HIPAA Handbooks

  • Privacy and security training for new and seasoned staff
  • 11 staff/setting focus areas
  • Education on protecting PHI
  • New HITECH Act changes
  • Discounts on bulk purchases



  • Role-based training using real-life case scenarios
  • Test-your-knowledge exercises with remediation
  • Post-course test to document staff participation


Other HIPAA Resources

  • Hot-topic audio conferences
  • Books on privacy and security
  • Newsletters
  • e-Newsletter
  • Videos



Hospital stands by HIPAA; won’t tell police man was in facility

Email This Post Print This Post

Police wanted to find a missing 81-year-old man. But HIPAA wouldn’t let them.

Officials at Salem (Ore.) Hospital wouldn’t confirm the man was a patient when police came originally looking, according to a March 8 Statesman Journal.

“It’s a cumbersome law,” Salem police Lt. Steve Birr said. “When I managed the missing persons caseload, one of the difficult things is that we have people with mental illnesses, and they could end up in a mental health facility and you would never know it and they would never tell you.”

According to the March 8 Journal article, neighbors reported Thomas Dill missing to police after they noticed his absence from their apartment complex. Police weren’t concerned about Dill’s mental health, but they worried that the 81-year-old, who is diabetic, could have experienced a medical emergency that lead to his disappearance.

When police called area hospitals to see whether Dill was a patient, Salem Hospital said they couldn’t answer the question because it was PHI.

Police learned Dill was a patient at Salem Hospital two days later thanks to a tip from an anonymous caller.

He’s since been transferred to an adult care facility.


  1. Mark Combs says:

    Shouldn’t the hospital have given the information to law enforcement? It seems reasonable to think they would have a justifiable “need to know”? If the individual didn’t want their family to know, I could see that complicating the issue.

  2. Greg Young says:

    The information could have been released. HIPAA specifically allows for the release of such information for missing persons in an emergency. We here at Mammoth Hospital have a specific policy regarding the release of information in an emergency. We do required a law enforcement officer to fill out a very simple half page form stating the reason for the request, select which of the five allowed catagories applies (missing persons is one of them), their name, department name and the departments case number (likely always a report of some sort if law enforcement is knocking on your door for something as immediate as thie).

    Hope this helps clarify.
    Greg Young, CHP
    Mammoth Hospital

Leave a Reply