Can Connecticut hospitals report voluntary psychiatric admissions to the state without violating the psychiatrist-patient privilege or HIPAA, so the state can flag people who shouldn't have firearms?

Plain-English summary

Connecticut's Public Act 13-03, enacted shortly after the Sandy Hook tragedy, required hospitals to report voluntary admissions for psychiatric care to the Department of Mental Health and Addiction Services (DMHAS) and required DMHAS to report that information to the Department of Emergency Services and Public Protection (DESPP) so DESPP could deny or revoke firearms permits for anyone voluntarily confined for psychiatric care within the previous six months.

Hospitals and the Connecticut Hospital Association balked, asking how this fit with the psychiatrist-patient privilege under Conn. Gen. Stat. § 52-146e and with HIPAA. DMHAS asked the AG.

The AG concluded that Public Act 13-03 sections 10 and 11 are themselves legislatively enacted exceptions to § 52-146e, even though they do not amend the privilege statute by cross-reference. Three rules of statutory construction supported that conclusion: (1) statutes covering the same subject are read together; (2) specific provisions covering a precise subject control over general ones; (3) the latest expression of legislative will prevails when reconciliation is impossible. Tomlinson v. Tomlinson, 305 Conn. 539 (2012), provided the framework, and PJM & Associates, LC v. Bridgeport, 292 Conn. 125 (2009), reinforced that statutes must not be construed to render any provision "superfluous, void or insignificant."

On HIPAA, the AG concluded that the same disclosure was permitted under 45 C.F.R. § 164.512, the "uses and disclosures for which an authorization or opportunity to agree or object is not required" rule. Disclosures required by law fit this safe harbor. The Connecticut statute was the required-by-law authority.

The AG expressed personal reservations about the policy, acknowledging that hospitals' reluctance to disclose without patient consent was understandable and that mandatory reporting could discourage voluntary treatment-seeking. But policy decisions about balancing patient confidentiality against gun-violence prevention belong to the Legislature, citing State v. Jenkins, 271 Conn. 165, 183-84 (2004).

Currency note

This opinion was issued in 2013. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: What does Public Act 13-03 actually require hospitals to report?
A: Section 10 directs every hospital admitting a person voluntarily for care and treatment of a psychiatric disability (as defined in § 17a-495) to report to DMHAS the patient's name, address, sex, date of birth, and date of admission. The full clinical record stays at the hospital; only those bare identifiers and dates leave.

Q: What does DMHAS do with the report?
A: Section 11 amends § 17a-500 to require DMHAS to forward that data to DESPP when the person holds, applies for, or seeks renewal of a firearms permit or certificate under the listed gun statutes. DESPP keeps the information confidential and uses it only to administer the firearms-eligibility provisions.

Q: How long does the firearms disability last?
A: Six months from the date of voluntary admission, under PA 13-03 §§ 2, 57, and 58. DESPP must revoke any permit already issued and may not issue a new permit during that period.

Q: Why did the hospitals object?
A: Because § 52-146e generally bars disclosure of psychiatric records without patient consent, and hospitals feared that voluntary disclosure under PA 13-03 would violate the privilege and create civil liability or chill patient willingness to seek inpatient care.

Q: What did Falco v. Institute of Living say?
A: That the psychiatrist-patient privilege protects patient identity (a private lawsuit plaintiff could not pierce the privilege through a bill of discovery to find out the identity of another patient who had attacked him). The Court did say "no exception is available beyond those contained in § 52-146f," but the holding was that the privilege "may be overridden only by legislatively enacted exceptions." The AG read the latter as the actual holding and concluded that PA 13-03 is itself a legislatively enacted exception.

Q: Did HIPAA pose a separate problem?
A: No. 45 C.F.R. § 164.512(a) permits covered entities to disclose protected health information when required by another law. The Connecticut statute supplied the legal requirement; HIPAA stepped aside.

