stringent privacy protection. 45 C.F.R. § 160.203. The term "more stringent" means the State law prohibits or restricts a use or disclosure that would be permitted under HIPAA. 45 C.F.R. § 160.202. State laws protecting the confidentiality of patient records control if they provide greater privacy protections.

Where State law protects the confidentiality of patient information and is not contrary to HIPAA, the State law and HIPAA must be read together in determining what information may be disclosed, to whom, and under what circumstances.

B. State Law

1. Authorized Disclosures Under the State Confidentiality Statute

The State statutes governing treatment of persons with a mental illness at the Institute and other DHS facilities were drafted with the intent to "provide the fullest possible measure of privacy, dignity, and other rights to persons undergoing care and treatment for mental illness". § 27-65-101(1)(c), C.R.S. Consistent with this intent, State law provides strict privacy protections concerning information obtained and records prepared in the course of providing mental health services. Section 27-65-121, C.R.S. ("the State Confidentiality Statute") provides that all information obtained and records prepared in the course of providing any services to individuals under Article 65 shall be confidential and privileged. § 27-65-121(1), C.R.S.

However, section 27-65-121(3), C.R.S., makes clear that there is no privilege or confidentiality for information concerning observed criminal behavior committed upon the premise, except written medical records or information covered by one of the testamentary privileges. § 13-90-107, C.R.S. (The Colorado statute detailing testamentary privileges including those related to communication with physicians, psychologists, therapists and social workers.) A forensic patient who escapes commits the crime of escape and the crime occurred on the premises of the Institute. While the patient's departure may not be "observed", the patient's absence is observed and that absence without authorization is criminal behavior. Therefore, the State Confidentiality Statute permits the Institute to disclose information concerning the escape.

Reading the State Confidentiality Statute together with the Privacy Rule bases for authorizing PHI disclosure, information concerning a forensic patient's escape may be disclosed so long as the disclosure is consistent with applicable law and standards of ethical conduct, and PHI disclosure is limited as follows:

a. disclosure to law enforcement as necessary to identify or apprehend an individual who has escaped from a correctional institution or from lawful custody. 45 C.F.R. § 164.512(j)(1)(ii)(B).

b. disclosure to anyone reasonably able to prevent or lessen an imminent threat to health and safety of a person or the public. 45 C.F.R. § 164.512(j)(1)(i)(A) and (B).

c. disclosure in response to a law enforcement request for information for purposes of identifying and locating a suspect, material witness or missing person. 45 C.F.R. § 164.512(f)(2). PHI that may be disclosed under this provision is limited to the patient's name and address, date and place of birth, social security number, ABO blood type and RH factor, type of injury, date and time of treatment, date and time of death, if applicable, and a description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos. These disclosures also may be made to a requesting law enforcement agency or to a person making a request on behalf of law enforcement, for example, a media organization making a television or radio announcement seeking the public's assistance in identifying a suspect. 65 Fed. Reg. 82,531 - 82,532 (Dec. 28, 2000).

When a civil patient elopes, the elopement does not constitute a crime. Therefore, the State Confidentiality Statute does not permit disclosure of any information about a civil patient elopement unless the eloping patient is also observed engaging in criminal conduct on the premises. Under these circumstances, the State Confidentiality Statute, when read with the Privacy Rule, permits the Institute to disclose information as set forth in paragraphs b and c above, but not paragraph a, since the elopement is not an escape from a correctional institution or lawful custody. The Privacy Rule also permits disclosure as necessary for law enforcement authorities to identify or apprehend an individual who has made a statement admitting to participation in a violent crime that the Institute reasonably believes may have caused serious physical harm. 45 C.F.R. § 164.512(j)(1)(ii)(A). Disclosure is prohibited if the statement admitting to participation in a violent crime is learned by the covered entity in the course of treatment to affect the propensity to commit the criminal conduct or through a request by the individual to initiate or be referred for treatment, counseling or therapy for the propensity to commit the criminal conduct. Generally, this basis would be subsumed under the Privacy Rule authority to disclose PHI to anyone reasonably able to prevent or lessen an imminent threat to health and safety of a person or the public.

