This article is a companion article to the article by Kara Kelley, ICE At The Front Door: Preparation Over Panic for Practice Leaders

In Part One, Kara Kelley focused on what ICE presence at your practice means for you as an employer.  Part Two addresses the other half of the equation; the role you never get to step out of:  healthcare provider.

When ICE enters or approaches a dental practice, HIPAA does not suddenly go on vacation.  IT also doesn’t give you license to obstruct law enforcement.  The tension lives in the middle, and that is where planning and practicing matters most.

This is where practices get uncomfortable, not because the rules are unclear, but the stress of federal agents in tactical gear in the workplace makes people forget the rules.

Before we dive into this topic, let me clarify a few things.  It does not matter what your political affiliations or opinions are in this situation.  This is intended for clarification on the topic of HIPAA Privacy and how it intersects with ICE in your practice. For more information and legal advice on the employment and legal aspects of this complex topic, refer to Kelley’s article and definitely consult with an employment attorney, and for issues regarding immigration issues, contact an immigration attorney.

Now, you will NEVER hear me ask you to put your personal safety at risk.  What I am asking is to stop for a moment and consider all aspects of an ICE interaction, plan and practice as a team.  Dental practices are not enforcement neutral spaces.  They are privacy driven environments with heightened compliance duties.  Preparation does not mean assuming wrongdoing.  It means respecting the complexity of the moment and refusing to let stress dictate compliance decisions.  HIPAA was designed for exactly these moments; when pressure is heightened, authority is present, and patients and teams still deserve protection. 

Now, let’s ground this in facts, and try to push fear aside.

HIPAA Does Not Care Why ICE Is There.

HIPAA is agnostic to immigration status, enforcement priorities and uniforms.  It applies the same way, whether the individual involved is a patient, an employee, a doctor or someone you’ve never met before.

Protected Health Information, sometimes called PHI, remains protected by your entire practice unless a specific HIPAA exception applies.  The presence of a badge or warrant does not automatically trigger one.

This matters because in normal scenarios with Law Enforcement, officers or agents may ask questions that sound reasonable, conversational or event helpful.  “Is this person scheduled today?” “Are they a patient here?”

Those questions are not neutral when it comes to HIPAA.  They are requests for PHI.

In the often-chaotic situation of ICE entering your practice, pleasantries go out the window, and our brains short circuit on what should be done and what we have rehearsed. 

A patient’s mere presence in your practice can be PHI.  Appointment schedules, treatment status, which operatory they are in, even confirmation that someone is or isn’t “here today” may constitute a HIPAA disclosure.

As always, HIPAA allows disclosures to law enforcement under certain situations such as a valid judicial warrant or court order or situations involving imminent threat to health or safety.  Absent of that, the default response is both simple and uncomfortable: you cannot disclose.

This is where practices stumble.  Admin teams at the front want to be helpful.  Clinical teams want to keep care moving.  Doctors want the disruption gone.  None of those instincts override HIPAA.

If ICE arrives while a patient is in active treatment, the practice still has obligations to that patient.  ICE does not “wait politely,” but urgency does not transfer authority to you.  Your responsibility is to protect PHI, maintain patient dignity and follow pre-established protocols without improvisation. 

What about team members?  When ICE inquiries involve a team member, practices often forget that employees can also be patients and employment records are not healthcare records, but conversations blur that line quickly. 

Employment verification, I-9s and personnel files fall under employment law, not HIPAA.  However, healthcare information related to accommodations, leave, injuries or dental treatment absolutely falls under HIPAA.

Innately, we want to be helpful as humans, but often we end up over sharing.  Statement such as, “They aren’t working today”, or “They are with a patient” can cross into PHI territory fast if that team member is a patient.  Take the time now to train all team members to separate what is employment information, with is health information, what team members are allowed to say and not say and what must be deferred to counsel. 

Silence may be the safest compliant choice. 

Practice owners and dentists sometimes assume their role affords them more flexibility in responding.  Authority does not equal immunity.

As a provider, dentists are still workforce members under HIPAA.  They are still bound by minimum necessary standards.  They are still prohibited from confirming or denying patient relationships without proper warrants or subpoenas.

An offhand comment from a doctor carries more legal weight than one from an administrative team member and enforcement agencies know this.  If you are the doctor and ICE approaches you directly, the rules do not change.  If anything, doctors set the tone for deescalation.

Many common HIPAA failures during enforcement encounters aren’t dramatic.  In fact, they are mundane.  Things such as escorting agents into clinical areas, leaving charts, screens or schedules with patient information visible, discussing names aloud within earshot or allowing team members to answer questions independently without proper training.  HIPAA violations don’t require malicious intent. They only require exposure. 

It may not be a right-of-way violation or consequence but the affected patient or other patients that overhear could turn that practice in for a HIPAA violation.

And amidst all that chaos we don't want one more thing against them. By them I mean the practice

A chaotic enforcement encounter can escalate quickly, disrupting care, compromising privacy and traumatize both patients and team members.  And to be fair, none of us knows how we will truly behave or respond when facing a crisis situation.

Take Covid for example.  Some of us responded well, some of us didn’t.  That was largely because we had never prepared for that scenario.  This situation, while different, is something we have never practiced.  There were protests, violence, chaos, and damage to property. Many states, including California, now require Workplace Violence training as part of OSHA.  And to be honest, this topic should be added so that we can appropriately respond.

Handled correctly, an ICE encounter doesn’t have to become a HIPAA incident.

Handled casually, it almost always does.

Now is the time to prepare and practice.