What can journalists do when prisons and jails cite HIPAA to withhold information about deaths in custody?

If you're a journalist who's been stonewalled while seeking public records about deaths in custody, you are not alone. We offer tips for requesting information and strengthening your story against HIPAA-related denials.

by Wanda Bertram, June 11, 2024

Prisons and jails often claim that the Health Information Portability and Accountability Act (HIPAA) privacy rule prevents them from sharing information about in-custody deaths with the press, or even with families of people who have died. Since these agencies have also been known to invoke HIPAA in denying information not remotely related to health,1 one might assume that many of these denials have no clear legal basis. But because prison oversight is abysmally weak — and because most people impacted by prisons’ lack of transparency are too poor to fight back — not a lot of legal precedent exists around what prisons and jails must or must not share.

The good news is that despite the grey area around health privacy law, HIPAA obstacles don’t have to spell the end of an investigation into deaths behind bars. This briefing lays out the HIPAA-related challenges for journalists investigating deaths in custody, offers tips for overcoming those challenges, and suggests ways to strengthen your stories against information denials.


HIPAA and common questions about in-custody deaths

HIPAA is a federal law passed in 1996 to set legal standards around healthcare coverage, efficiency in sharing of healthcare information, and processes for preventing healthcare fraud and data theft. Its Title II “privacy rule” prohibits healthcare providers — implicitly including confinement facilities — from sharing their patients’ “protected health information” (or PHI) with anyone other than approved family members and sometimes healthcare authorities.

When information requests remotely involve issues related to health, prisons and jails tend to default to denying journalists access to information. But journalists have the power to push corrections agencies to be more transparent about in-custody deaths.

Here are some of the obstacles you might encounter when asking common questions about deaths — and tips for getting around them:

  1. “Did someone die in this prison recently?”  
    While you may be denied even this most basic information, it’s worth pointing out that HIPAA applies only to someone’s personally identifiable health information, which generally does not include the fact that someone died. Furthermore, a jail or prison refusing to release this information upon request is a red flag, given that at least 15 prison systems proactively make this information public:

How different states handle public disclosure of in-custody deaths

We examined state departments of corrections’ websites (and when appropriate, the websites of other agencies such as the Attorney General’s office) to determine their standard practices around reporting deaths in custody to the public.
State Notifies public in a proactive and timely way? Publishes names of deceased individuals? Maintains a public list of deaths in prison? Link to public-facing death information Notes
Alabama No No No Quarterly reports The Alabama DOC publishes quarterly reports of deaths, but data is aggregated, not by individual.
Alaska Yes Yes No Press releases
Arizona Yes Yes No Press releases
Arkansas No Yes No Press releases Press releases only appear to list homicides, not other deaths.
California No Yes No Press releases Press releases only appear to list homicides and deaths of people on death row.
Colorado No No No
Connecticut No No No
Delaware Yes Yes No Press releases
Florida No Yes Yes Dashboard Florida DOC only appears to update its dashboard every few months.
Georgia No No No
Hawaii Yes Yes Yes Dashboard
Idaho No No No
Illinois No No Yes Dashboard
Indiana No No No Data workbook The Indiana Criminal Justice Institute maintains a page of aggregated data about deaths in custody, but does not make proactive announcements.
Iowa Yes Yes Yes Press releases
Kansas No No No
Kentucky No No No
Louisiana No No No The nonprofit Incarceration Transparency Project has helped fill the data gap through public records requests.
Maine No No No
Maryland No No No
Massachusetts No No No
Michigan No No No The Michigan DOC published notices about incarcerated people who died of COVID-19 in 2020, but has not continued any efforts to report deaths.
Minnesota No No No
Mississippi No No No
Missouri No No No
Montana Yes Yes Yes List of deaths
Nebraska Yes Yes No Press releases
Nevada Yes Yes Yes Dashboard
New Hampshire No No No Publishes press releases — including names — about some deaths, but irregularly and rarely.
New Jersey No No No
New Mexico No No No
New York No No No The Correctional Association of New York gathers and posts death data, though on a delay.
North Carolina No No No Publishes press releases — including names — about some deaths, but irregularly and rarely.
North Dakota No No No
Ohio No No No
Oklahoma No No No
Oregon Yes Yes No Press releases
Pennsylvania Yes Yes No Press releases
Rhode Island No No No
South Carolina No No No The nonprofit Incarceration Transparency Project has helped fill the data gap through public records requests.
South Dakota Yes Yes No Press releases
Tennessee No No No
Texas Yes Yes Yes Dashboard Reports deaths via the state Attorney General
Utah Yes Yes No List of deaths Utah DOC appears to archive death notices at the beginning of each new calendar year, but those looking for information on deaths in previous years can use Archive.org; e.g. deaths in 2023 are here.
Vermont Yes Yes No Press releases
Virginia No No No
Washington No No No
West Virginia No No No
Wisconsin No No No
Wyoming Yes Yes No Press releases
  1. “What was the deceased person’s name?”  
    Many prison systems post the names of the deceased as a matter of policy (see table above). If a prison or jail refuses to provide names, you may want to point out to them that other prison systems have done so without running afoul of the law. If that doesn’t work, you should consider challenging the DOC’s policy. When Hawaii’s Department of Public Safety refused to release the names of people who died during COVID-19, the Honolulu Civil Beat sued the department and won, with a Hawaii Circuit Court ordering the Department to release the names of people who die in custody going forward.
  2. “What was the cause of death?”  
    It’s common for officials to deny reporters information related to the cause of someone’s death, often citing HIPAA as the reason — and in many cases, this may be a legitimate claim. However, you’re wise to remember that several different documents are created when someone dies behind bars. There may be a death certificate, coroner’s report, medical examiner’s report, “death review” or incident reports, and/or an autopsy. While not every death triggers an autopsy, autopsies are public records in many states, so they are typically easier to obtain.