2. Authorized Disclosures Under the State Duty to Warn Statute

The State Duty to Warn Statute recognizes the overriding need to have health care providers make reasonable and timely efforts to warn or protect any person or persons when a patient has communicated a serious threat of imminent physical violence against a specific person or persons, and notify an appropriate law enforcement agency or take other appropriate action, regardless of the patient's status as a forensic or civil patient. § 13-21-117, C.R.S. Depending on the circumstances, other appropriate action could include giving notice to the media or a local school district if such action is to warn or protect from harm the person or persons specifically threatened.

The disclosures required under the State Duty to Warn Statute are consistent with the Privacy Rule permitted use and disclosure to avert a serious threat to health or safety. 45 C.F.R. § 164.512(j). Therefore, when an escaping forensic patient or an eloping civil patient has communicated a qualifying threat, the Institute may make disclosure of PHI as reasonably necessary to warn or protect the target(s) and notify law enforcement or take other appropriate action.

3. Authorized Disclosures Under the Interstate Compact on Mental Health

The Interstate Compact on Mental Health ("the Compact") mirrors the State Duty to Warn Statute recognition of the need to notify appropriate authorities when a dangerous or potentially dangerous patient escapes. § 24-60-1001, C.R.S. Although the Compact is generally applicable to voluntary or civil commitments, the duty to warn applies to forensic patients and civil patients alike. § 24-60-1001, Art. IX(a), C.R.S. Article V states:

Whenever a dangerous or potentially dangerous patient escapes from an institution in any party state, that state shall promptly notify all appropriate authorities within and without the jurisdiction of the escapee...

§ 24-60-1001, Article V, C.R.S.

The disclosures required under the Compact are consistent with the Privacy Rule's permitted use and disclosure to avert a serious threat to health or safety. 45 C.F.R. § 164.512(j). Therefore, when a dangerous or potentially dangerous patient, whether forensic or civil, escapes, the Institute is authorized to disclose PHI to all appropriate authorities as are reasonably able to prevent or lessen the threat. 45 C.F.R. § 164.512(j)(1)(A) and (B).

Because the mandate of the Compact provides the Institute with wide latitude in determining when a patient qualifies as dangerous or potentially dangerous, and to what authorities a report of such escape shall be reported, but provides no definitions or clarification of the terms "dangerous" or "authorities", it is reasonable to look to the Privacy Rule for guidance, since the intent of the Compact is to provide nationwide standards for mental health patient transfers and the purpose of HIPAA is to provide nationwide standards for privacy of PHI. "Dangerous" or "potentially dangerous" can be read in the context of the Privacy Rule to mean a patient who the Institute has determined to pose a serious threat to health or safety. 45 C.F.R. § 164.512(j). "Appropriate authorities" can be read in the context of the Privacy Rule to mean law enforcement or any persons the Institute believes reasonably able to prevent or lessen the identified threat. Id. In this manner, the Compact and HIPAA can be construed so as to give effect to both.

Question 2: To what extent does federal law allow the Institute to provide current threat assessments when forensic and civil patients escape or elope?

Several of the bases for disclosure discussed above require the Institute to have made a threat assessment in order to determine what disclosure is authorized or required. However, such a threat assessment would generally be based on information obtained in the course of treatment. Such treatment information is confidential under numerous laws, and disclosure would in most cases conflict with the ethical obligations of the treating professional. See § 12-43-218, C.R.S., concerning the disclosure of confidential communications by a mental health professional; § 13-90-107, C.R.S., concerning testamentary privileges. Only under limited circumstance are disclosures of information obtained in the course of treatment appropriate; most notably pursuant to section 13-21-117, C.R.S., for notification of the target of a specific threat and an appropriate law enforcement agency when a mental health patient communicates a serious threat of imminent physical violence against a specific person or persons.

Therefore, whenever a forensic patient escapes, the Institute may notify law enforcement authorities. When any patient escapes or elopes, the Institute may disclose limited PHI in response to requests for information from law enforcement or those acting on behalf of law enforcement to identify and locate a suspect, material witness or missing person. When the escape or elopement of any patient presents a serious and imminent threat to the health or safety of a person or the public, PHI may be disclosed to anyone reasonably able to prevent or lessen the threat.

The Institute will necessarily be making threat assessments in order to determine whether certain disclosure provisions are triggered. However, to the extent that a threat assessment is based on the information learned in the course of treatment, such disclosure generally would be contrary to law or ethical standards. One exception is for disclosure of a threat to a specific person or persons under the State's Duty to Warn Statute.

Issued this 24th day of March, 2011.