Q: Are there other statutory exceptions to § 52-146e outside § 52-146f to j?
A: Yes, the AG identified several: § 17a-465b authorizes DMHAS to report missing patients to DESPP. § 54-56d(k)(3)(A) lets a court-appointed health guardian access the defendant's records. Section 17a-506 requires reports to probate court for admissions of conserved persons. Section 19a-498b requires nursing home reporting to DMHAS. None of those is cross-referenced from § 52-146f to j, but each operates as a legislative exception. The pattern supported reading PA 13-03 the same way.

Background and statutory framework

The Sandy Hook Elementary School shooting in December 2012 prompted Connecticut's General Assembly to enact comprehensive gun-safety legislation, codified as Public Act 13-03. Two pieces of that act intersected with the psychiatrist-patient privilege:

• Section 10 (amending the hospital reporting statute) requires every hospital voluntarily admitting a person for psychiatric care to report identifying information and date of admission to DMHAS.
• Section 11 (amending § 17a-500) requires DMHAS to forward that data to DESPP for firearms-eligibility determinations under §§ 29-28 to 29-38 and § 53-202d.

DMHAS had asked whether those mandates created legal compulsion or an implied license, given the strict confidentiality of § 52-146e and the Falco and Jenkins decisions. The AG's analysis ran the statutes-in-pari-materia / specific-over-general / latest-expression chain and concluded that PA 13-03 created the necessary exception. On HIPAA, the disclosure fell within the "required by law" safe harbor in 45 C.F.R. § 164.512.

The AG flagged the policy tension. State v. Jenkins, 271 Conn. 165 (2004), held that courts cannot create case-by-case privilege exceptions; only the Legislature can balance confidentiality against public safety. The Legislature had spoken in PA 13-03.

Citations and references

Statutes:
- Conn. Gen. Stat. § 52-146e (psychiatrist-patient privilege)
- Conn. Gen. Stat. § 17a-500
- Public Act 13-03 (Connecticut, 2013)
- HIPAA, 45 C.F.R. § 164.512

Cases:
- Falco v. Institute of Living, 254 Conn. 321 (2000), privilege protects patient identity
- State v. Jenkins, 271 Conn. 165 (2004), exceptions to privilege require legislative action
- In Re Jessica W., 308 Conn. 652 (2012), statutes read together for harmonious application
- Tomlinson v. Tomlinson, 305 Conn. 539 (2012), specific over general, latest prevails
- PJM & Associates, LC v. Bridgeport, 292 Conn. 125 (2009), avoid superfluous interpretation

Source

• Landing page: https://portal.ct.gov/AG/Opinions
• Original PDF: https://portal.ct.gov/-/media/ag/opinions/2013/opinion2013-04_pat_rehmer_opinion9-24-13-pdf.pdf?rev=56bd773d724043dd9c671808f4b7a4cb

Original opinion text

GEORGE C, JEPSEN
ATTORNEY GENERAL,

55 Elm Sireet
P.O. Box £20
Hartford, CF 06141-0120

Office of The Attorney General
State of Connecticut

September 24, 2013

The Honorable Patricia Rehmer

Commissioner

Department of Mental Health and Addiction Services
410 Capitol Ave.

Hartford, CT 06134

Dear Commissioner Rehmer:

This opinion responds to your request for advice about whether P.A. 13-
03, §§ 10 and 11 provide exceptions to the psychiatrist-patient privilege contained
in Conn. Gen. Stat. § 52-146e and whether the disclosure required by the 2013
legislation is permitted under the Health Insurance Portability and Accountability
Act of 1996 (“HIPAA”) Pub, L, 104-191, 110 Stat. 1936, and the HIPPA
regulations promulgated by the Department of Health and Human Services 45
C.F.R. Parts 160 and 164. I understand that a number of hospitals as well as the
Connecticut Hospital Association have made this same inquiry to your agency.

