Independent New Hampshire Journalism · Northfield, NH

When Can Police Get Your Medical Records? More Often Than You Think

Federal privacy rules cut six separate doors into your medical file for law enforcement, and a judge stands in front of exactly one of them. Here is every door, who else has a key, and why New Hampshire is pulling in two directions at once.

Most people believe HIPAA is a wall. They picture a law that stops a police officer at the front desk and sends him away without a warrant. That belief is wrong, and it is wrong in a specific, documented way that anyone can check in an afternoon. The federal privacy rule is a permission structure. It tells your hospital, your pharmacy, and your insurer when they are allowed to hand your information to the government. Most of the time, the answer is yes.

I read the operative regulation in full this week, along with two New Hampshire criminal statutes, the state’s consumer privacy law, a 2025 New Hampshire Supreme Court opinion out of Belknap County, and a United States Supreme Court decision from 2001 that draws the only hard constitutional line in this whole area. What follows is the map.

Twelve exits, and only one of them is about crime

The governing provision is 45 CFR 164.512, titled uses and disclosures for which an authorization or opportunity to agree or object is not required. The title is the whole story. Everything listed in that section can happen without asking you and without telling you.

The section runs from paragraph (a) through paragraph (l). Twelve standards. Disclosures required by law. Public health reporting. Reports about victims of abuse, neglect, or domestic violence. Health oversight audits and investigations. Judicial and administrative proceedings. Law enforcement. Coroners and funeral directors. Organ donation. Research. Averting a serious threat. Specialized government functions. Workers’ compensation.

Law enforcement is paragraph (f). It is one exit out of twelve, which means that counting only the police doors understates the traffic. But paragraph (f) is where the criminal exposure lives, so start there.

What your doctor must tell the police, whether you like it or not

Before any of the federal permissions matter, New Hampshire imposes a duty. RSA 631:6 makes it a misdemeanor for anyone who knowingly treats or assists a person for a gunshot wound, or for any injury the treater believes was caused by a criminal act, to fail to immediately notify law enforcement of all the information they possess about the injury.

Read that again. Not the injury. All the information they possess concerning the injury.

There is one exception, and it is narrow. An adult who has been the victim of a sexual assault offense or abuse as defined in RSA 173-B:1 can object to the release. That objection evaporates the moment the same patient is also being treated for a gunshot wound or other serious bodily injury.

The federal rule accommodates this at 164.512(f)(1)(i), which permits disclosure as required by law, naming laws that require the reporting of certain types of wounds or other physical injuries. New Hampshire’s mandate and the federal permission fit together without friction. So do the state’s child abuse and vulnerable adult reporting duties, which route through paragraphs (b) and (c) instead.

The six doors marked law enforcement

Paragraph (f) contains six numbered permissions. Here they are, in order, stripped of the legalese.

Only one line in that table has a judge in it.

Door (f)(1)(ii)(C) deserves particular attention, because it is the one most people have never heard of. An administrative subpoena is a document the investigating agency writes for itself. No judge reviews it. The regulation attaches three conditions: the information sought must be relevant and material to a legitimate law enforcement inquiry, the request must be specific and limited in scope to the extent reasonably practicable, and de-identified information could not reasonably be used. Every one of those judgments is made by the same agency that wants the file.

Door (f)(2) is the one that should make people sit up. To help identify or locate a suspect, fugitive, material witness, or missing person, a provider may hand an officer your name and address, date and place of birth, Social Security number, ABO blood type and Rh factor, type of injury, date and time of treatment, date and time of death, and a description of your distinguishing physical characteristics down to scars and tattoos. No paperwork of any kind is required. The regulation does draw a line: DNA and DNA analysis, dental records, and typing or analysis of body fluids or tissue stay out of that particular handover.

The subpoena your divorce lawyer cannot use

Set paragraph (f) next to paragraph (e), which governs subpoenas in judicial and administrative proceedings, and a strange asymmetry appears.

Under (e), a lawyer who serves a subpoena on your doctor without a court order cannot simply be handed your file. The provider must first receive satisfactory assurance, documented in writing, either that the requesting party made a good faith attempt to notify you and your window to object has closed, or that the party has sought a qualified protective order limiting how the records are used and requiring their return or destruction at the end of the case.

Under (f)(1)(ii)(C), a law enforcement agency’s self-issued administrative subpoena carries none of that. No notice to you. No protective order. No opportunity to object, because you will not know it happened.

The opposing party in your custody fight faces a higher procedural bar than a police agency investigating you. That is not an accident of drafting; it is the structure of the rule.

