Which statement best describes a HIPAA administrative law enforcement request for PHI not tied to a suspect?

• A. It can be fulfilled without any justification.
• B. It requires a court order.
• C. It may be fulfilled only if the request is relevant, specific, and limited in scope, and deidentified data would not suffice.
• D. It may always be fulfilled in full once the law enforcement officer requests it.

Answer: (C)

Disclosures to law enforcement under HIPAA are permissible only with careful justification and tight limits. When a request for PHI is administrative and not tied to a specific suspect, the covered entity must evaluate it to ensure it is relevant to the investigation, specific about what is sought, and limited in scope. The minimum necessary standard applies—only the least amount of information needed should be disclosed. If information can be provided in de-identified form, that should be used because it protects privacy. Only if de-identified data would not meet the investigatory needs can identifiable PHI be disclosed, and the disclosure must still be limited to what is necessary. A court order or subpoena is one pathway in some cases, but not the sole requirement, and the patient data should not be disclosed in full without justification. This is why the correct approach is that the request may be fulfilled only if it’s relevant, specific, and limited in scope, and deidentified data would not suffice.