For the reasons that follow, I conclude that P.A. 13-03 §§ 10 and 11 must
be read as legislatively enacted exceptions to Conn, Gen. Stat. § 52-146e,
authorizing the Department of Mental Health and Addiction Services
(“DMHAS”) to collect data from hospitals about voluntary admissions and
permitting DMHAS to re-disclose the voluntary admissions data to the
Commissioner of the Department Emergency Services and Public Protection
(“DESPP”) without the patient’s consent. Additionally, because P.A. 13-03 §§ 10
and 11 specifically permit the use and disclosure of a patient’s involuntary
admission without the patient’s consent, I conclude that 45 C.F.R, § 164.512 (a
HIPAA regulation) permits this disclosure.

Background

By statute DMHAS promotes comprehensive, client-based services in the
areas of mental health and substance abuse treatment. Conn. Gen. Stat. § 17a-
450(b). Services are provided to clients by DMHAS run facilities such as
Connecticut Valley Hospital, as well as by private providers that enter into
provider agreements with DMIIAS to provide services to DMHAS clients. See
e.g., Conn. Gen. Stat. § 17a-453a. With some exceptions, federal and state laws
protect the confidentiality of DMHAS clients, including their identity. See e.g.,
Conn. Gen. Stat. § 52-146d et seq, 45 C.F.R. §164.500 et seq. Privately run
hospitals are subject to these confidentiality laws in the same manner as DMHAS
or DMHAS-contracted facilities.

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 2

P.A. 2013-03

Prior to the enactment of P.A. 13-03, Conn. Gen. Stat. § 17a-500 only
obligated DMHAS to maintain information about probate court orders that
required involuntary commitment of persons to hospitals for psychiatric
disabilities and to then report this information, when requested, to the
Cominissioner of DESPP, Conn. Gen, Stat. § 17a-499 requires probate courts to
report to DMHAS orders of involuntary commitment,

Several months after the Sandy Hook Elementary School tragedy in
Newtown, the General Assembly passed Public Act 13-03. Section 10 of that Act
requires hospitals to report to DMHAS whenever a person is voluntarily admitted
to a hospital for psychiatric disabilities, as defined in Conn, Gen, Stat. § 17a-495,'
for care and treatment of a psychiatric disability. The hospital is required to
include in its report the patient’s name, address, sex, date of birth and date of
admission. Public Act 13-03, § 11 amends Conn. Gen, Stat. § 17a-500 to require
DMHAS to report this information to the Commissioner of the DESPP if such a
person holds, applies for or seeks renewal of” any firearm permit or certificate
pursuant to Conn. Gen. Stat. §§ 29-28 through 29-38, 53-202d, as amended by
P.A, 13-3§§ 2 through 5, 28 and 58> The Commissioner of DESPP is required to
the keep the voluntary admission information confidential and only use the data
for purposes of fulfilling his obligations under Conn. Gen, Stat.§§ 53-202d, 29-28
through 29-38. Specifically, pursuant to Sections 2, 57, and 58 of Public Act 13-
03, the DESPP Commissioner is prohibited from issuing firearms certificates and
permits to any person voluntarily confined in a hospital for persons with
psychiatric disabilities within the preceding six months for care and treatment of a
psychiatric disability. The DESPP Commissioner also must revoke any certificate
or permit issued to such a person who has been voluntarily confined in a hospital

' Pursuant to Conn. Gen. Stat. § 17a-495, “hospital for psychiatric disabilities” means “any public
or private hospital, retreat, institution, house or place in which any mentally ill person is received
or detained as a patient;” and “mentally ill person” means “any person who has a mental or
emotional condition which has substantial adverse effects on his or her ability to function and who
requires care and treatment... .”

? Pursuant to Section 8(a) of P.A. 13-03, when DESPP receives an application for a permit, a
certificate or a renewal, it must “verify” that the applicant has not been voluntarily admitted “by
making inquiry to” DMHAS.

3 Because the information provided to DMHAS from the hospitals will not be provided in
DMHAS’ capacity as a covered entity, HIPAA does not apply as to the provision of the reported
information in accord with § 11 of Public Act 2013-13 to DESPP.

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 3

for persons with psychiatric disabilities within the preceding six months for care
and treatment of a psychiatric disability.

