Information Sharing Myths

Myth: Legal regulations such as HIPAA and 42 CFR, Part 2 prevent clinicians and public health agencies from sharing personal health information with criminal justice agencies.

Mythbuster: HIPAA and 42 CFR, Part 2 place limits on the type of personal health information that can be disclosed, when a patient’s consent is required, who is allowed to access the information, and how it is stored and transmitted. However, these regulations do not prevent sharing personal health information as long as the necessary protections are in place.  Moreover, both sets of regulations contain exceptions that allow justice and health professionals to share information in certain situations without an individual’s consent. For more information on HIPAA and 42 CFR, Part 2 check out our issue paper,  The Legal Landscape of Justice and Health Information SharingModule 3 of our Toolkit, and our FAQs on HIPAA and 42 CFR, Part 2.

Myth: I come from a small jurisdiction and we don’t have access to the data systems or technology needed to conduct information sharing.

Mythbuster: Gone are the days when it was necessary to purchase specialized software to facilitate interoperability–the ability for data systems and organizations to work together. There are several web-based options for storing and sharing data electronically that build on agencies’ existing technology infrastructure. For example, technology expert Paul Wormeli from the Integrated Justice Information Systems (IJIS) Institute recommends that jurisdictions with limited capacity to build data systems and develop interoperability use Cloud Computing, which stores information on remote servers that can be accessed over the internet. Alternatively, jurisdictions may want to consider the National Information Exchange Model (NIEM), which can be downloaded for free from For more information on the use of technology to support information sharing see Module 4 of our Toolkit, our FAQ on Health Information Technology and the Criminal Justice System, or an interview with Paul Wormeli of the IJIS Institute.

Myth: Information sharing is too expensive and requires too much staff time.

Mythbuster: With increasing access to low-cost and/or open-source data systems, jurisdictions can build interoperability at a low cost. There are also financial incentives in the HITECH Act for eligible correctional healthcare providers to adopt, implement, or update electronic health records that can offset some of the cost of initial investments in health information technology. Furthermore, while there will usually be some initial investment of resources and staff-time required, once the initiative is running smoothly, both health and justice agencies can realize significant cost and staff-time savings. Information sharing can minimize unnecessary duplication of services, decrease the use of incarceration for individuals who could be served more appropriately outside of the justice system, and reduce rates of recidivism by improving connections with treatment services when people return to their communities. Click here to learn more about cost-savings associated with diversion and treatment alternatives.

Myth: Sharing health records with professionals in the criminal justice system will place my patients at risk

Mythbuster: There are ways to design information sharing initiatives that protect patient privacy, preserve clinician-patient trust, and minimize adverse consequences. For example, informed consents that allow people to opt out of sharing their health records with particular agencies can be used to protect privacy rights and promote autonomy. Furthermore, there are technological approaches for limiting access to sensitive information. While it is essential to protect the privacy rights of people involved in the criminal justice system, in many cases the potential harm that can result when corrections and community health systems do not communicate, outweighs potential risks of unauthorized disclosure. To learn more, check out our Issue Brief on the Ethical Dimensions of Information Sharing or Module 3 of our Toolkit.