Television gives the impression that police can walk into a hospital and read a chart. The reality under the HIPAA Privacy Rule is narrower and more specific. Health care providers may share certain information with law enforcement in defined situations, and even then only limited information without a legal order. This guide explains those situations in plain language so that patients understand what protection they have and what to expect. It is educational and not legal advice.
The basic rule
HIPAA covers most health care providers, health plans, and their contractors. As a general rule, they cannot use or disclose your protected health information without your written authorization unless the Privacy Rule specifically permits or requires it. Law enforcement requests are one of the categories the rule addresses in detail. Importantly, in most of these situations HIPAA permits a provider to disclose; it does not require the provider to do so. The provider may decline, and many hospitals have policies that limit disclosures to what is legally compelled.
Also important: police officers are not covered by HIPAA themselves. Once information is lawfully in their hands, HIPAA no longer governs how they use it, although other laws may.
When disclosure to law enforcement is permitted
The Privacy Rule lists specific circumstances in which a provider may disclose protected health information to a law enforcement official without the patient's authorization. The main ones are summarized below.
| Situation | What may be disclosed | Notes |
|---|---|---|
| Court order, court-ordered warrant, subpoena or summons issued by a judicial officer, or grand jury subpoena | What the order requires | The strongest basis; providers generally comply after reviewing the order |
| Administrative request such as an administrative subpoena or investigative demand | Information relevant to a legitimate inquiry | Only if the request is specific, limited in scope, and de-identified information would not suffice |
| Identifying or locating a suspect, fugitive, material witness, or missing person | Limited identifying information only: name, address, date and place of birth, Social Security number, blood type, type of injury, date and time of treatment or death, and a physical description | Does not permit disclosure of DNA, dental records, or body fluid or tissue analysis results |
| Victim of a crime | Information about the victim | Generally requires the victim's agreement unless the victim is incapacitated and specific conditions are met |
| Death that may have resulted from criminal conduct | Information to alert law enforcement | Applies when the provider suspects a crime caused the death |
| Crime on the provider's premises | Evidence of the crime | The provider believes in good faith the information is evidence |
| Emergency care off premises | Information needed to alert law enforcement to a crime, its location, victims, and the perpetrator | Applies to emergency responders reporting a crime |
Separate provisions address reporting required by other laws, such as gunshot wound reporting or child abuse reporting, and situations involving a serious and imminent threat to health or safety. Those are grounded in different parts of the rule but often involve law enforcement as the recipient.
Limits on what can be shared
Three limits apply across nearly all of these situations. First, the minimum necessary standard: the provider must limit the disclosure to the information reasonably necessary for the purpose. A request to confirm whether a person was treated does not justify handing over the full chart. Second, the disclosure must fit the specific permission; the identification and location provision, for example, allows only the listed data elements. Third, the disclosure must be documented, and you have a right to request an accounting of disclosures that includes disclosures made to law enforcement, with some exceptions for ongoing investigations where law enforcement has asked for a temporary suspension.
A police officer's verbal request is not a court order. A provider may choose to disclose limited information under one of the permitted categories, but it is not required to, and it may not release a full record on a verbal request alone.
Special categories with extra protection
Some information has protection beyond HIPAA. Records of federally assisted substance use disorder treatment programs are governed by a separate federal regulation, 42 CFR Part 2, which generally requires a specific court order, not just a subpoena or warrant, before records can be disclosed for use in a criminal investigation or prosecution of the patient. Psychotherapy notes, meaning a therapist's separate personal notes from a counseling session, require the patient's authorization for most disclosures. Many states add protections for mental health, HIV, genetic, and reproductive health information.
In addition, federal rules adopted in 2024 added specific limits on disclosures of reproductive health care information for the purpose of investigating or imposing liability for lawfully provided care. Those provisions have been subject to litigation, and their status may change; a patient concerned about this category should check current guidance from HHS and their state.
What you can do
- Request an accounting of disclosures from your provider. It will list disclosures to law enforcement made within the past six years, except where a temporary suspension has been requested.
- Ask for the provider's Notice of Privacy Practices, which must describe the law enforcement disclosures it may make.
- If you believe a provider disclosed information improperly, file a complaint with the provider's privacy officer and, if unresolved, with the HHS Office for Civil Rights. Complaints must generally be filed within 180 days of when you knew of the disclosure.
- If you receive treatment at a substance use program covered by 42 CFR Part 2, ask how the program handles law enforcement requests; the protections are stronger but you should know the program's process.
- Understand that you cannot generally prevent a provider from complying with a valid court order, but you may be able to challenge the order itself through the courts with a lawyer's help.
State law and other protections
HIPAA sets a floor. State laws that provide more privacy protection continue to apply, and many states require a warrant or court order for categories where HIPAA would permit a more informal disclosure. Providers are required to follow the more protective rule. Hospitals in particular often adopt policies that route every law enforcement request through a privacy officer or legal department, both to protect patients and to make sure the hospital does not disclose more than the law allows.
If you are ever asked by a provider whether you agree to a disclosure to police, you are entitled to say no. Where the rule requires your agreement, the provider must honor that answer unless a separate exception applies.
Common questions
Can a hospital tell police whether I am a patient there?
Under the HIPAA identification and location provision, a provider may disclose limited identifying information, such as name, address, date of birth, and type of injury, in response to a law enforcement request to identify or locate a suspect, fugitive, material witness, or missing person. The provider is permitted but not required to do so, and it may not disclose the full record on that basis.
Do police need a warrant to get my medical records?
For the full record, HIPAA generally requires a court order, court-ordered warrant, judicial subpoena, or grand jury subpoena, or an administrative request that meets specific conditions. Limited information can be shared without a warrant in the specific situations the rule lists. State law may require more.
Can I find out if my records were shared with law enforcement?
Yes. You have a right to an accounting of disclosures, which covers disclosures made without your authorization for purposes other than treatment, payment, and health care operations, including those to law enforcement. Law enforcement can ask the provider to temporarily suspend your access to that information if disclosure would impede an investigation.
Are substance use treatment records treated differently?
Yes. Records of federally assisted substance use disorder programs are protected by 42 CFR Part 2, which generally requires a specific court order with particular findings before records can be used in a criminal investigation or prosecution of the patient. A standard subpoena or warrant is not sufficient by itself.