Conn. Gen. Stat. § 52-146c Psychiatrist-Patient Confidentiality

Your first question concerns whether Conn. Gen. Stat. § 52-146e, the
Psychiatrist-Patient Confidentiality statute, prevents your agency from making the
disclosure that Public Act 13-03 directs, Connecticut General Statutes § 52-146e
and provides in relevant part:

(a) All communications and records as defined in
section 52-146d* shalt be confidential and shall
be subject to the provisions of section 52-146d
to 52-146j, inclusive. Except_as provided in
section 52-146f to 52-1461, inclusive, no person
may disclose or transmit _any communications
and records or the substance or any part or any
resume thereof which identify a patient to any
person, corporation or governmental agency
without the consent of the patient or his
authorized representative. (emphasis supplied)

As is plain from the language of the statute, Conn, Gen. Stat. § 52-146e
protects against disclosing the identity of a psychiatric patient. See Falco_v.
Institute of Living, 254 Conn. 321, 329 (2000)(purpose of § 52-146e privilege is
to preserve the therapeutic relationship betwcen the patient and psychiatrist and
includes the identity of the patient), None of the exceptions referenced in § 52-
146e itself apply to the present circumstance.

• Conn, Gen. Stat. § 52-146d contain the following relevant definitions: “(2) ‘Communications and
  records’ means all oral and written communications and records thereof relating to diagnosis or
  treatment of a patient’s mental condition between the patient and a psychiatrist, or between a
  member of the patient’s family and a psychiatrist, or between any such persons and a person
  participating under the supervision of a psychiatrist in the accomplishment of the objectives of
  diagnosis and treatment, wherever made, including communications and records which oceur in or
  are prepared at a mental health facility;”...

“(4) ‘Identifiable’ and ‘identify a patient’ refer to communications and records which contain (A)
names or other descriptive data from which a person acquainted with the patient might reasonably
recognize the patient as the person referred to, or (B) codes or numbers which are in general use
outside of the mental health facility which prepared the communications and records}...

“(6) ‘Patient? means a person who communicates with or is treated by a psychiatrist in diagnosis
or treatment.”

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 4

Your agency is concerned that P.A. 13-03, §§ 10 and 11 do not
specifically amend §§ 52-146f through 52-146j to create an exception to the
confidentiality requirement of § 52-146e. Further, DMHAS is concerned that the
Public Act contains no language specifically authorizing DMIHAS to disregard the
confidentiality requirement of § 52-146e when fulfilling its reporting obligations
under P.A, 13-03.

When faced with statutory provisions that appear to impose conflicting
obligations, courts seek to read them together and if possible construe the
provisions to avoid conflict. Specifically, when more than one statutory provision
is involved, our Supreme Court presumes that the legislature intended those
provisions to be read together to create a harmonious body of law. In Re Jessica
W, 308 Conn. 652, 672 (2012). If the two statutory provisions cannot be
reconciled, the following well-established statutory construction principles apply:

[S]pecific terms covering the given subject matter
will prevail over general language of the same or
another statute which might otherwise prove
controlling... . Where there are two provisions in a
statute, one of which is general and designed to
apply to cases generally, and the other is particular
and relates to only one case or subject within the
scope of a general provision, then the particular
provision must prevail; and if both cannot apply, the
particular provision will be treated as an exception
to the general provision. . . . Additionally, if the
expressions of legislative will are irreconcilable, the
latest prevails. . . . see also 2B N. Singer & J.
Singer, Sutherland Statutory Construction (7th
Ed.2008) § 51:2, p. 228 (“where two statutes deal
with the same subject matter, the more recent
enactment prevails as the latest expression of
legislative will”).