The rule also tilts the scales on the way out. Paragraph (j) lets a provider disclose to head off a serious and imminent threat, or to help police identify someone who has admitted participating in a violent crime. Paragraph (j)(4) then supplies a presumption of good faith whenever the provider acted on actual knowledge or on a credible representation by someone with apparent knowledge or authority. Disclosure gets the benefit of the doubt. Silence does not.

The pharmacy counter is not the same as the state database

Prescription history is a diary. It says what you have, what you had, what you were afraid you had, and roughly when.

In December 2023, Senator Ron Wyden and Representatives Pramila Jayapal and Sara Jacobs wrote to the Department of Health and Human Services reporting the results of an inquiry into the country’s largest pharmacy chains. All eight the lawmakers examined said they would turn over prescription records on what the letter called a “mere subpoena” rather than requiring a warrant. Three of them, according to the lawmakers, allow store staff to process law enforcement demands with no legal review at the corporate level. The lawmakers asked HHS twice that year to require a warrant. HHS did not.

Now compare the state’s own drug database. New Hampshire’s Controlled Drug Prescription Health and Safety Program, built under RSA 318-B:31 through 318-B:38 and administered through the Board of Pharmacy, does not give police a login. Under the program’s governing law and rules, a law enforcement official seeking program data needs a court order based on probable cause or a search warrant. RSA 318-B:12-a separately limits how program data may be used and redisclosed.

The two vaults that hold

Two categories are much harder to reach, and both are worth knowing by name.

Federal substance use disorder records under 42 CFR Part 2, backed by 42 U.S.C. 290dd-2, cannot be used against a patient in a criminal investigation or proceeding without either the patient’s written consent or a court order meeting specific requirements. That is a real standard, and it is stricter than anything in 164.512. The Part 2 rules were substantially harmonized with HIPAA in a 2024 rulemaking, with notice-of-privacy-practices compliance due February 16, 2026.

The second is narrower and easy to miss. Paragraph (j)(2) says that when a provider learns of a patient’s admission to a violent crime in the course of treatment aimed at the propensity to commit that conduct, or in counseling or therapy, or through the patient’s request to be referred for that treatment, the disclosure permission does not apply. The regulators decided the couch stays sealed even when the waiting room is not.

The doors that have nothing to do with solving a crime

Paragraph (k), specialized government functions, is where the rule stops being about criminal investigation and starts being about government access generally. Four provisions matter here.

Hold (k)(6) in mind. It is the hinge of the biggest health privacy fight of the last two years.

The constitutional floor, and exactly where it ends

There is one place the Constitution intervenes directly, and its limits are as instructive as its holding.

In Ferguson v. City of Charleston, 532 U.S. 67 (2001), a public hospital run by the Medical University of South Carolina built a program with police and prosecutors to drug-test pregnant patients and turn positive results over for arrest. The Supreme Court held that a state hospital’s performance of a diagnostic test to obtain evidence of a patient’s criminal conduct for law enforcement purposes “is an unreasonable search if the patient has not consented” to the procedure. The special needs doctrine did not save it, because the program’s purpose was indistinguishable from ordinary crime control.

Now the limits. The Court reached that result because the hospital was a state hospital, which made its staff government actors bound by the Fourth Amendment. A private hospital is not a government actor. The Fourth Amendment does not directly govern what a private provider hands over voluntarily. Justice Scalia, dissenting, pointed out that South Carolina recognized no physician-patient privilege at all, which meant nothing in state law filled the gap either.

Ferguson also left the reporting statutes untouched. Both the majority and Justice Kennedy’s concurrence said so directly. A law like RSA 631:6 is not what the case was about.

And the older precedent still stands. In Whalen v. Roe, 429 U.S. 589 (1977), the Court upheld a state prescription database that collected the names of patients receiving frequently abused drugs. Government collection of medical data, standing alone, is not a constitutional violation. That is the ground New Hampshire’s own drug monitoring program is built on.

The year the doors got wider

In April 2024, HHS finalized a rule that would have barred using protected health information to investigate or impose liability on anyone for seeking, obtaining, providing, or facilitating lawful reproductive health care, and would have required an attestation from anyone requesting records for oversight, judicial, law enforcement, or coroner purposes.

On June 18, 2025, Judge Matthew Kacsmaryk of the Northern District of Texas vacated it, in Purl v. U.S. Department of Health and Human Services, No. 2:24-cv-00228-Z. The vacatur reached the entire country. According to the several law firm analyses published in the weeks that followed, the opinion concluded that the agency lacked clear delegated authority to fashion special protections for information produced by “politically favored medical procedures.” One piece survived: the notice-of-privacy-practices changes tied to substance use disorder records.

