Recently, there have been several news articles and viral videos about Immigration and Customs Enforcement (ICE) officers conducting enforcement actions in and around businesses, including some in health care practices. That means it is a good time to review what your rights and obligations are as a health care provider in these circumstances. 

Understanding HIPAA compliance during ICE visits to your med spa

While all states have their own state laws protecting patient privacy, the most well-known is the federal Health Insurance Portability and Accountability Act (HIPAA), which provides rules and standards on handling a patient’s protected health information (PHI), including how it is safeguarded or disclosed by covered entities, such as health care providers. In general, health care providers must keep a patient’s PHI secure, disclosing only in certain situations or when authorized by the patient or their representatives. These responsibilities do not go away when law enforcement officers are present at the clinic or health facility.

However, HIPAA does allow times when a health care provider may make a disclosure of PHI to law enforcement without first obtaining the patient’s authorization, including complying with court orders, warrants and subpoenas and responding to administrative requests. Generally, any such disclosure should be limited to the minimum necessary information needed for the situation. Limited disclosures of name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics are permitted under Health and Human Services guidance to locate or identify subjects, fugitives, witnesses or missing persons suspicious deaths. This is not an exhaustive list, and it is recommended that you review the guidance available here. 

What law enforcement can access inside your medical spa

While HIPAA covers patient privacy and health information, what are the rules for ICE or other law enforcement officers physically entering a health care facility or office? Like other federal law enforcement officers, ICE officers have broad authority to investigate potential violations and pursue suspects. This includes public areas of businesses, lobbies and parking lots. However, they are not generally able to enter private or non-public areas of businesses such as offices or examination rooms unless they meet an exception. This is rooted in the Fourth Amendment’s protection of reasonable expectation of privacy. The exceptions that would allow an officer to enter a private area fall into three broad categories: 

1. If the officers have a warrant. It is important to note that there are two classes of warrant: administrative and judicial. Only a judicial warrant authorizes a law enforcement officer to enter and conduct a search of the otherwise private area named in the document. Judicial warrants are those that are issued or signed by a judge. Administrative warrants, on the other hand, are issued by the enforcement agency themselves and authorize the arrest or detention of suspected individuals, but do not allow officers to enter private areas without permission.
2. If they are given permission to enter the private area. Property owners, tenants and their authorized representatives who have the authority can consent to searches. So, it is important for businesses that may have multiple employees with this type of authorization to have a clear company policy on how to handle these situations.
3. If there are “exigent circumstances.” These are circumstances where the officer reasonably believes, based on the present circumstances, that immediate action is needed. There isn’t a list of defined “exigent circumstances,” since it depends on the immediate facts of the situation. However, common areas that have been found to qualify include if there is a risk to life or serious injury. For instance, officers can enter private areas if they are responding to screams or the sounds of struggle. They can also enter if there is a reasonable belief that evidence may be disposed of before a warrant can be obtained. And officers can enter private areas without a warrant or permission if they are in hot pursuit of a suspect or to prevent the suspect’s escape. Determining if the belief in the exigent circumstances was reasonable is done by courts after the fact. 

How to train med spa staff for law enforcement encounters

While asserting these privacy rights is constitutionally protected, obstructing or interfering with otherwise lawful enforcement activities can be prosecuted under federal law. These non-protected activities may include providing false or misleading information to officers, hiding or destroying documents or evidence, and hiding or assisting suspects with evading agents.

Enforcement actions or raids are often fast-moving and chaotic situations with heightened emotions. The line between constitutionally protected actions and illegal obstruction can be difficult to tell in the heat of the moment. So, it is important for health care businesses to have a clear policy to protect their patient’s privacy rights. Staff should have a clear idea of what steps to take and who to contact when someone, whether it is an ICE or police officer or another person in an official capacity, is seeking access to the private areas of the business.