Tomlinson v. Tomlinson, 305 Conn, 539, 552-553 (2012)(Citations omitted;
internal quotation marks omitted.). Finally, if possible, a court will not construe
a statutory provision in way that the provision becomes “superfluous, void or
insignificant." PJM & Associates, LC yv. Bridgeport, 292 Conn, 125, 138 (2009),

Applying these rules of statutory construction, I conclude that P.A. 13-03
§§ 10 and 11 are legislatively enacted exceptions to Conn. Gen. Stat. § 52-146e,
even though these provisions do not contain an explicit exception to Conn, Gen,

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 5

Stat. § 52-146e. Because Public Act 13-03 is the most recent articulation of
legislative intent, and a more specific articulation of state policy regarding the
treatment of psychiatric information in the specific context of preventing firearm
violence, I conclude that P.A. 13-03, §§ 10 and 11 provide a further statutory
exception to the psychiatric privilege. The disclosures contemplated by P.A, 13-
03, §§ 10 and 11 are required so that the DESPP Commissioner can fulfill his
obligations under the statute to revoke or deny any permit or certificate for a
firearm to any person voluntarily admitted to a psychiatric hospital within the
preceding six months for care and treatment of a psychiatric disability.
Construing Public Act 13-03 in a way that does not create a legislative exception
to § 52-146e could effectively undermine the entire purpose of the mandated
disclosures under the Public Act, rendering it “superfluous, void or insignificant.”

Neither Falco v, Institute of Living, 254 Conn, 321, 329 (2000), nor State
v. Jenkins, 271 Conn. 165, 181-182 (2004), support a conclusion that the only
exceptions permitted to § 52-146e are those listed in § 52-146f through § 52-146i.
In Falco, the plaintiff, who had been a patient at the Institute of Living, was
attacked by another patient during a group meeting. The plaintiff sought to learn
the identity of the other patient at the Institute through a Bill of Discovery. The
Supreme Court agreed with the Institute that protecting communications that
identify a patient were central to the purpose of § 52-146e and were protected.
Although the Court stated at one point in the opinion that “no exception is
available beyond those contained in § 52-146f”; id, at 330; the holding of the case
is contained the Court’s conclusion “that the psychiatrist-patient privilege may be
overridden only by legislatively enacted exceptions, and that the facts of this case
do not fall within the narrowly drawn exceptions delineated by the legislature.”
Id. at 333. I am aware of no principle of law that would require a properly
enacted legislative exception to the privilege be contained in the statute that
creates the privilege.°

Of course it is self-evident that there are in fact exceptions to § 52-146e “beyond those contained
in § 52-146? because § 52-146e itself recognizes that there are exceptions found in “52-146d to
52-146), inclusive.” Moreover, two other statutes explicitly contain exceptions to § 52-146¢e but
are not contained in §§ 52-146f through 52-146j. Conn, Gen. Stat § 17a-465b authorizes DMHAS
Commissioner to permit a report to DESPP that a person receiving in-patient services is missing
and provides that the report may be made, “Notwithstanding the provision of... § 52-146e. . .”
Conn. Gen. Stat, § 54-56d(k)(3)(A) permits a health guardian appointed by the court for a criminal
defendant to have access to the defendant’s psychiatric records and provides that the health
guardian shall have access to the records, “Notwithstanding the provisions of § 52-14G6e.. .”
Finally, in addition to these statutes, Conn. Gen. Stat. § 17a-506 requires a report to the probate
court whenever a hospital for psychiatric disabilities admits a conserved person and Conn. Gen,
Stat. § 19a-498b requires a nursing home administrator or its designee to notify DMHAS of the
admission to a nursing home of a patient with psychiatric diagnosis confimned by Medicaid
assessment. Neither statute references 52-146¢e.

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 6

In Jenkins, the trial judge admitted into evidence, over objection, the
defendant’s mental health records, which contained statements made by the
defendant to a nurse under the supervision of a psychiatrist. The State argued that
the defendant had impliedly waived his right to keep the mental health records
confidential when he claimed during testimony that he was intoxicated at the time
the crime was committed. The Supreme Court held that it was improper for the
defendant’s mental health records to be disclosed without the defendant’s express
consent and that § 52-146e does not provide for an implied wavier of the
privilege. The Court reiterated that courts are without authority to authorize the
release of psychiatric records without the patient’s consent. The Court held:

The exceptions to the general rule of nondisclosure
of communications between psychiatrist and patient
were drafted narrowly to ensure the confidentiality
of such communications will be protected unless
important countervailing considerations require
their disclosure. . . It_is the responsibility of the
legislature, not the courts, to balance the patient’s
right to confidentiality against any other opposing
considerations, ... As we have stated, it is contrary
to the language of the statute and the intent of the
legislature for courts to make discretionary case-by-
case determinations of when the privilege may be
overridden, ...

