UPDATE (May 13, 2020): On May 4, changes to North Carolina’s communicable disease confidentiality law went into effect, including important modifications to the parts of the law that permit information to be released to law enforcement officials. Please see this post for details.

UPDATE (March 24, 2020): After this was posted, the HHS Office for Civil Rights (OCR) released guidance for HIPAA-covered entities on disclosures of protected health information to first responders. The OCR guidance addresses the requirements of the HIPAA Privacy Rule and reminds readers to take state laws into account as well. There are some specific examples in the OCR guidance that reach different conclusions than this post, but that is because the OCR guidance focuses solely on HIPAA. This blog post integrates both HIPAA and North Carolina law. 

As more COVID-19 cases are identified in North Carolina, some local health departments may be asked to give first responders addresses or other information about local residents who are known or suspected of having the disease or having been exposed to it.

First responders who go to the homes of infected or exposed persons are at risk of being exposed to the virus that causes COVID-19. Both medical and non-medical responders need information about using personal protective equipment (PPE) or other actions they should take to protect their own health and safety. Medical first responders such as EMS need additional information to provide appropriate care, and to alert hospitals when they are transporting a patient who may have COVID-19. At the same time, information that identifies a person who has or may have COVID-19 is protected by confidentiality laws that limit the amount of information that may be disclosed.

The CDC has provided important guidance for 911 and other emergency call centers about screening questions that should be asked before emergency services are dispatched, and the PPE that first responders may need. In addition, the North Carolina Office of Emergency Medical Services has developed guidance for EMS dispatch about screening for the virus that causes COVID-19. The HIPAA oversight agency, U.S. DHHS’s Office for Civil Rights (OCR), has also released a document that includes information about disclosures of individually identifiable information in emergency circumstances. I urge readers to read these documents for more detailed information about these issues.

This post is focused on whether and to what extent information about COVID-19 infections or exposures that are known to public health officials may be disclosed, but it is essential to remember that many infections and exposures will be unknown to public health officials.

It is also important to bear in mind that, like everything else associated with COVID-19, this is an evolving situation. The recommendations for how to respond may change over time as the situation changes and as different agencies work together to further develop and align their guidance.

Providing Information while Maintaining Confidentiality

Time is scarce for local governments in the midst of a pandemic, so before describing the relevant laws, I will briefly summarize current CDC guidance and my views about how information that is known to public health officials may be managed in a way that maintains confidentiality while providing information that first responders may need:

• Current CDC guidance advises 911 and other public safety answering points (PSAPs) to ask screening questions before emergency services are dispatched. For medical calls, the questions should be designed to assess whether the call concerns a person who may have signs, symptoms, or risk factors for COVID-19 (however, the query process must never supersede providing essential pre-arrival instructions for lifesaving interventions, such as the administration of naloxone for an overdose). For non-medical calls, the guidance recommends that local governments and EMS authorities coordinate with state and local public health and emergency call centers to determine the need for modified caller queries. The guidance also addresses the recommended PPE for EMS personnel, including care providers and drivers, and reminds all first responders to perform hand hygiene and avoid touching their faces.
• When local health departments have information about individuals with known or suspected COVID-19, individually identifiable information about such individuals may be given to 911 call centers or other PSAPs. Dispatchers should be informed that the information is strictly confidential and not public record under North Carolina laws and HIPAA.
• When medical first responders are dispatched, confidentiality laws permit the dispatcher to disclose individually identifiable information about COVID-19, whether it is from the health department or based on screening queries. Further, the CDC advises that dispatchers should notify pre-hospital healthcare providers (such as EMS) and hospitals in advance when they may be caring for, transporting, or receiving a patient with COVID-19, or when COVID-19 is suspected.
• When a non-medical first responder (such as fire or law enforcement) is dispatched, the first responder should be informed of the PPE needed and any other measures the responder should take to protect the health and safety of the responder or others. However, specific information about the health of individuals at the address may not be disclosed to non-medical first responders unless a specific exception to the applicable confidentiality laws applies.

For more detailed information, keep reading, and please remember that this is information but not legal advice. The relevant local actors–including but not limited to health departments, EMS, other first responders, and occupational safety personnel–should work together to determine local procedures, taking into account federal and state guidance and seeking the advice of agency attorneys as needed.

Information about Who is Infectious is Incomplete

There are people in North Carolina with COVID-19 who are not known to public health officials. Further, it is likely that some infected people are unaware that they have COVID-19. There are a number of reasons for this, including constraints on the availability of tests, the possibility that some individuals with milder symptoms have not sought health care, and emerging evidence that suggests that some people could be infectious even before developing symptoms.

Because we can’t actually know for sure who has it and who doesn’t, the safest approach would be to assume that any given individual might have it and use universal precautions. That said, at present personal protective equipment is in short supply, and occupational safety personnel will need to work within any practical limitations when developing recommendations or protocols. It is in part because of these practical limitations that I believe it reasonable for the information that is known to public health officials to be used and disclosed to non-medical first responders. However, public health officials must still take care not to provide more information than they are authorized by law to disclose.

It’s also important to recognize the critical role confidentiality plays in protecting the public health, as well as the autonomy and dignity of the individuals whose health information is protected. There is a long history of social stigma being attached to communicable diseases, going back to ancient times but continuing during the 21st century’s pandemics of SARS and H1N1 flu. Researchers have demonstrated that this can affect the public health, if people are deterred from seeking care for fear that their illness will be exposed to the public and they’ll be stigmatized as a result. I hope readers will not see confidentiality laws as insignificant or mere administrative burdens. They are actually integral to communicable disease control.

