Yes, HIPAA will apply to a first responder if their agency is a covered entity. HIPAA generally applies to EMS agencies that provide healthcare and transmit health information electronically in connection with transactions covered by HIPAA, such as submitting electronic insurance claims. It is often the case for ambulance or EMS companies.

 

Which first responders are covered entities

The organization will be the covered entity, not the job title. According to EMS attorneys Page, Wolfberg & Wirth in their white paper written for NEMSIS, a covered entity is defined as any healthcare provider that submits billing to a health insurance plan or government entity.

If your county EMS service transports patients and submits electronic claims to Medicare, it generally qualifies as a covered entity. A volunteer fire department that does not conduct covered electronic transactions may fall outside HIPAA's direct requirements.

 

What EMS can share for treatment

The HHS goes into great detail with their ambulance reporting FAQ and states that you can release PHI to a hospital for treatment of the patient without authorization 45 CFR 164.506.

You are not required to follow the minimum necessary standard when disclosing information for treatment purposes between providers. So if your EMS medical director emails a hospital neurologist about a call they made for a stroke, they can disclose the needed information to treat the patient. Where things get tricky is how you get that information to that provider.

 

Why hospitals can send outcomes back to EMS

EMS providers have complained for years that hospitals will not provide patient outcomes due to HIPAA regulations. As mentioned above, in their white paper, Page, Wolfberg & Wirth believe that to be false and include an HHS letter from 2012 stating that a hospital can provide outcome information to EMS providers for the purpose of quality improvement if both providers have or have had a relationship with the patient.

Another study that can help with providing information to first responders was a service evaluation in the UK over the course of 12 months. Hospital-to-prehospital feedback was provided to clinicians at one ambulance station and one air ambulance service. Using a facilitator that met the standards for sharing patient information with the hospital system in the UK.

 

When police and fire personnel can receive PHI

HHS guidance⁠ identifies six circumstances in which covered entities may disclose PHI to law enforcement, first responders, and public health authorities without patient authorization. These include disclosures required by law, those authorized to prevent or control the spread of infectious diseases, and disclosures necessary to prevent or lessen a serious and imminent threat to health or safety. The guidance specifically addresses COVID-19, although the underlying HIPAA provisions apply more broadly.

Police1⁠ explains how these provisions allow hospitals to share relevant information while limiting unnecessary disclosures. HHS provides an example in which a hospital may share a list of patients who tested positive for COVID-19 with an EMS dispatch center. Dispatchers may then inform responding personnel of relevant exposure risks on a per-call basis. Distributing the entire list to individual responders would not ordinarily satisfy HIPAA’s minimum necessary standard.

 

What a compliant message contains

Always keep the minimum necessary in mind when emailing outside of a treatment scenario. Limit your subject line to minimal information, state what your need is in the body of the email with as little patient-identifying information as possible, and only attach the information you need the recipient to have.

Also be sure that you are sending the email to the correct recipient. If you are emailing about a specific call, you should be sending that information to a person who can verify they work at the relevant facility.

 

How email safeguards apply

The HHS provides another FAQ on their website about sending PHI via email. They state that covered providers can communicate with patients via email as long as they apply reasonable safeguards when doing so. HHS also goes on to say that the Privacy Rule does not prevent you from sending an unencrypted email to a patient about treatment. Patients have the option to ask for a different form of communication, and you will need to comply with Security Rule regulations as well.

 

According to Paubox's 2026 report on Healthcare Email Security, 74% of those domains did not have effective DMARC in place. This is an increase from 2024, when 65% of breached domains did not have effective DMARC protection. Keep in mind these are all organizations that were breached, and could not tell you if your organization would be breached without these protections. Another report from Paubox states, "Most healthcare email systems look HIPAA compliant but still send unencrypted messages." in their executive summary.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Are police officers considered a covered entity under HIPAA?

Police officers are not covered unless the police agency is a health care provider and performs standard electronic transactions.

 

Can a hospital provide me with patient outcome information if I am an EMS provider?

Yes, you can receive information about a patient's outcome if it is for treatment purposes or if you are using that information to improve your quality, as long as you follow reasonable safeguards when sending the information.

 

Do I need to encrypt all emails containing PHI when sending them to a first responder?

HIPAA does not categorically require encryption for every email containing PHI. However, covered entities must assess transmission risks and implement appropriate safeguards, including encryption when reasonable and appropriate under the Security Rule.