1. Ricardo Alonso-Zaldivar, “Effectiveness of Medical Privacy Law is Questioned,” Los Angeles
Times, April 9, 2008.

2. Tara Parker-Pope, “Hospital Workers Fired for Snooping on Spears,” The New York Times,
March 17, 2008.

3. U.S. Department of Health & Human Services, Office of Civil Rights, Compliance and
Enforcement, “Privacy Rule Enforcement Highlights,” as of April 30, 2008,
 http://www.hhs.gov/ocr/privacy/enforcement/04302008.html, 06/27/08.

4. U.S. Department of Health & Human Services, HIPAA Frequent Questions, “When does the
Privacy Rule allow covered entities to disclose protected health information to law enforcement officials?” Last updated August 8, 2005, http://www.hhs.gov/hipaafaq/permitted/law/505.html,
06/27/08. (Note: Citations to the Code of Federal Regulations have been omitted.)

5. 45 CFR 164.501 (2003). HIPAA defines law enforcement official as, “an officer or employee of
any agency or authority of the United States, a State, a territory, a political subdivision of a
State or territory, or an Indian tribe, who is empowered by law to: (1) Investigate or conduct an
official inquiry into a potential violation of law; or (2) Prosecute or otherwise conduct a criminal,
civil, or administrative proceeding arising from an alleged violation of law.”

6. Oregon Association of Hospital and Health Systems, “HIPAA Law Enforcement,” n.d.,
www.oahhs.org/legal/hipaa/law_enforcement_general.php, 08/08/08.

7. Washington State Hospital Association, Hospital and Law Enforcement - Guide to Disclosure of
Protected Health Information, Third Edition, November 2006, citing [i] RCW 46.20.308, and [ii]
45 CFR 164.512(f)(1)(i), www.wsha.org/files/62/HIPAA_and_LE_Guide_3rd_ED.pdf, 08/08/08.

8.  Michigan Complied Laws §§257.625c, 257.625g.

9. Michigan Complied Laws §257.625a (6)(e).