Yeah, I didn’t say any of that but ok. HIPAA/employers actually require you to give law enforcement information in a variety of situations, including specifically the situation I mentioned:
To report PHI that the covered entity in good faith believes to be evidence of a crime that occurred on the covered entity’s premises (45 CFR 164.512(f)(5)).
HHS - When does the Privacy Rule allow covered entities to disclose information to law enforcement
Yes, without a warrant. It’s in the Privacy Notice in any retail pharmacy.
Impersonating a cop is a pretty big step that’s illegal in its own right but we did have moms trying to see if their adult daughter was on birth control, but that’s pretty easy to stop. Just lock their profile and ask the patient to make up a passcode or only deal with them in person.