§164.512(f)(5) Permitted disclosure: Crime on premises. A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.
Audit Inquiry
Are policies and procedures in place to determine when it is permitted to disclose PHI about an individual who may have committed a crime on the premises?
Determine whether policies and procedures related to disclosures of PHI to law enforcement officials address the established performance criterion.
Obtain and review a disclosure, if available. Elements to consider include, but are not limited to, documentation of:
-Whether the entity exercised professional judgment
-Whether the entity believes in good faith that there was evidence of criminal conduct that occurred on its premises.