ATTACHMENT A TO FORMAL ATTORNEY GENERAL OPINION HIPAA PRIVACY MATRIX DISCLOSURES TO LAW ENFORCEMENT
Reason for HIPAA Cite Required or Permitted In Response or Voluntarily
Disclosure
Required by law 45 C.F.R. Required by Colorado law, C.R.S. Can volunteer under HIPAA
164.512(a) and 12-36-135, to must report under Colorado
164.512(f)(1)(i) report at once to law enforcement, any injury a law.
provider believes to be the result of a
criminal act.
Disclosure limited to information on observed
injury.
45 C.F.R. Required by court order or warrant; subpoena or
164.512(f)(1)(ii) summons issued by a
judicial officer; grand jury
subpoena; administrative and civil subpoena; or
civil or investigative demands authorized by law if
the information sought is relevant, specific, limited
and material to a
law enforcement inquiry and deidentified
information could not reasonably be
used.
To identify or 45 C.F.R. Permitted to locate a In response to a
locate a suspect, 164.512(f)(2) suspect, fugitive, material witness or law enforcement
fugitive, material missing person but may only disclose name; address; date official's request
witness or missing and place of birth; social security number; ABO blood type to locate or identify a
person and rh factor; type of injury; date and time of treatment; date suspect, fugitive,
and time of death; and description of distinguishing physical material witness or
characteristics including height, weight, gender, race, hair missing person.
and eye color, presence or absence of facial hair, scars and
tattoos. No DNA information may be disclosed.
Information about a 45 C.F.R. Permitted to disclose information about a In response to law
victim or suspected 164.512(f)(3) person enforcement official's request
victim of a crime who is or is suspected to be a
victim of a
crime if:
Individual consents; or
Consent not possible because of incapacity or
emergency circumstance and law enforcement
represents that information is needed to determine
whether a
violation of law has occurred by a
person
other than the victim and the information is not
intended to be used against the victim, immediate
law enforcement activity depends on the disclosure
that would be materially and adversely affected by
waiting for the individual's consent, and in the
exercise of the covered entity's professional
judgment the disclosure is in the best interest of the
victim.
Disclosures about a 45 C.F.R. Permitted under HIPAA if the covered entity has a Can volunteer under HIPAA
Decedent where 164.512(f)(4) suspicion that the death may have resulted from Must report under Colorado
provider suspects criminal conduct. law
criminal activity
caused death Colorado law requires the reporting of injuries
believed to be the result of a
criminal act.
Crime on the 45 C.F.R. Permitted if the covered entity believes Can volunteer under HIPAA
premises of a 164.512(f)(5) in good faith the protected health
covered entity information constitutes evidence of
criminal conduct occurring on the premises
of the covered entity.
In a medical emergency, 45 C.F.R. Permitted if emergency is not on the covered entity's Can alert law enforcement
about the commission 164.512(f)(6) premises to alert law enforcement to the commission and and volunteer
and nature of a crime, nature of a crime; the location of the crime or the victim of
the location of the crime; and the identity, description and location of the
crime, crime victims, perpetrator of the crime.
and the perpetrator of
the crime.
To report child abuse 45 C.F.R. Required to report under Colorado law, C.R.S. 19-3-304, Can volunteer under HIPAA
and neglect 164.512(b)(1)(ii) to county social services or local law enforcement agency. Must report under Colorado
Permitted by HIPAA to a government authority authorized law
by law to receive reports of child abuse or neglect.
To report abuse, 45 C.F.R. Colorado law, C.R.S. 12-36-135, requires the Can volunteer under HIPAA
neglect and domestic 164.512(c) reporting of injuries the provider believes resulted Under Colorado law, must
violence (other than from a report injuries from criminal
child abuse) criminal act including domestic violence.
Free access — add to your briefcase to read the full text and ask questions with AI
ATTACHMENT A TO FORMAL ATTORNEY GENERAL OPINION HIPAA PRIVACY MATRIX DISCLOSURES TO LAW ENFORCEMENT
Reason for HIPAA Cite Required or Permitted In Response or Voluntarily
Disclosure
Required by law 45 C.F.R. Required by Colorado law, C.R.S. Can volunteer under HIPAA
164.512(a) and 12-36-135, to must report under Colorado
164.512(f)(1)(i) report at once to law enforcement, any injury a law.
provider believes to be the result of a
criminal act.
Disclosure limited to information on observed
injury.
45 C.F.R. Required by court order or warrant; subpoena or
164.512(f)(1)(ii) summons issued by a
judicial officer; grand jury
subpoena; administrative and civil subpoena; or
civil or investigative demands authorized by law if
the information sought is relevant, specific, limited
and material to a
law enforcement inquiry and deidentified
information could not reasonably be
used.
