Point-of-Service Information Sharing Between Criminal Justice and Behavioral Health Partners: Addressing Common Misconceptions

Image of Seq map.png

Information sharing across behavioral health and criminal justice systems is critical to reducing the number of people with mental and substance use disorders in jails. At the point of service, the availability of information related to the person’s treatment history and condition can enhance safety, improve the individual’s health and support recovery outcomes. However, many jurisdictions face substantial challenges in developing information sharing agreements, cross-system coordination and technology to gather and share information from their systems. As stakeholders strive to work within the requirements of the Health Insurance Portability and Accountability Act (HIPAA) and other federal and state confidentiality laws, many misconceptions may complicate their efforts and pose unintended barriers.

At the 2018 Best Practices Implementation Academy convened by SAMHSA’s GAINS Center, John Petrila, vice president of adult policy at the Meadows Mental Health Policy Institute and a national expert on data sharing and privacy law, presented strategies to enable appropriate information sharing between healthcare and criminal justice agencies.

First, he presented two scenarios that highlight misconceptions related to HIPAA:

Test Your Knowledge


An officer responding to a person who might be suicidal calls the local Mental Health Center (MHC) and asks if the person is currently a patient at the Center. Can the center share that information under HIPAA?


Yes! HIPAA regulations, as interpreted by the U.S. Department of Health and Human Services, permit the center to provide the information to the officer in order “to prevent or lessen a serious and imminent threat to health or safety.” Should a MHP be present with the officer, this information may also be shared as the MHP is a covered entity (see below for more on “covered entities”). However, note that state law may prohibit such exchanges; if state law is more protective of privacy than HIPAA, then state law takes precedence.


Treatment staff from the jail call a local hospital to ask for the name of the medication taken by a person who was recently booked. Can the hospital provide this information under HIPAA?


Yes! HIPAA regulations permit the hospital to share this information with the jail if it is for one of the following five purposes:

  • Provide health care
  • Ensure health and safety of inmates and others
  • Protect transporting officer
  • Promote law enforcement on premises
  • Uphold safety and security of correctional facility

In fact, HIPAA is more permissive than many stakeholders realize regarding what information mental health agencies can provide to law enforcement. To help with identifying and locating a suspect, fugitive, missing person or material witness, a health provider may provide law enforcement with the following:

  • Name
  • Address
  • Date and place of birth
  • Social Security number
  • ABO blood type
  • Type of injury
  • Date and time of treatment
  • Date and time of death (if applicable)
  • Distinguishing physical characteristics

Again, if state laws are more restrictive, these limitations should be considered when deciding to share the above information. More guidance on this topic is provided on the U.S. Department of Health and Human Services website.

Tagged In:

Creating a framework for data sharing

Petrila suggested that rather than beginning efforts to share information by turning immediately to a specific situation (a common temptation for stakeholders starting to create information sharing arrangements), communities should first develop clear goals for information sharing and a framework to guide that effort. For example, instead of deciding whether or not a particular mental health clinician can tell a local law enforcement agency about a patient’s medicines in any given situation, first decide why information sharing is needed between the two entities in the first place.

Communities should seek to answer four important questions to guide their data-sharing efforts:

  1. Why do you want to share information?
  2. What type of information do you want to share?
  3. With whom do you want to share the information?
  4. Who decides if you will get to share it?

Once the framework for information sharing is established, it may be formalized into Business Associate Agreements (BAAs) or other types of agreements that create governance structures and rules for information sharing and use.

For additional information about Business Associate Agreements, consult the following resources: sample agreement provisions from the U.S. Department of Health & Human Services, or a sample agreement from the Camden Coalition of Healthcare Providers.

Why do you want to share information?

Partners need to be clear about why they want to share the information. Does the group want to collect individually identifiable information and use this information for point-of-service decision making by law enforcement or clinical staff? Does the group want to link people detained in the jail to existing case managers in the community? While this may seem like a simple process, many stakeholders fail to explore these questions. Furthermore, there may be restrictions on access by partners who are non-covered entities, so understanding the purpose of information sharing with non-covered entities is critical to establishing a legal and effective information-sharing system.

What type of information do you want to share?

The next step is to determine what type of information is needed to support point-of-service actions and decision-making.  Stakeholders should try to specify exactly what information is needed and for what purpose, as conversations between partners may founder when the request is vague or broad (for example, simply asking for “health information”).

