Could police obtain treatment-facility patient information, and did an out-of-state juvenile have to register locally?

Plain-English summary

Travelers Rest police asked about a juvenile who had left a treatment facility and the facility's refusal to disclose information about him. The Attorney General first clarified that the youth had been placed under the Interstate Compact on the Placement of Children, rather than the compact identified in the request. He said the sending state retained jurisdiction over the child's care and placement under that compact, while South Carolina could address an offense committed within its territory.

On the police information request, the AG gave no blanket authorization. A particular disclosure of protected health information had to fit one of the HIPAA law-enforcement exceptions, including its limits on what information could be released. The opinion also concluded that this juvenile's treatment-facility stay did not amount to Greenville County residence requiring sex-offender registration on the facts described.

Currency note

This opinion was issued in 2008. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Q: Did the AG say police could demand all records from the treatment facility? A: No. He said disclosure had to be evaluated under the applicable HIPAA exception and its limits in the particular situation.

Q: Did the opinion treat this placement as governed by the Interstate Compact on Juveniles? A: No. The AG said the placement had been made under the Interstate Compact on the Placement of Children and analyzed the sending state's retained jurisdiction under that compact.

Q: Did the AG require the youth to register in Greenville County because of the facility stay? A: No. The opinion concluded that the described indefinite treatment placement did not make the youth a resident of that county for registration purposes.

Q: Did the opinion eliminate South Carolina authority over new offenses committed there? A: No. It quoted the compact's preservation of receiving-state jurisdiction over a delinquent act or crime committed in that state.

Background and statutory framework

The police chief raised commitment procedures, patient information, the absence of an active investigation and sex-offender registration. The AG distinguished the applicable interstate compact, quoted the HIPAA exceptions for law enforcement and considered whether a residential treatment placement created local residence under the registry law. Each conclusion was tied to the specific placement and request described.

Citations and references

Statutes discussed: Section 20-7-1980; S.C. Code Ann. § 23-3-450. Federal regulation discussed: 45 C.F.R. § 164.512(f).

Source

• Landing page: https://www.scag.gov/opinions/opinions-archive/may-7-2008/
• Original PDF: https://www.scag.gov/wp-content/uploads/2011/05/crowe-l-c-os-8577-5-7-08-residential-treatment-facility-hippa-runaway-police.pdf

Original opinion text

May 7, 2008

Lance C. Crowe, Chief of Police
Travelers Rest Police Department
6711 State Park Road
Travelers Rest, South Carolina 29690
Dear Chief Crowe:
In a letter to this office you referenced that an individual housed at a facility known to you as SpringBrook (“the Facility”), an acute adult inpatient and adolescent residential treatment facility operating within the city limits of Travelers Rest, was a recent runaway from the Facility. According to your letter, the individual, a fourteen year old male adjudicated delinquent in the State of Maryland for the commission of two homicides, was placed in the Facility in accordance with the Interstate Compact on Juveniles, S.C. Code Ann. §§ 20-7-8705 et seq., for an indeterminate amount of time. You indicated that when the Travelers Rest police requested information about the juvenile’s history, the Facility, refused your request citing the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Referencing such, you have raised the following questions:

1. Are the requirements in S.C. Code Ann. §§ 44-24-10 through 44-24-280 regarding
   the commitment of children in need of mental health treatment inconsistent with the Interstate Compact on Juveniles to the extent that the Facility does not have to file with the Greenville County Probate Court those who are involuntary committed to the Facility?
2. Do HIPAA regulations prohibit the Facility from disclosing information about a
   patient’s legal status and/or criminal history to the Travelers Rest police to assess the public safety risk to the citizens of Travelers Rest?
3. Do HIPAA regulations prohibit the Travelers Rest police from obtaining patient
   legal and/or criminal information not in conjunction with an ongoing criminal investigation?

