What can journalists do when prisons and jails cite HIPAA to withhold information about deaths in custody?

If you're a journalist who's been stonewalled while seeking public records about deaths in custody, you are not alone. We offer tips for requesting information and strengthening your story against HIPAA-related denials.

by Wanda Bertram, June 11, 2024

Prisons and jails often claim that the Health Information Portability and Accountability Act (HIPAA) privacy rule prevents them from sharing information about in-custody deaths with the press, or even with families of people who have died. Since these agencies have also been known to invoke HIPAA in denying information not remotely related to health,¹ one might assume that many of these denials have no clear legal basis. But because prison oversight is abysmally weak — and because most people impacted by prisons’ lack of transparency are too poor to fight back — not a lot of legal precedent exists around what prisons and jails must or must not share.

The good news is that despite the grey area around health privacy law, HIPAA obstacles don’t have to spell the end of an investigation into deaths behind bars. This briefing lays out the HIPAA-related challenges for journalists investigating deaths in custody, offers tips for overcoming those challenges, and suggests ways to strengthen your stories against information denials.

HIPAA and common questions about in-custody deaths

HIPAA is a federal law passed in 1996 to set legal standards around healthcare coverage, efficiency in sharing of healthcare information, and processes for preventing healthcare fraud and data theft. Its Title II “privacy rule” prohibits healthcare providers — implicitly including confinement facilities — from sharing their patients’ “protected health information” (or PHI) with anyone other than approved family members and sometimes healthcare authorities.

When information requests remotely involve issues related to health, prisons and jails tend to default to denying journalists access to information. But journalists have the power to push corrections agencies to be more transparent about in-custody deaths.

Here are some of the obstacles you might encounter when asking common questions about deaths — and tips for getting around them:

1. “Did someone die in this prison recently?”  
   While you may be denied even this most basic information, it’s worth pointing out that HIPAA applies only to someone’s personally identifiable health information, which generally does not include the fact that someone died. Furthermore, a jail or prison refusing to release this information upon request is a red flag, given that at least 15 prison systems proactively make this information public:

2. “What was the deceased person’s name?”  
   Many prison systems post the names of the deceased as a matter of policy (see table above). If a prison or jail refuses to provide names, you may want to point out to them that other prison systems have done so without running afoul of the law. If that doesn’t work, you should consider challenging the DOC’s policy. When Hawaii’s Department of Public Safety refused to release the names of people who died during COVID-19, the Honolulu Civil Beat sued the department and won, with a Hawaii Circuit Court ordering the Department to release the names of people who die in custody going forward.
3. “What was the cause of death?”  
   It’s common for officials to deny reporters information related to the cause of someone’s death, often citing HIPAA as the reason — and in many cases, this may be a legitimate claim. However, you’re wise to remember that several different documents are created when someone dies behind bars. There may be a death certificate, coroner’s report, medical examiner’s report, “death review” or incident reports, and/or an autopsy. While not every death triggers an autopsy, autopsies are public records in many states, so they are typically easier to obtain.

Journalists should also keep in mind that if a prison or jail refuses to release information and vaguely cites “health privacy law,” it’s worthwhile to clarify which law. Most often, the answer will be HIPAA, but some states have their own laws that go beyond HIPAA’s prohibitions to exclude additional information from public records disclosure.

Making the most of your public records request

Here are a few ways to maximize your chances of a fruitful records request and to fight back against stonewalling:

• Review the basics about public records laws concerning the criminal legal system in your state before you file. (We wrote a 50-state guide to filing public records requests to criminal legal agencies.)
• Call the public records official at the DOC or jail before you file to get an idea of what records exist and in what format. Ask them what kinds of records and reports the agency creates around deaths in custody, including any records of internal investigations of deaths.
• Find out what kind of reporting about healthcare is made between the correctional agency and other parties. If the jail or prison uses a private healthcare provider, what kinds of reports does the company have to make to the agency regularly? The prison/jail may also make reports to hospitals it partners with and to any state or local oversight bodies. Reports that aggregate data without personally identifiable information may be easier to release than records pertaining to individuals.
• If possible, clarify in your records request that you do not intend to seek personally identifiable health information and ask for the agency to redact any such information.
• Appeal denials to your Attorney General’s public records ombudsman, whose job it is to determine if denials of public records requests were legitimate. If you think a prison or jail is denying you information that is not necessarily protected by HIPAA, it’s worth at least telling the ombudsman what is going on. (You may also want to alert prison oversight officials in your state when you get an unreasonable denial.)

Tip: If your public records requests are denied or delayed, you can also try searching the jail or DOC’s website for the records you’re looking for.² Occasionally, correctional agencies store sensitive documents on their web server without strong security.

Privacy law obstacles can be the beginning, not the end, of a good story

Being stonewalled is frustrating, but if getting the information you want seems impossible, broadening or adjusting the focus of your story can allow you to hold the prison (or jail) system accountable even in the face of information denials. We suggest that you:

• Look for patterns of medical neglect rather than individual cases. There may already be public evidence of neglect in the prison or jail system you’re investigating. States and large counties often audit correctional facilities’ healthcare systems, and the auditor/comptroller, Inspector General, and Attorney General’s office may have information about prior medical issues in the facility. (For an example of a story that uses evidence from local audits, see Arizona Luminaria’s reporting on jail deaths in Tucson.) You can also search legal databases like PACER for the name of the facility you’re investigating, or the names of any healthcare companies contracting with the facility, to find evidence of prior healthcare issues, which could put the deaths you’re investigating into context.
• Connect with families. If you’re having trouble getting basic facts about in-custody deaths, chances are that families are, too. Ask the families of people who died in the facility about their experiences with the prison or jail after their loved ones’ deaths. Journalists have written powerful stories about correctional agencies stonewalling families who ask for information, or waiting hours or days to tell them about deaths or injuries.
  

  Conversely, it’s also possible that the jail or prison will release medical records to the family that they wouldn’t release to the media. Building strong relationships with impacted communities and working with them to pressure the facility to release records may help you overcome HIPAA-related obstacles.

• Talk to prison and jail oversight officials. Ask these officials if they have had trouble getting information about deaths and medical care in the facility. Again, a corrections agency that keeps journalists in the dark about deaths is probably creating similar obstacles for others. The Sacramento Bee, for example, has reported skillfully on the barriers facing Sacramento’s Inspector General.

Beyond the story: pushing for systemic change

Obstacles to transparency around prison conditions often go beyond a single story, revealing a larger problem with corrections agencies stonewalling journalists who are working in the public interest. News organizations, particularly in partnership with impacted communities, have the power to change that. In Massachusetts, for example, news organizations campaigned successfully for public records reform.

Remember: Journalists do critical work to bring deaths behind bars to light, but they’re far from the only ones fighting the lack of “sunlight” in jails and prisons. The more creative you can be with your investigations, the greater the chances that family members, oversight officials, and even corrections officers will come forward to strengthen your story — and, hopefully, help you build the case that in-custody deaths should not be obscured by health privacy law.

Did you find this briefing helpful? Have a story to share? Let us know through our contact page.