Handling CPS or Law Enforcement Requests: What You Can and Cannot Say
Originally published: 2025-11-17
It is one of the most stressful phone calls a chiropractor can receive. A representative from Child Protective Services or law enforcement asks for information about a child who has been seen in your office. Your instincts say to cooperate fully, but your obligations under HIPAA and state law require more caution. Knowing what you can and cannot say can prevent a privacy violation and protect both you and your patient.
When the Call Comes In
A recent case involved a chiropractor who received a vague voicemail from CPS asking for details about a pediatric patient. The doctor wisely called ChiroFutures before responding. She was advised not to confirm or deny that the child was a patient, to document the contact, and to inform the caller that she would verify her legal responsibilities before releasing any information.
“Never confirm or deny that a patient is in your office without proper authorization.”
Before sharing any information, verify the caller’s identity, the agency they represent, and their authority to request records. Ask for written documentation of that authority, such as a subpoena, court order, or signed authorization from a parent or guardian.
What You Can Share
Information required by law, such as mandatory reports of suspected abuse or neglect
Records specifically authorized for release by the patient or legal guardian
Information ordered by a court or subpoena
If you are mandated to report suspected abuse, you must disclose what is required by statute. However, once the report is made, further communication with investigators should go through proper channels and be documented carefully.
What You Cannot Share
Any information not specifically requested or legally required
Records of other family members or unrelated visits
Verbal confirmations that a person is or has been a patient, unless authorized
If an investigator insists on immediate access, remain professional and cooperative, but do not provide protected health information without legal authority. Offer to have your attorney or malpractice representative follow up directly.
Documentation Protects You
Every contact from an agency should be documented, including the date, time, caller name, purpose of the call, and your response. If you release records, note exactly what was sent and under what authority. If you refuse a request, note why. This record demonstrates compliance with both HIPAA and your ethical duty to protect patient privacy.
The Risk Management Bottom Line
You can cooperate with authorities without violating confidentiality. Verify authority, limit disclosure to what is legally required, and document everything. When in doubt, call ChiroFutures before you respond.
ChiroFutures provides guidance and templates to help chiropractors handle CPS, law enforcement, and legal record requests properly and confidently.
