HIPAA (only one “P “by the way) does not prohibit exchange of personal health information in the course of a criminal investigation. The real question is when the police got involved. At the very least they should have questioned the parents. And the police are not HIPAA covered entities.
One of the more troubling aspects of the Laura Dickinson investigation was the fact that so many people knew something was amiss, yet no one spoke up to tell the public.
That's especially troubling for those who've taken an oath to protect and serve.
Almost immediately after the body of the Eastern Michigan University student was found in her dorm room, law enforcement officials from several agencies got involved in the investigation, including Ypsilanti Police, Washtenaw County Sheriff's deputies and the Michigan State Police. Because the death occurred on the EMU campus, the investigation was led by the university's Department of Public Safety.
A federal report released last week that examined how EMU responded to the crime leaves no doubt that the EMU public safety staff, state police and other investigators knew early on that the death was very likely a homicide, and everyone involved knew they were conducting a murder investigation. An earlier report commissioned by the EMU Board of Regents and compiled by the law firm Butzel Long drew the same conclusion: Many people knew the death was a homicide, but no law enforcement official communicated that to President John Fallon, to the public or, most importantly, to Dickinson's family and EMU students, faculty and staff until after the arrest.
The issue of jurisdiction is at play in this case. Because EMU public safety officers were in charge, other agencies deferred to their decisions about what information to release. When EMU issued a statement saying no foul play was suspected in Dickinson's death, no one publicly contradicted it. When Public Safety Director Cindy Hall continued to describe it as a death investigation rather than a homicide, other agencies remained quiet.
The culture of law enforcement emphasizes, not surprisingly, a clear chain of command. Subordinates are disciplined not to subvert this chain by speaking out, without authorization from their supervisors. While some people involved in the investigation disagreed with EMU's decision not to release information to the public, they said nothing. It was more than two months after her death that police arrested a suspect, and only at that point did EMU disclose the true nature of the investigation.
Those investigating the crime are to be commended for making an arrest in the case. But while doing so, EMU violated the Clery Act, which requires timely notifications of campus crimes. Even more damaging, EMU seriously violated the trust of people they've vowed to protect - and other agencies were complicit in their silence. And that's a much harder breach to mend.