Proposed intervenors moved to drop their appeal on September 4, 2025, telling the Fifth Circuit that HHS had chosen not to appeal. The court dismissed on September 10, 2025. The rule is dead.

Here is the part that should bother anyone who has to comply with this stuff. More than a year later, the Code of Federal Regulations still carries the wreckage. The current text of 164.512, up to date as of July 23, 2026, still opens by cross-referencing the reproductive health provisions at 164.502(a)(5)(iii) and 164.509, and its amendment history still ends with the April 26, 2024 rulemaking. HHS’s own fact sheet on the rule still describes the prohibition, the presumption, and the attestation requirement in the present tense, under a single note at the top saying the Department will determine next steps after a thorough review of the court’s decision. That note has been sitting there since July 1, 2025.

A compliance officer reading the government’s own rulebook today would find requirements a federal court erased and the government declined to defend.

Medicaid becomes an enforcement database

In June 2025, the Associated Press reported that the Centers for Medicare & Medicaid Services had directed the transfer of Medicaid enrollee data, including from California, Illinois, Washington, and the District of Columbia, to the Department of Homeland Security. In July 2025, CMS and Immigration and Customs Enforcement signed an agreement giving ICE access to a Medicaid database containing addresses and citizenship status.

Twenty-two states sued in California v. HHS, No. 3:25-cv-05536, in the Northern District of California. Judge Vince Chhabria granted a preliminary injunction on August 12, 2025. A December 2025 order permitted limited biographical data from the plaintiff states while keeping sensitive health records out. In March 2026, Stateline reported that plaintiff states allege data moved anyway.

New Hampshire never joined that lawsuit. Attorney General John Formella’s office did not sign on. The orders in that case protect the plaintiff states. They do not reach a Granite Stater on Medicaid, because New Hampshire is not a party.

Meanwhile, the direction of travel in other statehouses is one-way. An April 2026 analysis from the Center for Health Law and Policy Innovation catalogued state bills pushing the other direction, including a Mississippi measure requiring state entities to cooperate with federal immigration enforcement and share information on request, and an Indiana bill requiring hospitals to report each Medicaid patient and the form of identification used.

Recall paragraph (k)(6). The federal privacy rule already contains a standing permission for a government health plan to pass enrollment data to another agency administering public benefits, whenever a statute or regulation authorizes it. The architecture for this was in the rulebook the entire time.

The side door nobody voted on

All of the above concerns the medical record. The billing record is a different animal, and it is barely guarded.

On July 9, 2025, 404 Media reported, based on internal ICE material it reviewed, that ICE’s Enforcement and Removal Operations unit had gained access to ISO ClaimSearch, a commercial database holding details on more than 1.8 billion insurance claims and 58 million medical bills, along with names, addresses, telephone and tax identification numbers, and license plates. The database was built to catch insurance fraud and recover stolen vehicles. Reporter Joseph Cox wrote that it was being “repurposed as a deportation tool.”

Verisk, which operates ClaimSearch, denied to 404 Media that ICE or DHS is a client, and a company spokesperson stated that “ClaimSearch does not track immigration or citizenship status.” Access is administered through the National Insurance Crime Bureau, a nonprofit backed by more than 1,200 insurance companies, which did not directly answer whether ICE has access. The story was picked up by Reason, Marketplace, and the trade press, and the Cato Institute wrote it up as a legal workaround.

Whatever the resolution of that dispute, the structural point holds. Federal health privacy law regulates covered entities and their business associates. A claims aggregator downstream of the billing cycle can end up outside that perimeter, and the record it holds still tells you who was treated, where, when, and for roughly what.

The same gap swallows the rest of modern health data. Period trackers, wellness apps, fitness wearables, and direct-to-consumer genetic services are generally not covered entities. As KFF Health News has reported, when the app is free and the business model is the data, the federal privacy rule simply does not apply.

New Hampshire’s counterweight

Against all of that, New Hampshire has built something real, and it did it by amending the state constitution.

In 2018, voters added Part I, Article 2-b, recognizing a right to live free from governmental intrusion in private or personal information as “natural, essential, and inherent.” It passed with better than eighty percent support.