Chief Crowe
Page 2
May 7, 2008

4. Do inpatients/residents at the Facility, who would, if not residing at the Facility,
   be required to register as a sex offender in their home county, have to register in Greenville County while staying at the Facility? As to your question regarding whether the provisions of Sections 44-24-10 through 44-24280 regarding the commitment of children in need of mental health treatment are inconsistent with the Interstate Compact on Juveniles to the extent that the Facility does not have to file with the Greenville County Probate Court those who are involuntary committed to the Facility, I have been informed by an individual with the State Department of Social Services that the individual referenced in your letter was sent to the Facility pursuant to the Interstate Compact on the Placement of Children (“the Compact”) and not the Interstate Compact on Juveniles. Provisions regarding the Compact are set forth in S.C. Code Ann. §§ 20-7-1980 et seq. As to your question regarding Sections 44-24-10 et seq., in the opinion of this office, such provisions would typically be inapplicable to a juvenile transferred to South Carolina pursuant to the Compact. Subsection (5) of Section 20-7-1980 states that
   [t]he sending agency shall retain jurisdiction over the child sufficient to determine all matters in relation to the custody, supervision, care, treatment and disposition of the child which it would have had if the child had remained in the sending agency’s state, until the child is adopted, reaches majority, becomes self-supporting or is discharged with the concurrence of the appropriate authority in the receiving state. (emphasis added). The term “sending agency” is defined by Section 20-7-1980 as
   ...a party state, officer or employee thereof, a subdivision of a party state, or officer or employee thereof, a court of a party state, a person, corporation, association, charitable agency or other entity which sends, brings, or causes to be sent or brought any child to another party state. Therefore, pursuant to such provision, the State of Maryland would retain jurisdiction over the juvenile and it does not appear that Sections 44-24-10 et seq. would be applicable in such situation. Accord: Op. Miss. Atty. Gen. dated March 2, 1994; Op. Nev. Atty. Gen. dated May 24, 1988. I would only add that a further provision of Section 20-7-1980 states that “[n]othing contained herein shall defeat a claim of jurisdiction by a receiving state sufficient to deal with an act of delinquency or crime committed therein.” Therefore, for an act of delinquency or crime committed in South Carolina, this State would have jurisdiction over that particular act. As to your questions regarding HIPAA, as referenced in a prior opinion of this office dated November 4, 2004,

Chief Crowe
Page 3
May 7, 2008
HIPAA is the Health Insurance Portability and Accountability Act of 1996, 110 Stat. 1936 (1996), and was enacted to protect the privacy of health information. Regulations were promulgated by the Department of Health and Human Services regarding the privacy standards of medical records. 45 C.F.R. parts 160 and 164. As indicated in United States v. Sutherland, 143 F.Supp. 2d 609 (W.D.Va. 2001), HIPAA regulations establish the circumstances under which patient medical records may be revealed by health plans, health care clearinghouses, and most health care providers. As noted in an opinion of the Arkansas Attorney General dated August 23, 2002, the regulations generally, prohibit the disclosure by covered entities of protected health information without the required consent, authorization, or agreement; they require notice by covered entities of the use and disclosure of protected health information to the affected individual; they require covered entities to develop and implement privacy policies and physical standards to protect health information; they require the designation of a privacy officer within the covered entity who is to be responsible for the development and implementation of a privacy policy for the covered entity; they require the designation by covered entities of a contact person or administrative office who is to be responsible for receiving complaints concerning compliance with the privacy policy of the covered entity; and they require covered entities to impose sanctions upon members of the entity's workforce who fail to comply with the entity's privacy policies. In United States v. Zamora, 408 F.Supp.2d 295, 297-298 (S.D.Tex. 2006), the court stated that
[p]ursuant to HIPAA, individually identifiable medical information cannot be disclosed by covered entities without the consent of the individual unless disclosure was expressly permitted by HIPAA. 45 C.F.R. § 164.502. There are several instances where disclosure is permitted without authorization from the individual. 45 C.F.R. § 164.512. “A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.” 45 C.F.R. § 164.512 (emphasis added). “Required by law” is defined as “a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law.” 45 C.F.R. § 164.103. “Required by law includes, but is not limited to, court orders

Chief Crowe
Page 4
May 7, 2008
and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information....” Id. A disclosure made pursuant to § 164.512(a) must meet the requirements outlined in § 164.512(c), (e), or (f). 45 C.F.R.
§ 164.512(a)(2). Section 164.512(f) provides for disclosure of protected information for law enforcement purposes. 45 C.F.R. § 164.512(f). This section permits disclosures for law enforcement purposes to a law enforcement official as required by law, or in compliance with “(A) A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer; (B) A grand jury subpoena; or (C) An administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law....” 45 C.F.R. § 164.512(f)(1)(ii).As an initial matter, pursuant to § 164.512(f)(1)(ii)(C), information sought must be relevant and material to the law enforcement inquiry, the request must be specific and limited in light of the information sought, and de-identified information could not be reasonably used. (emphasis added). As noted above and as set forth in the referenced prior opinion of this office, exceptions exist as to these regulations. As set forth by 45 C.F.R. Section 164.512, A covered entity1 may use or disclose protected health information without the written authorization of the individual…or the opportunity for the individual to agree or object…in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, a use or disclosure permitted by this section, the covered entity's information and the individual's agreement may be given orally.