Journalists should also keep in mind that if a prison or jail refuses to release information and vaguely cites “health privacy law,” it’s worthwhile to clarify which law. Most often, the answer will be HIPAA, but some states have their own laws that go beyond HIPAA’s prohibitions to exclude additional information from public records disclosure.


Making the most of your public records request

Here are a few ways to maximize your chances of a fruitful records request and to fight back against stonewalling:

  • Review the basics about public records laws concerning the criminal legal system in your state before you file. (We wrote a 50-state guide to filing public records requests to criminal legal agencies.)
  • Call the public records official at the DOC or jail before you file to get an idea of what records exist and in what format. Ask them what kinds of records and reports the agency creates around deaths in custody, including any records of internal investigations of deaths.
  • Find out what kind of reporting about healthcare is made between the correctional agency and other parties. If the jail or prison uses a private healthcare provider, what kinds of reports does the company have to make to the agency regularly? The prison/jail may also make reports to hospitals it partners with and to any state or local oversight bodies. Reports that aggregate data without personally identifiable information may be easier to release than records pertaining to individuals.
  • If possible, clarify in your records request that you do not intend to seek personally identifiable health information and ask for the agency to redact any such information.
  • Appeal denials to your Attorney General’s public records ombudsman, whose job it is to determine if denials of public records requests were legitimate. If you think a prison or jail is denying you information that is not necessarily protected by HIPAA, it’s worth at least telling the ombudsman what is going on. (You may also want to alert prison oversight officials in your state when you get an unreasonable denial.)

Tip: If your public records requests are denied or delayed, you can also try searching the jail or DOC’s website for the records you’re looking for.2 Occasionally, correctional agencies store sensitive documents on their web server without strong security.


Privacy law obstacles can be the beginning, not the end, of a good story

Being stonewalled is frustrating, but if getting the information you want seems impossible, broadening or adjusting the focus of your story can allow you to hold the prison (or jail) system accountable even in the face of information denials. We suggest that you:

  • Look for patterns of medical neglect rather than individual cases. There may already be public evidence of neglect in the prison or jail system you’re investigating. States and large counties often audit correctional facilities’ healthcare systems, and the auditor/comptroller, Inspector General, and Attorney General’s office may have information about prior medical issues in the facility. (For an example of a story that uses evidence from local audits, see Arizona Luminaria’s reporting on jail deaths in Tucson.) You can also search legal databases like PACER for the name of the facility you’re investigating, or the names of any healthcare companies contracting with the facility, to find evidence of prior healthcare issues, which could put the deaths you’re investigating into context.
  • Connect with families. If you’re having trouble getting basic facts about in-custody deaths, chances are that families are, too. Ask the families of people who died in the facility about their experiences with the prison or jail after their loved ones’ deaths. Journalists have written powerful stories about correctional agencies stonewalling families who ask for information, or waiting hours or days to tell them about deaths or injuries.

    Conversely, it’s also possible that the jail or prison will release medical records to the family that they wouldn’t release to the media. Building strong relationships with impacted communities and working with them to pressure the facility to release records may help you overcome HIPAA-related obstacles.

  • Talk to prison and jail oversight officials. Ask these officials if they have had trouble getting information about deaths and medical care in the facility. Again, a corrections agency that keeps journalists in the dark about deaths is probably creating similar obstacles for others. The Sacramento Bee, for example, has reported skillfully on the barriers facing Sacramento’s Inspector General.


Beyond the story: pushing for systemic change

Obstacles to transparency around prison conditions often go beyond a single story, revealing a larger problem with corrections agencies stonewalling journalists who are working in the public interest. News organizations, particularly in partnership with impacted communities, have the power to change that. In Massachusetts, for example, news organizations campaigned successfully for public records reform.

Remember: Journalists do critical work to bring deaths behind bars to light, but they’re far from the only ones fighting the lack of “sunlight” in jails and prisons. The more creative you can be with your investigations, the greater the chances that family members, oversight officials, and even corrections officers will come forward to strengthen your story — and, hopefully, help you build the case that in-custody deaths should not be obscured by health privacy law.


Did you find this briefing helpful? Have a story to share? Let us know through our contact page.



  1. For example, the Kansas Department of Corrections cited health privacy law when denying a KCUR reporter’s request for an internal email about a disciplinary writeup.  ↩

  2. A general search on the agency website for PDF files can be fruitful. To Google for PDFs on a specific website — for example, the Louisiana Department of Corrections — use the following syntax: “site:doc.louisiana.gov filetype:pdf.”)  ↩

Wanda Bertram is the Communications Strategist at the Prison Policy Initiative. (Other articles | Full bio | Contact)

2 responses:

  1. Cynthia Farnham-Stella says:

    Thank you for this article. I lost my daughter Heather in December 2016 to an incustody jail death. I have been fighting for justice for all families.

    I have been working to make all of this transparent. It is a long road and certainly worth fighting for.

    Incustody deaths also happen in the county jails, transport to hospital and hospitals.

    Justice for all families dealing with this

    1. Hey Cynthia,

      I’m so sorry to hear about your daughter, and wishing you best of luck in getting transparency around what happened. Glad the article was some help.

      – Wanda, Prison Policy Initiative

Stay Informed

Get the latest updates:

Share on 𝕏 Donate


Not near you?
Invite us to your city, college or organization.