On May 1, 2025, the New Hampshire Supreme Court gave it teeth. State v. Zarella, 2025 N.H. 20, came up from Belknap County, where a defendant facing four counts of aggravated felonious sexual assault sought in camera review of the complainant’s counseling and medical records held by private providers. The Court held that Article 2-b abrogates State v. Cressey‘s application of the older Gagne standard to records held by private organizations. To reach such records now, a defendant must follow RSA 173-C:5 for records privileged under that chapter, or demonstrate an “essential need” for records privileged under RSA 329-B:26 and RSA 330-A:32. The Court also required notice and an opportunity for the record holder to object. Attorney General Formella’s office argued for the heightened standard.

State law supplies more. RSA 329:26 places physician-patient communications on the same footing as attorney-client privilege, with an explicit carve-out: blood and urine samples and test results taken from a person under investigation for driving under the influence are not privileged, and their use is limited to the criminal proceeding. RSA 135-C:19-a governs disclosure of mental health information and, in the paragraph permitting certain disclosures, provides that information disclosed under it stays confidential and is not subject to discovery, subpoena, or admission into evidence in any judicial or administrative proceeding.

And New Hampshire’s hole

Then there is the state’s consumer privacy law, and this is where the picture falls apart.

The New Hampshire Data Privacy Act, RSA 507-H, took effect January 1, 2025. It lists sensitive data to include a consumer’s mental or physical health condition or diagnosis, requires opt-in consent to process it, and hands exclusive enforcement to the Attorney General, whose office stood up a Data Privacy Unit inside the Consumer Protection and Antitrust Bureau. The one-year cure period expired December 31, 2025.

Now read RSA 507-H:3. The chapter does not apply to any “body, authority, board, bureau, commission, district or agency” of the state or any political subdivision. It does not apply to a HIPAA covered entity or business associate. Protected health information is separately exempt, and so is patient-identifying information under the federal substance use disorder statute.

The problems, stated plainly

Permission has been mistaken for a shield. HHS’s own guidance is explicit that the rule permits, but does not require, certain disclosures to law enforcement. Whether your record moves is a policy decision made by a corporation, not a legal command. Nobody publishes those policies.

Self-authorization is doing the work a judge should do. An administrative subpoena is an agency certifying its own demand. Three conditions, all self-assessed, all unreviewed unless someone later litigates.

The protection attaches to the container, not the person. Court order at the state database. Subpoena at the pharmacy. Purchase order at the claims aggregator. Same prescription, three standards.

The rulebook is out of date and the agency has not fixed it. Vacated requirements remain in the published regulation and in the agency’s own guidance more than a year after the government stopped defending them.

New Hampshire is not covered by the Medicaid data injunction. Twenty-two states obtained limits. The state chose not to be one of them, and no one in state government has explained why.

State privacy law exempts the two entities that matter. RSA 507-H protects Granite Staters from retailers and app developers. It does nothing about the hospital or the police.

What to do with this

Ask your provider for its written policy on law enforcement requests. Covered entities are required to have policies and procedures; ask what theirs says about administrative subpoenas specifically, and whether anyone with legal training reviews them.

Ask for an accounting of disclosures under 45 CFR 164.528. The right has exceptions. Ask which ones the provider applied, and make them name the exception.

Know which conversation you are having. A statement made in counseling or therapy sits under a different rule than the same statement made in a hallway. Substance use treatment records sit under a stricter federal law than the rest of your chart. That is not a reason to withhold information from a clinician who is treating you. It is a reason to know the architecture.

Understand that a gunshot wound in New Hampshire is a police report, immediately, by force of criminal statute. So is any injury your treater believes came from a crime.

And if you are on Medicaid in this state, understand your position exactly. The federal court orders limiting the transfer of enrollee data to immigration authorities run to the twenty-two states that went to court. New Hampshire did not go.

The doors were cut by regulation, widened by a single district judge, and left open by an agency that has not updated its own rulebook. Every one of them can be closed by the same kind of decision that opened it. Somebody has to make it.

Count the doors. Then ask your representative which ones they intend to shut.

Fact check

VERIFIED means the primary source was opened and read for this article. ATTRIBUTED means the claim rests on a named outlet or organization, credited here.

Editor’s note. This article is built on the text of 45 CFR 164.512 as published in the Electronic Code of Federal Regulations, the HHS Office for Civil Rights fact sheet on the reproductive health care privacy rule, the full opinion in Ferguson v. City of Charleston, the New Hampshire statutes and constitutional provision named above, and the New Hampshire Supreme Court’s opinion in State v. Zarella. Where a claim rests on reporting rather than on a document, the outlet is named in the fact check table. Corrections: Granite State Report corrects verified errors promptly and appends a note identifying what changed and when. Nothing here is legal advice; if your own records are at issue, talk to a lawyer.