HIPAA & Whistleblowing

Under the HIPAA whistleblower exception at 45 C.F.R. § 164.502(j), “good faith” means the healthcare worker holds a reasonable belief, grounded in fact, that the covered entity has engaged in unlawful conduct, violated professional standards, or endangered patient safety.

This standard protects workers from HIPAA liability when they disclose protected health information (PHI) to proper authorities, such as a health oversight agency or an attorney, based on that belief.

Importantly, it does not protect malicious or frivolous allegations made with knowledge of their falsity. This exception ensures that workers can report fraud and abuse without fear of violating patient privacy laws.

Under 45 CFR § 164.502(j)(1), a whistleblower may disclose protected health information (PHI) without violating HIPAA if the disclosure is made in good faith to specific parties.

– To a health oversight agency or public health authority authorized by law to investigate the conduct
– To an appropriate health care accreditation organization for reporting failure to meet professional standards or misconduct
– To an attorney retained by the whistleblower to determine their legal options regarding the conduct

HIPAA preemption sets a federal floor, not a ceiling, for privacy protections.

A state whistleblower law that provides broader protections, such as stronger anti-retaliation provisions or a wider scope of protected disclosures, will generally survive because it is “more stringent” and not contrary to HIPAA.

Conversely, a state law that conflicts with HIPAA by offering weaker protections would likely be preempted. However, the practical effect is often more nuanced, as preemption determinations are highly fact-specific and may require a case-by-case analysis.

The HIPAA whistleblower exception at 45 C.F.R. § 164.502(j) allows healthcare workers to disclose protected health information (PHI) to an attorney or health oversight agency in good faith to report fraud. This exception directly supports False Claims Act qui tam litigation by enabling whistleblowers to share the evidence needed to build a case.

– The exception removes HIPAA as a barrier to bringing qui tam suits, which has contributed to the rise of healthcare fraud cases
– Whistleblowers can disclose PHI without first reporting internally or obtaining patient consent
– The disclosure must be made in good faith and to a permitted recipient, such as an attorney or oversight agency

To ensure HIPAA compliance when disclosing protected health information (PHI) to report fraud, a whistleblower should follow these steps:

– Confirm good faith belief: Have a reasonable, fact-based belief that the covered entity engaged in unlawful conduct, violated standards, or endangered safety
– Disclose only to permitted recipients: Share PHI only with a health oversight agency, public health authority, accreditation organization, or an attorney retained for legal advice
– Limit disclosure: Disclose only the PHI necessary to support the report
– Document the disclosure: Keep a record of what was disclosed, to whom, and when
– Consult an attorney: Seek legal guidance before disclosing PHI to ensure compliance

No. Under the HIPAA whistleblower exception at 45 CFR § 164.502(j), a healthcare worker who discloses protected health information (PHI) in good faith to report fraud will not face civil monetary penalties.

The regulation explicitly states that a covered entity is not considered to have violated HIPAA when a workforce member makes such a good faith disclosure to an attorney, a health oversight agency, or a healthcare accreditation organization.

The individual must hold a reasonable belief that the covered entity has engaged in unlawful conduct or violated professional standards. However, this protection does not extend to disclosures made with malicious intent or knowing falsity.

No. The HIPAA whistleblower exception at 45 CFR § 164.502(j) does not explicitly require that a disclosure be limited to the “minimum necessary” protected health information. The regulation focuses instead on the whistleblower’s good faith belief and the recipient of the disclosure.

That said, the “minimum necessary” standard is a general requirement of the HIPAA Privacy Rule. While the whistleblower exception does not expressly impose it, best practice for whistleblowers is to disclose only the information needed to support the report.

Disclosing more than necessary could raise questions about whether the disclosure was made in good faith and may expose the whistleblower to other legal risks.