Executive Summary

Recent changes to the law governing The Indiana Scheduled Prescription Electronic Collection and Tracking program ("INSPECT") (I.C. 35-48-7) grant practitioners civil and criminal immunity when they, in good faith, report possible drug seeking patients to law enforcement.  In order to receive such immunity, a report must be based on information found in a search of the INSPECT database.  Despite the civil and criminal immunity, practitioners are still bound by state and federal privacy laws, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"),  to keep protected health information private.

Overview

INSPECT is designed to serve as a tool to address the problem of prescription drug abuse and diversion in Indiana.  INSPECT allows law enforcement and health care professionals to access information which can assist in identifying drug seeking patients.  Practitioners who have a license to prescribe controlled substances in the United States may establish an account to access the INSPECT database.  The information retained in the INSPECT database is meant to assist the practitioner with identifying patients with a possible drug abuse problem when determining whether to prescribe controlled substances to a patient. 

The INSPECT database contains the following information:

• A list of individuals who have filled prescriptions for controlled substances in Indiana,
• Identification numbers for the recipients of controlled substances,
• The recipient's date of birth,
• The quantity of the controlled substance dispensed,
• The dispenser's DEA registration number, and
• Information as to whether the prescription was transmitted to the pharmacist orally or in writing. 

As of July 1, 2010, the INSPECT law now provides civil and criminal immunity to practitioners who, in good faith, use the information obtained during a search of the INSPECT database to report possible drug abusers to law enforcement (I.C. 35-48-7-11.1(n)).  The law states that practitioners who disclose information to a law enforcement agency are presumed to have acted in good faith.

Analysis

General Rule

Generally, HIPAA only allows a provider to release a patient's protected health information, without the patient's authorization, when such release is for the purposes of treatment, payment or health care operations.  A provider may also release protected health information with a patient's authorization or pursuant to an exception under HIPAA.  For the purposes of the INSPECT law, a provider must meet the requirements of one of the law enforcement exceptions under HIPAA before releasing any information found in the INSPECT database to law enforcement.

Law Enforcement Exception
 
While the Indiana INSPECT law provides civil and criminal immunity to practitioners who, in good faith, disclose information regarding suspected drug abusers to law enforcement, HIPAA prohibits such a disclosure, unless the disclosure is made to law enforcement under the following circumstances:

• To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer or a grand jury subpoena.
• To respond to an administrative request such as an administrative subpoena or investigative demand or other written request from law enforcement.
• To respond to a request for protected health information for purposes of identifying or locating a suspect, fugitive, material witness or missing person.
• To report a suspected perpetrator of a crime when the report is made by the victim who is a member of the covered entity's workforce.
• To identify or apprehend an individual who has admitted participation in a violent crime.
• To respond to a request for PHI about a victim of a crime and the victim agrees, including but not limited to reporting child abuse (victim does not need to agree), adult abuse, neglect or domestic violence.
• To report protected health information to law enforcement when required by law.
• To alert law enforcement to the death of an individual when there is a suspicion that the death resulted from criminal misconduct.
• To report protected health information that the provider in good faith believes to be evidence of a crime that occurred on the covered entity's premises. 

Conclusions

The information in the INSPECT database is protected health information under HIPAA.  The recent changes to the INSPECT law granting immunity to practitioners that report information to law enforcement do not override the privacy requirements set forth under HIPAA.  Despite the immunity provided under the INSPECT law, practitioners are still bound by the requirements of HIPAA and other state and federal privacy laws.  As such, practitioners will need to either have the patient's authorization or meet a HIPAA exception prior to releasing any INSPECT information to law enforcement.