§164.512(k)(5) Correctional institutions and other law enforcement custodial situations.
(i) Permitted disclosures. A covered entity may disclose to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual protected health information about such inmate or individual, if the correctional institution or such law enforcement official represents that such protected health information is necessary for: (A) The provision of health care to such individuals; (B) The health and safety of such individual or other inmates; (C) The health and safety of the officers or employees of or others at the correctional institution; (D) The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another; (E) Law enforcement on the premises of the correctional institution; or (F) The administration and maintenance of the safety, security, and good order of the correctional institution.
(ii) Permitted uses. A covered entity that is a correctional institution may use protected health information of individuals who are inmates for any purpose for which such protected health information may be disclosed.
(iii) No application after release. For the purposes of this provision, an individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.
Audit Inquiry
How does the covered entity determine whether to disclose PHI to a correctional institution or a law enforcement official with custody of an individual?
Are policies and procedures in place to determine whether a use or disclosure of PHI to a correctional institution or law enforcement official is permitted?
Obtain and review policies and procedures related to disclosures of PHI to correctional institutions or other law enforcement custodial situations for consistency with the established performance criterion.
Obtain and review a sample of documentation of disclosures to a correctional institution or law enforcement official; elements to consider include, but are not limited to, whether the disclosure is necessary for:
-The provision of health care to such individuals
-The health and safety of such individual or other inmates
-The health and safety of the officers or employees of or at the correctional institution
-The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another
-Law enforcement on the premises of the correctional institution
-The administration and maintenance of the safety, security, and good order of the correctional institution.