The Helpful Brother-in-Law

1. Hospital admission and diagnosis - not defensible. Obtaining protected health information by claiming to be family is deception aimed at inducing a HIPAA-covered entity to disclose. The hospital carries the HIPAA exposure, but the investigator carries the professional one: misrepresentation in the course of an investigation sits squarely inside the disciplinary grounds of s. 493.6118 (fraud, deceit, dishonest conduct) and in the agency's contract and E&O exposure. Even the "yes, he's on 4 West" is thin - a verbal confirmation with no custodian, no record, and an origin the investigator can never disclose on the stand without exposing his own method.

2. Employer HR as a "benefits verifier" - worse. This is classic pretexting. Depending on what is requested it implicates the Gramm-Leach-Bliley pretexting prohibition (15 U.S.C. § 6821) and, in any event, is a false representation to a third party to extract records. The same credibility problem follows: the source cannot be produced or cross-examined.

3. Address - defensible, if done properly. Motor-vehicle and driver records are available to a licensed investigative agency for permissible purposes under the Driver's Privacy Protection Act, and property/voter/utility-record research is ordinary public-records work. The lawful path is the ordinary one: no deception required.

Framing: the test is not "will it work" but "can I describe this method under oath, to a judge, with the client's attorney sitting next to me."

Hospital status and condition

• A signed authorization from Tom (unlikely) or a release embedded in the divorce case.
• A subpoena or court order issued through her divorce attorney directing the hospital's records custodian to produce records or a certification - this is the standard route and produces admissible business records rather than a phone rumor.
• Observation and canvass: whether he is home, mobile, driving, working out - far more probative of a disability claim than a diagnosis.

Employment and pay

• Subpoena duces tecum to the employer for employment, leave, and payroll records, with notice to Tom as required by the rules of procedure.
• Interrogatories and requests to produce served on Tom directly (his own leave records and tax returns are in his control).
• Deposition questions: "When did you last work? What is your pay status?" - a party's own answers are far stronger than an HR clerk's phone answer.

Address

• Public-records and DPPA-permissible database research, surveillance to confirm the residence, and skip-trace work through utilities and property records.

What to tell the client: the fastest route is not the same as the usable route. Anything she can use in court has to come from a source that will survive cross-examination. Set the expectation that hospital and payroll records arrive on subpoena timelines, not by Friday, and that Friday's answer will be surveillance and public records.

Stop, contain, document, and re-plan.

• Do not repeat or build on it. No further calls to the hospital, no calls to Tom's coworkers to "confirm." A single bad act is a mistake; a pattern is a course of conduct.
• Notify the qualifying licensee and the agency's attorney now, in writing, while the client can still be advised and the file can still be handled. Surprises are what turn an investigator's error into an agency's license problem.
• Do not put the results in the report as fact. If the admission is referenced at all, it must be flagged as unverified and sourced to a method that cannot be disclosed. Better practice: leave it out and let subpoenaed records do the work.
• Tell the client plainly that the confirmation may be unusable, may be attacked, and may create discovery problems for her in the divorce if the method surfaces - then pivot to subpoenas through her attorney.
• Treat it as a process failure, not bad luck: write the intake rule that no covered-entity or financial-record request is made without a signed authorization or a subpoena in hand.