I don't normally get involved in this, but here goes what I know. below in italics are excerpts from the CFR, in bold are my interpretations.
Disclaimer: only you know the whole story, but based on how I understand the event I think all these sections apply and you bet I would report it, using the appropriate procedure.
In CA, I am required to report directly to LEO and file a written report within 24 hours to CPS/HHS. the opinion of my supervisor has no baring on how this is filed. If I tell my Sup then he is now required to submit a report as well in addition to mine. employees of the same organization who are reporting the same event may be included by name on the same report. ex, CPS would get a report from me with both my name and my partners name, from the fire department with all the FF's names, from the SO with every officer who was on scene documented, and from the hospital with every person who provided care to the patient.
I hate to say it but in the simplest form of the law your supervisors and lawyer are wrong. by posting here you felt there was a legitimate violation and failed to properly report the incident to the authority who is responsible for identifying if law was broken. we are not cops, we do not have the right or authority to judge if a crime has been committed. we have the responsibility to inform an LEO of all the information we know so that they may investigate.
"
To respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness or missing person; but the covered entity must limit disclosures of PHI to name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics. Other information related to the individual’s DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision, but may be disclosed in response to a court order, warrant, or written administrative request (45 CFR 164.512(f)(2))"
this sections tells you what you are permitted to disclose to Law enforcement or the authority having primary investigative responsibility when you are required to report, you are legally requested to report, or if any other section states that you may report
"Child abuse or neglect may be reported to any law enforcement official authorized by law to receive such reports and the agreement of the individual is not required (45 CFR 164.512(b)(1)(ii))."
this may not apply here, however the pictures where not part of a complete book, by separating them from the original source they are no longer considered academic. artistic is interpreted differently by individuals and can per interpreted differently based on the age of the child. key to remember here is that you as the mandatory reporter are not conducting the investigation. Once you have the feeling that abuse or neglect MAY have occurred you MUST report this in most instances, to the authority responsible for determining if a crime has been committed. ie, giving the LEO the information necessary to determine if the person is a known or suspected offender. additionally public intoxication is usually an immediate cause for revocation of probation or parole in which the person has very reduced rights to privacy.
"(1) Permitted disclosures. A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure:
(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and (B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. (45 CFR 164.502(j))"
child pornography is known to cause serious psychological harm to children and has lasting affects for the rest of the victims life. possession of child pornography is a felony and not a victim-less crime, it can be prosecuted without the child in questions knowledge. while we have already agreed that these pictures were torn from a different book can you identify what book they came from? did you see the library book with missing pages? if not can you be absolutely positive that they are from a legitimate academic or artistic source? remember just because they came from a book or magazine does not make it legal, freedom of the press has its limitations. I would report let the experts decide if its a violation of law
"Except when required by law, the disclosures to law enforcement summarized above are subject to a minimum necessary determination by the covered entity (45 CFR 164.502(b), 164.514(d)). When reasonable to do so, the covered entity may rely upon the representations of the law enforcement official (as a public officer) as to what information is the minimum necessary for their lawful purpose (45 CFR 164.514(d)(3)(iii)(A)). Moreover, if the law enforcement official making the request for information is not known to the covered entity, the covered entity must verify the identity and authority of such person prior to disclosing the information (45 CFR 164.514(h))."
basically if the cop says that they need the information for a legitimate investigation, YOU MUST PROVIDE THAT INFORMATION, once you have identified who the officer is. HIPAA is meant to protect PHI but is not to interfere with reporting crime when you believe in good faith that a crime has been committed by the individual in question.
http://www.hhs.gov/hipaafaq/permitted/law/505.html
here is a link to the HSS FAQ, do not rely on these summaries but instead use them to guide you through the actual CFR (Code of Federal Regulations) here:
http://www.gpo.gov/fdsys/pkg/CFR-2011-title45-vol1/pdf/CFR-2011-title45-vol1-sec164-512.pdf