Disclosures by workforce members who are victims of a crime

§164.502(j)(2) – Disclosures by workforce members who are victims of a crime: A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce who is the victim of a criminal act discloses protected health information to a law enforcement official, provided that:
(i) The protected health information disclosed is about the suspected perpetrator of the criminal act; and
(ii) The protected health information disclosed is limited to the information listed in §164.512(f)(2)(i).

Audit Inquiry

How has the covered entity ensured that disclosures by a workforce member related to his or her status as a victim of a crime are consistent with the rule?

Inquire of management how the entity identifies and treats disclosures of PHI by workforce members who are victims of a crime.

Obtain and review policies and procedures related to disclosures of PHI by workforce members who are victims of a crime. Evaluate whether disclosures are treated consistent with the established performance criterion and the entity established policies and procedures.