Id, at 183-84 (emphasis supplied)(citations omitted; internal quotation marks
omitted.)

In my view, Public Act 13-03, §§ 10 and 11 provide exceptions to § 52-
146e. I reach this conclusion with reservations about the wisdom of this policy. I
fully understand the reluctance of providers to make this disclosure without a
patient’s consent as it might discourage individuals from seeking necessary
treatment or otherwise interfere with the therapeutic relationship between patients
and their psychiatrists. Ultimately, however, as our Supreme Court has
concluded, it is for the Legislature to “balance the patient’s right to confidentiality
against any other opposing considerations.” Id. at 183-84, The Legislature has
quite apparently done so in enacting Public Act 13-03, §§ 10 and 11.

HIPPA

You have also asked whether disclosure by providers to DMIAS or by
DMHAS to DESPP would result in a violation of HIPPA, thereby compelling a

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 7

conclusion that HIPPA preempts the disclosure provisions of Public Act 13-03,
§§ 10 and 11.

The Health Insurance Portability and Accountability Act of 1996
(“HIPAA”) Pub. L. 104-191, 110 Stat. 1936, and regulations under HIPAA
promulgated by the Department of Health and Human Services 45 C.F.R. Parts
160 and 164 are federal Jaws that protect the confidentiality of an individual’s
medical records. The federal regulations contain exceptions that permit otherwise
protected health information to be disclosed without an individual’s consent.

In particular, 45 C.F.R. § 164.512 provides that protected health
information may be disclosed or used by a covered entity, in this case all public or
private hospitals, without the individual’s written authorization “in situations
covered by this section, subject to the applicable requirements of this section.”
More specifically, §164.512(a)(1) permits disclosure of protected health
information without an individual’s consent “to the extent that such use or
disclosure is required by law and the use or disclosure complies with and is
limited to the relevant requirements of such law.” “Required by law means a
mandate contained in law that compels an entity to make a use or disclosure of
protected health information and that is enforceable in a court of law,” 45 CFR
§164.103. A disclosure mandated by a statute is included in this definition. Id.

Disclosures pursuant to section 10 of Publie Act 2013-3 by public or
private hospitals to DMHAS of the voluntary admission of a patient for
psychiatric services fall within the “required by law” exception. The final
commentary accompanying HIPAA regulations makes this clear, In addressing
concerns raised about the inclusion of § 164,.512(a), the commentary provides that
this provision was included “to preserve access to information considered
important enough by state or federal authorities to require its disclosure by law.
The importance of these required uses or disclosures is evidenced by the
legislative or other public process necessary for the government to create a legally
binding obligation on a covered entity.” Standards for Privacy of Individually
Identifiable Health Information 65 Fed. Reg. 82462, 82667 (December 28, 2000).
The commentary notes that the phrase “required by law” “is intended to be read
broadly to include the full array of binding legal authority, such as constitutions,
statutes, rules, regulations . . . . [1]t encompasses federal, state or local actions
with legally binding effect... .” 65 Fed. Reg. at 82668, The commentary also
states that § 164.512(a) was generally meant not to interfere with, or add onto, the
requirements of those other laws:

[W]e intend this provision to preserve access to
information considered important enough by state
or federal authorities to require its disclosure by
law... . [SJuch required uses and disclosures arise

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 8

in a myriad of other areas of law, ranging from
topics addressing national security (uses and
disclosures to obtain security clearances), to public
health (reporting of communicable diseases), to law
enforcement (disclosures of gunshot wounds).
Required uses and disclosures also may address
broad national concerns or particular regional or
state concerns, It is not possible, or appropriate, for
{Health and Human Services] to reassess the
legitimacy of or the need for each of these mandates
in each of their specialized contexts.

