HIPAA Compliance for Child Protective Services (DCF)

The Health Insurance Portability and Accountability Act of 1996 is a federal law that requires health care providers to protect patient privacy. State agencies for child protective services, many of which go by the acronym DCF, or Department of Children and Families, have to comply with HIPAA in certain circumstances.

Significance

• According to HIPAA any health care provider who is considered a "covered entity" must keep health information private and secure. Since each state has its own department of child protective services, it may or may not need to comply with HIPAA. The U.S. Department of Health and Human Services can help agencies determine if they must comply.

Considerations

• In the case of child abuse or neglect, there are exceptions to HIPAA, of which child protection agencies should be aware. For instance, if the child is believed to be the victim of abuse, then information about that child's health can be shared in order to investigate the allegations.

Function

• Child protection workers, however, should be aware that the exceptions to HIPAA do not apply for the perpetrators of child abuse or to the child's parents or guardians.