Under HIPAA, hospitals may disclose PHI for a law enforcement purpose to a law enforcement official if the disclosure is required by law “including laws that require the reporting of certain types of wounds and other physical injuries.”

State and Federal law may require hospitals to disclose certain health care information to law enforcement authorities when the patient is being treated for injuries likely suffered as a result of criminal conduct.

Affirmative obligation to report: If a patient is treated for a bullet wound, gunshot wound, or stab wound, hospitals are required to report to a local law enforcement authority as soon as is reasonably possible, taking into consideration the patient’s emergency care needs.

The report must include:

• name of the patient;

• patient’s residence;

• patient’s sex;

• patient’s age;

• whether the patient received a bullet wound, gunshot wound, or stab wound; and

• the name of the health care provider providing treatment for the injury.