HIPAA in Corrections

As far as I can tell, the inmate using tobacco in the facility is much more of a security issue than a medical issue. If I were you, I would inform one of the officers.

As far as HIPAA goes, I feel like it is a bit of a reach to call a patient smoking protected health information, especially considering that it breaches security. If I am wrong though, you could always just inform security that the patient implied that s/he had contraband, not specifically tobacco. That way you take the medical aspect out of it entirely.

It looks like correctional institutions are specifically addressed in the law, & it works in your favor.

(5) Correctional institutions and other law enforcement custodial situations.

(i) Permitted disclosures. A covered entity may disclose to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual protected health information about such inmate or individual, if the correctional institution or such law enforcement official represents that such protected health information is necessary for:(A) The provision of health care to such individuals;

(B) The health and safety of such individual or other inmates;

© The health and safety of the officers or employees of or others at the correctional institution;

(D) The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another;

(E) Law enforcement on the premises of the correctional institution; and

(F) The administration and maintenance of the safety, security, and good order of the correctional institution.

45 CFR 164.512 - Uses and disclosures for which an authorization or opportunity to agree or object is not required. | LII / Legal Information Institute