With whom do you want to share the information?

Partners should clarify with whom the information will be shared. Sharing information with law enforcement, a hospital or a researcher each require different considerations and agreements. Petrila explained that it is important to remember that HIPAA was designed to help agencies share information—the “P” in HIPAA stands for “portability.” All entities covered by HIPAA can share information among themselves. It is when a covered entity wants to share with a non-covered entity that special agreements are needed.

What are considered covered entities?

This includes providers, such as:

  • Doctors
  • Clinics
  • Psychologists
  • Dentists
  • Chiropractors
  • Nursing homes
  • Pharmacies

...but only if any electronic transmissions of information are in connection with a transaction for which HHS has adopted a standard.*

*Fire departments may be considered covered entities if they bill for their services and transmit that information.

This includes:

  • Health insurance companies
  • Managed care organizations
  • Company health plans

Government programs that pay for health care, such as Medicare, Medicaid, and the military and veterans’ health care programs

This includes entities that process nonstandard health information they receive from another entity into a standard format (i.e., standard electronic format or data content), or vice versa

Who decides if you will get to share it?

People providing their personal information make the first decision regarding the sharing and use of identified protected health information. One strategy found effective in increasing information sharing is to have a standardized universal Release of Information form consented to by an individual that allows named agencies to access the provided information. Only one agency has to obtain the signed waiver, which then facilitates quick and useful information sharing with the other named entities.

To determine who can share information, stakeholders should also address questions about governance in their agreements in order to safeguard the information sharing effort and, where identifiers are used, ensure that privacy is protected. For example, the following questions may arise:

  • What if a party that was not part of the original agreement wishes to access information?
  • What if a party to the agreement wishes to use information for a purpose not specified in the original agreement?
  • What if a party wishes to withdraw from the agreement?

Stakeholders should think deeply about the governance structure and should address questions that may arise through their legal agreements.

As noted above, information sharing with non-covered entities will require an information sharing agreement. The type of agreement depends on the information and the circumstances in which the information will be shared. In the case of protected health information covered by HIPAA, agreements may include BAAs, Data Use Agreements (DAUs), contracts, or other forms of agreements. The type of agreement required also depends on the intended use. For example, whether a BAA is appropriate depends on the type of work the prospective business associate is providing the covered entity.

What is Considered a Business Associate

By law, the HIPAA Privacy Rule applies only to covered entities—health plans, health care clearinghouses and certain health care providers. However, most health care providers and health plans do not carry out all of their health care activities and functions by themselves. Instead, they often use the services of a variety of other persons or businesses.

 The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse and will help the covered entity comply with some of their duties under the Privacy Rule. Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions. The business associate should not obtain information for independent use or purposes, except as needed for the proper management and administration of the business associate.

Types of business associates may include the following:

  • Corrections
  • Court services
  • District court
  • Human services – outreach and housing
  • Law enforcement
  • Fire department (if they do not bill for services)

For more information on business associates, visit the U.S. Department of Health and Human Services webpage on Business Associates.

For more information on drafting BAAs, visit the U.S. Department of Health and Human Services webpage on Business Associate Contracts

Using the Sequential Intercept Model as part of the framework

The Sequential Intercept Model (SIM) shows the progression of how people move through the criminal justice system. As people come into contact with the various intercept points, information about the person is collected and often retained; it may be of interest to other parties making decisions about the person. As a result, the SIM can be used to shape conversations about information sharing. At each point along the model, the following questions can be considered: What types of information are collected and which might enhance the decisions made? Who provides the information? Who might object to sharing the information? Who may want it at a later stage? For what purposes might the information be used? The extent to which information follows a person through the justice system can be a determining factor in the continuity of care provided to people with mental and substance use disorders.

Related News

Press Release

County Leaders Call for Action on Housing Affordability, Mental Health

Intergovernmental Partnerships Key to Achieving Solutions

Press Release

Counties Recognize Mental Health Awareness Month, Plan Advocacy Across the U.S.

NACo again this year will mark Mental Health Awareness Month throughout the month of May with counties advocating for solutions that support the wellbeing of residents and address the nation’s mental health crisis.

Woman on bench

Congress introduces Second Chance Act reauthorization

On April 16, the Second Chance Reauthorization Act of 2024 was introduced in the U.S. House of Representatives with robust bipartisan support. NACo supports this legislation, which would reauthorize funding for Second Chance Act programs for five years.