By William Maruca

A Houston-area woman was arrested at her gynecologist’s office by Sheriff’s deputies because she presented a false ID and now may face deportation. The woman, Blanca Borrego, was reportedly visiting Northeast Women’s Healthcare for an annual check-up and to follow up on a painful abdominal cyst that had been identified a year earlier. After filling out paperwork and waiting two hours, she was called into an exam room and met by law enforcement officers, who led her out in handcuffs in front of her young daughters.

“We’re going to take her downtown, she presented a form of false identification,” Borrego’s daughter recalled the deputy saying. He said their mother’s bond would probably be around $20,000, and added, “She’s going to get deported.”

Ms. Borrego had reportedly remained in the U.S. for 12 years on an expired visa. It was her first visit to this clinic, although she had been treated previously by the same physician. However, one commentator suggests she may have been eligible for protection from deportation under current law:

In fact, Borrego would have qualified for President Obama’s Deferred Action for Parents of Americans and Lawful Permanent Residents (DAPA) administrative reform program, which was announced last year. For the estimated 4.1 million undocumented individuals like Borrego—who have been in the United States since January 1, 2001 and have a son or daughter who is a U.S. citizen or lawful permanent resident—DAPA allows work permit applications and protection from deportation.

When can a physician practice, clinic, hospital or other healthcare provider reveal protected health information to law enforcement? Section 164.512(j) of the HIPAA rule permits such disclosures to avert a serious threat to health or safety, and only in limited situations:

(j) A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure:

(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and

(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or

(ii) Is necessary for law enforcement authorities to identify or apprehend an individual:

(A) Because of a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim; or

(B) Where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody, as those terms are defined in section 164.501.

Covered entities may also disclose to law enforcement officials protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity. It is not clear whether at this time if Northeast will rely on that provision to justify their call to the police. There are no allegations of identity theft and in fact Ms. Borrego reportedly was covered by her husband’s health insurance policy.

Ironically, when asked about its policies regarding informing authorities about suspected undocumented aliens, the Memorial Hermann spokeswoman Alex Loessin replied “As you know, because of patient privacy, I am unable to provide comment.”

The HIPAA implications of this emerging story have yet to fully play out. Covered entities and their business associates should use caution before voluntarily disclosing PHI to law enforcement agencies, particularly when there is no indication of violent crime or serious threats to health or safety.