1

The term “covered entity” is defined by 45 C.F.R. § 160.103 as a “(1) a health plan; (2) health care clearinghouse. (3) a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” I presume the Facility would be included within such definition. The term “health care provider” is defined as a “provider of services (as defined in 42 U.S.C.A. § 1395(u), a provider of “medical and other health services (as defined in 42 U.S.C.A. § 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.” 45 C.F.R. § 160.103.

Chief Crowe
Page 5
May 7, 2008
Consistent with such, a covered entity may disclose or use protected health information without the written authority of an individual in certain different situations. As noted in the referenced opinion, as to exemptions to HIPAA for law enforcement purposes, 45 C.F.R. Section 164.512(f) provides as follows: Standard: Disclosures for law enforcement purposes. A covered entity may disclose protected health information for a law enforcement purpose to a law enforcement official if the conditions in paragraphs (f)(1) through (f)(6) of this section are met, as applicable. (1) Permitted disclosures: Pursuant to process and as otherwise required by law. A covered entity may disclose protected health information: (i) As required by law including laws that require the reporting of certain types of wounds or other physical injuries, except for laws subject to paragraph (b)(1)(ii) or (c)(1)(i) of this section; or (ii) In compliance with and as limited by the relevant requirements of: (A) A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer; (B) A grand jury subpoena; or (C) An administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law, provided that: (1) The information sought is relevant and material to a legitimate law enforcement inquiry; (2) The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and (3) De-identified information could not reasonably be used. (2) Permitted disclosures: Limited information for identification and location purposes. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response

Chief Crowe
Page 6
May 7, 2008
to a law enforcement official's request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, provided that: (i) The covered entity may disclose only the following information: (A) Name and address; (B) Date and place of birth; (C) Social security number; (D) ABO blood type and rh factor; (E) Type of injury; (F) Date and time of treatment; (G) Date and time of death, if applicable; and (H) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos. (ii) Except as permitted by paragraph (f)(2)(i) of this section, the covered entity may not disclose for the purposes of identification or location under paragraph (f)(2) of this section any protected health information related to the individual's DNA or DNA analysis, dental records, or typing, samples or analysis of body fluids or tissue. (3) Permitted disclosure: Victims of a crime. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response to a law enforcement official's request for such information about an individual who is or is suspected to be a victim of a crime, other than disclosures that are subject to paragraph (b) or (c) of this section, if: (i) The individual agrees to the disclosure; or (ii) The covered entity is unable to obtain the individual's agreement because of incapacity or other emergency circumstance, provided that:

Chief Crowe
Page 7
May 7, 2008
(A) The law enforcement official represents that such information is needed to determine whether a violation of law by a person other than the victim has occurred, and such information is not intended to be used against the victim; (B) The law enforcement official represents that immediate law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure; and (C) The disclosure is in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment. (4) Permitted disclosure: Decedents. A covered entity may disclose protected health information about an individual who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the individual if the covered entity has a suspicion that such death may have resulted from criminal conduct. (5) Permitted disclosure: Crime on premises. A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity. (6) Permitted disclosure: Reporting crime in emergencies. (i) A covered health care provider providing emergency health care in response to a medical emergency, other than such emergency on the premises of the covered health care provider, may disclose protected health information to a law enforcement official if such disclosure appears necessary to alert law enforcement to: (A) The commission and nature of a crime; (B) The location of such crime or of the victim(s) of such crime; and (C) The identity, description, and location of the perpetrator of such crime. (ii) If a covered health care provider believes that the medical emergency described in paragraph (f)(6)(i) of this section is the result of abuse, neglect, or domestic violence of the individual in need of emergency health care, paragraph (f)(6)(i) of this section does not apply and any disclosure to a law enforcement official for law enforcement is subject to paragraph (c) of this section.