To identify or 45 C.F.R. Permitted to locate a In response to a
locate a suspect, 164.512(f)(2) suspect, fugitive, material witness or law enforcement
fugitive, material missing person but may only disclose name; address; date official's request
witness or missing and place of birth; social security number; ABO blood type to locate or identify a
person and rh factor; type of injury; date and time of treatment; date suspect, fugitive,
and time of death; and description of distinguishing physical material witness or
characteristics including height, weight, gender, race, hair missing person.
and eye color, presence or absence of facial hair, scars and
tattoos. No DNA information may be disclosed.
Information about a 45 C.F.R. Permitted to disclose information about a In response to law
victim or suspected 164.512(f)(3) person enforcement official's request
victim of a crime who is or is suspected to be a
victim of a
crime if:
Individual consents; or
Consent not possible because of incapacity or
emergency circumstance and law enforcement
represents that information is needed to determine
whether a
violation of law has occurred by a
person
other than the victim and the information is not
intended to be used against the victim, immediate
law enforcement activity depends on the disclosure
that would be materially and adversely affected by
waiting for the individual's consent, and in the
exercise of the covered entity's professional
judgment the disclosure is in the best interest of the
victim.
Disclosures about a 45 C.F.R. Permitted under HIPAA if the covered entity has a Can volunteer under HIPAA
Decedent where 164.512(f)(4) suspicion that the death may have resulted from Must report under Colorado
provider suspects criminal conduct. law
criminal activity
caused death Colorado law requires the reporting of injuries
believed to be the result of a
criminal act.
Crime on the 45 C.F.R. Permitted if the covered entity believes Can volunteer under HIPAA
premises of a 164.512(f)(5) in good faith the protected health
covered entity information constitutes evidence of
criminal conduct occurring on the premises
of the covered entity.
In a medical emergency, 45 C.F.R. Permitted if emergency is not on the covered entity's Can alert law enforcement
about the commission 164.512(f)(6) premises to alert law enforcement to the commission and and volunteer
and nature of a crime, nature of a crime; the location of the crime or the victim of
the location of the crime; and the identity, description and location of the
crime, crime victims, perpetrator of the crime.
and the perpetrator of
the crime.
To report child abuse 45 C.F.R. Required to report under Colorado law, C.R.S. 19-3-304, Can volunteer under HIPAA
and neglect 164.512(b)(1)(ii) to county social services or local law enforcement agency. Must report under Colorado
Permitted by HIPAA to a government authority authorized law
by law to receive reports of child abuse or neglect.
To report abuse, 45 C.F.R. Colorado law, C.R.S. 12-36-135, requires the Can volunteer under HIPAA
neglect and domestic 164.512(c) reporting of injuries the provider believes resulted Under Colorado law, must
violence (other than from a report injuries from criminal
child abuse) criminal act including domestic violence. conduct including domestic
violence
For disclosures beyond the observed injury,
HIPAA permits disclosures to report a
person the
covered entity reasonably believes to be a
victim of
abuse, neglect, or domestic violence to a
government authority authorized by law to receive
report of abuse if:
1. The individual consents, or
2. The disclosure is expressly authorized by
statute and the CE believes the disclosure is
necessary to prevent serious harm to the
individual or other potential victims, or
3. The disclosure is expressly authorized by
statute and the individual cannot agree because
of incapacity and law enforcement official
authorized to receive a
report represents that
disclosure will not be used against the
individual, immediate law enforcement activity
depends upon the disclosure and would be
materially and adversely affected by waiting for
the individual's consent.
Must inform the individual of these disclosures.
To avert a 45 C.F.R. Permitted by HIPAA if the covered entity has a Can volunteer under HIPAA
serious threat 164.512(j) good faith belief the disclosure is necessary to Colorado may impose a
to health or safety. prevent or lessen a duty to warn
serious and imminent threat to a
person or public health or safety, and
Is to a
person reasonably able to prevent or lessen
the threat, including the target of the threat; or
Is necessary for law enforcement to identify or
apprehend an individual: because of a
statement
by an individual admitting participation in a
violent crime that the CE reasonably believes may
have caused serious physical harm to the victim,
or where it appears from all the circumstances
that the individual has escaped from a
correctional institution or from lawful custody.
Disclosures limited to the statement by the
individual and the limited information in section
164.512(f)(2)(i).
Disclosure not permitted if statement is learned in
the course of treatment to affect the propensity to
commit criminal conduct, or through a
request to
initiate or be referred to treatment.
Colorado courts may impose a
duty to warn third
persons under Tarasoff. See Ryder v. Mitchell,
54 P.3d 885 (Colo. 2002).
Patient Authorization 45 C.F.R. Disclosure is permitted pursuant to the individual's HIPAA permits, Colorado
164.508 HIPAA-compliant authorization form, except for certain theft of medical records
uses of psychotherapy notes. statute requires patient
consent