65 Fed. Reg. at 82667 (emphasis supplied).

Further, the reporting obligation is enforceable both through regulatory
action and injunctive relief. Pursuant to the Public Health Code, licensed facilities
that provide care for mentally ill persons are obligated to comply with applicable
law. See Conn. Gen, Stat. §§ 17-227-14c(D) (hospitals for mentally ill persons),
19a-495-550(b)(5)(A)(ii) (private freestanding mental health day treatment
facilities and psychiatric outpatient clinics for adults); 19a-495-551(b)(4)Gi)
(private freestanding mental health residential living centers). The Commissioner
of Public Health is authorized to enforce the Public Health Code regulations. See
Conn. Gen. Stat. §§ 19a-2a, 19a-495. See also Conn, Gen. Stat. § 3-5 (authority of
Governor to institute actions).

Of note, § 164,512(a)(2) provides that disclosures required by law about
victims of abuse, neglect or domestic violence for judicial or administrative
proceedings, or for law enforcement purposes, require covered health care entities
to meet additional applicable requirements contained in § 164.512(c), (e), or (f).
However, the additional requirements contained in § 164,512(a)(2) only apply to
the specific laws that govern the subject matter specified in (c), (e), or (f). These
additional requirements should not be read as the only circumstances under which
disclosure or use “required by law” may be made pursuant to (a)(1), The section-
by-section description of the HIPAA regulations issued by Department of Health
and Human Services, the promulgating agency, further supports that §
164.512(a)(2) was included to clearly indicate where there are additional
provisions in § 164.512 with which covered entities must comply before
disclosing protected health information required by laws.

To more clearly address where the substantive and
procedural requirements of other provisions in this
section apply, ... in § 164.512 (a)(2) we list the

Honorable Patricia Rehmer
Department of Mental Health and Addiction Services
Page 9

specific paragraphs that have additional
requirements with which covered entities must
comply. They are disclosures about victims of
abuse, neglect or domestic violence (§ 164.512(c)),
for judicial and administrative proceedings (§
164.512(e)), and for law enforcement purposes (§
164.512(H).

65 Fed. Reg. at 82525. “Only when the disclosure involves the particular topics
covered by paragraphs (c), (e), or (f) must the covered entity also comply with the
additional requirements set forth in those paragraphs. Because the topics covered
by paragraphs (c), (e), or (f) are narrow, the ‘required by law’ exception would
lose its force if all required disclosures had to fit within those topics in order for
HIPAA to permit them.” Ohio Legal Rights Serv. v. Buckeye Ranch, Inc., 365 F.
Supp. 2d 877, 889-90 (S.D. Ohio 2005).°

As explained above, notwithstanding my reservations about the wisdom of
this policy, I conclude that Public Act 13-03 §§ 10 and 11 must be interpreted as a
legislatively created exception to Conn. Gen. Stat. § 52-146e and thereby
authorizes psychiatric hospitals to disclose to DMHAS and for DMHAS to re-
disclose to DESPP the voluntary admission of patients for care and treatment of a
psychiatric disability. Thus, I further conclude that for purposes of HIPPA the
disclosures are “required by law” in Connecticut and would not violate federal
law.

I trust this answers your questions.

GEORGE JEPSEN

© See also “Health Information Privacy, Frequently Asked Questions, May a covered entity
disclose protected health information to a Protection and Advocacy system where the disclosure is
required by law?” US. Dept. of = Health & Human Services,
http:/Avww.hhs.gov/oct/privacy/hipaa/faq/disclosures_required_by_law/909.htnl

(last visited at 9/9/13). (“Section 164.512(a)(2) provides that in making a “required by law”
disclosure about adult abuse, neglect or domestic violence (section 164,.512(c)), for judicial or
administrative proceedings (section 164.512(e)), or for law enforcement purposes (section
164.512(f)), covered entities must also comply with any additional privacy requirements in these
provisions that apply.”)