Chief Crowe
Page 8
May 7, 2008
(emphasis added). As stated at 87 Am. Jur. Proof of Facts 3d 259, Confidentiality of Medical and Other Treatment Records, citing 45 C.F.R. § 164.512(f),
[t]here are several circumstances under which covered entities may disclose protected health information to law enforcement agencies or officials. Protected health information may be disclosed pursuant to laws that require reporting of certain types of injuries or in compliance with a court order, warrant, subpoena (including a grand jury subpoena) summons or administrative request. A covered entity may disclose specific protected health information in response to a law enforcement officer's request for such information for the purpose of identifying or locating a suspect, fugitive or material witness. In response to a law enforcement officer's request about an individual who is or is suspected to be a victim of a crime, a covered entity may disclose protected health information if the individual agrees to the disclosure or, if the entity is unable to obtain the individual's consent due to incapacity or emergency, the law enforcement official represents that the information is needed to determine whether a violation of the law has occurred, the information is not intended to be used against the individual, immediate law enforcement activity would be adversely affected by waiting until the individual is able to agree to the disclosure and the entity determines that disclosure is in the best interests of the individual. If an individual dies on the premises of the health care facility and the facility staff reasonably suspect that the death may have resulted from criminal conduct, the facility may disclose protected health information to alert law enforcement officials. Similarly, a covered entity may disclose protected health information to alert law enforcement officials when it believes criminal conduct has occurred on the entity premises and in the course of providing emergency health care off-premises, if necessary to alert law enforcement officials to the commission of a crime, the location of a crime or its victims and the identity, description and locations of suspected perpetrators of the crime. Therefore, in answer to your questions regarding any prohibition by the Facility from disclosing information regarding a patient’s legal status and/or criminal history to your department to assess the public safety risk or when such information is not in conjunction with an ongoing criminal investigation, I can only point you to the provisions set forth above which would have to be reviewed in light of a particular situation. As set forth, 45 C.F.R. Section 164(f) provides the circumstances allowing for disclosure for law enforcement purposes and a particular situation would have to fit within one of the exceptions set forth by such provision in order for disclosure to law enforcement to occur. That provision also includes the limits to the types of information that may be released where appropriate.

Chief Crowe
Page 9
May 7, 2008
In your last question you asked whether inpatients or residents at the Facility, who would, if not residing at the Facility, be required to register as a sex offender in their home county, have to register in Greenville County while staying at the Facility? This State’s laws regarding registration of sex offenders does not specifically provide an answer to your question. Typically, an offender, including a juvenile, who is incarcerated is not required to register as a sex offender until he or she is released from the place of incarceration. See: S.C. Code Ann. § 23-3-440(1). Also, pursuant to S.C. Code Ann. § 23-3-450, “[t]he offender shall register with the sheriff of each county in which he resides....” In the opinion of this office, an individual housed at the Facility would not be required to register as a sex offender in this State. Again, the statutes regarding registration of individuals who are considered sex offenders do not require registration until the individual is released from a place of incarceration and require registration where the offender “resides”. An individual, following his adjudication as a delinquent, placed in an acute adult inpatient and adolescent residential treatment facility pursuant to an interstate compact for an indeterminate amount of time would not, in the opinion of this office, be considered a “resident” of that location for purposes of registration as a sex offender. A basis for such a determination is consistent with the finding, as set forth in an opinion of this office dated April 11, 1984, that “residency” for other purposes, such as voting, is construed as “domicile”. See Phillips v. S.C. Tax Commission, 195 S.C. 472, 12 S.E.2d 13 (1940). As stated in the 1984 opinion,
[t]he Court has defined a person’s domicile as “the place where [he]...has his true, fixed and permanent home and principal establishment, to which he has, whenever he is absent, an intention of returning. See also: O’Neill’s Estate v. Tuomey Hospital, 254 S.C. 578, 176 S.E.2d 527 (1970). As further stated in that opinion, “intent” is
...primarily an issue of fact, determined on a case by case basis...A person may have but one domicile at any given time; to change one’s domicile, “there must be an abandonment of, and an intent not to return to the former domicile.” There must also be the clear establishment of a new domicile..The Supreme Court has emphasized that “[o]ne of the essential elements to constitute a particular place as one’s domicile...is an intention to remain permanently or for an indefinite time in such place.

Chief Crowe
Page 10
May 7, 2008
It does not appear that an individual placed in an acute treatment facility would necessarily consider that facility to constitute his or her “domicile”. Therefore, it does not appear that registration as a sex offender in such circumstances would be required. With kind regards, I am, Very truly yours, Henry McMaster Attorney General

By:

REVIEWED AND APPROVED BY:

______
Robert D. Cook
Deputy Attorney General

Charles H. Richardson
Senior Assistant Attorney General