Confidentiality Laws

Information that identifies a person who has or may have COVID-19 is protected by North Carolina’s communicable disease confidentiality law, G.S. 130A-143. When the information is maintained by a local health department, it is likely protected by the HIPAA Privacy Rule as well. Information about emergency medical services is also subject to another state confidentiality law, G.S. 143-518.

I’ll discuss each of these laws in turn, beginning with HIPAA.

HIPAA Privacy Rule

The HIPAA Privacy Rule governs how covered entities may use or disclose protected health information (PHI). The term covered entity is defined to include most health care providers, as well as health insurers and certain others. Local health departments are covered entities under HIPAA, so they must comply with the HIPAA Privacy Rule when disclosing PHI. EMS agencies may be assumed to be covered as well. Other local agencies, or parts of agencies, may also be covered. A full treatment of the question of which local entities are covered is beyond the scope of this post and depends in part on local decision-making (for more information, see this post by my colleague Aimee Wall).

Protected health information (PHI) is defined as individually identifiable information that relates to any of the following:

• An individual’s health status or condition,
• Provision of health care to an individual, or
• Payment for the provision of health care to an individual.

Information that can be used to identify an individual is considered PHI even if it doesn’t include the person’s name. For example, an address that is associated with an individual with a particular health status or condition, such as COVID-19, constitutes PHI when the information is created or maintained by a covered entity.

A covered entity may disclose PHI only as permitted by the HIPAA Privacy Rule. The Privacy Rule specifically allows disclosures of PHI that are necessary for a variety of purposes. Many of the allowed disclosures are subject to a HIPAA provision known as the minimum necessary standard, which directs covered entities to limit the amount of PHI that is disclosed to that which is necessary to accomplish the purpose of the disclosure. 45 C.F.R. 164.514(d).

Two types of disclosures that are particularly relevant to the question of health departments providing COVID-19 information to 911 centers or other PSAPs are disclosures for treatment purposes, and disclosures for public health purposes.

Disclosures for treatment purposes. The HIPAA Privacy Rule allows covered entities to disclose individuals’ PHI for treatment purposes. 45 C.F.R. 164.506. Treatment is defined to include the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another. 45 C.F.R. 164.501. The rule does not require a written authorization, consent, or any other form of release for disclosures made for treatment purposes.

Disclosures for treatment purposes are not subject to the minimum necessary standard. 45 C.F.R. 164.502(b). Health departments and other covered entities therefore have broad authority to disclose PHI that is needed for the treatment of patients to medical first responders and other health care providers.

Disclosures for public health purposes. The HIPAA Privacy Rule also allows covered entities to disclose PHI for specified public health purposes. 45 C.F.R. 164.512(b). This section of the rule is not as broad as the section for treatment-related disclosures. It is important to read it carefully to determine whether a disclosure for any particular public health purpose is authorized. Also, disclosures made under the public health provision are subject to the minimum necessary rule.

A subsection of the rule gives public health agencies and other covered entities the limited authority to disclose PHI to a person who may have been exposed to a communicable disease, or who may otherwise be at risk of contracting or spreading a disease or condition, but only if the public health agency or other covered entity is authorized by law to notify the person of the exposure risk “as necessary in the conduct of a public health intervention or investigation.” 45 C.F.R. 164.512(b)(1)(iv).

In North Carolina, several laws authorize public health to obtain, use, and disclose information about individuals with communicable diseases for public health investigations and interventions. See G.S. Ch. 130A, Art. 6, Part 1. One of these laws, the communicable disease confidentiality law described below, constrains how information about reportable communicable diseases may be used or disclosed.

North Carolina’s Communicable Disease Confidentiality Law (G.S. 130A-143)

Under North Carolina law, information that identifies an individual who has or may have a reportable communicable disease is strictly confidential, is not a public record, and may be disclosed only as allowed by G.S. 130A-143. Violation of this law is a class 1 misdemeanor. G.S. 130A-25; 14-3. COVID-19 is a reportable communicable disease that is subject to this law.

The law does not define what is meant by “information that identifies an individual.” In practice, it is reasonable to use HIPAA’s concept of individually identifiable and assume that information that could be used to identify an individual is captured by this phrase, even if it doesn’t include the person’s name.

For disclosures for treatment purposes, the communicable disease confidentiality law is aligned with the HIPAA Privacy Rule. If the disclosure is permitted by the HIPAA Privacy Rule, it is permitted under this state law as well. G.S. 130A-143(3).

The law also allows disclosures that are both necessary to protect the public health and made in accordance with statewide communicable disease rules. G.S. 130A-143(4). Because the disclosures must be consistent with the state rules, this is not broad permission for public health officials to share information in the interest of public health. Rather, it is limited permission to make disclosures when state rules allow it. Here is where things get complicated. COVID-19 is an emerging disease—that is, a disease that has not previously been seen in human populations. As a result, the N.C. communicable disease rules do not include provisions that are specific to COVID-19. Instead, the disease falls under a rule that: (1) incorporates by reference CDC guidelines and recommended actions, and (2) provides guidelines for state public health officials to use when they devise control measures for communicable disease control measures not otherwise addressed in the rules. 10A N.C.A.C. 41A .0201.

What does this mean for disclosures about COVID-19 for first responders? While it is not entirely clear, I believe public health officials should refer to CDC guidance in determining which disclosures of PHI may be made. The bullet-point summary earlier in this post reflects my views about how to use the current CDC guidance, which distinguishes between medical and non-medical first responders, to determine which disclosures may be made to which first responders, under both HIPAA and the state communicable disease confidentiality law. I am also taking into account practices that have developed to provide limited information to non-medical first responders who need PPE or other instructions before interacting with individuals with other communicable diseases with which the state has more experience, such as tuberculosis.

The communicable disease confidentiality law also includes a provision for disclosing information about a person with a reportable communicable disease or condition to law enforcement, but this provision is quite limited. G.S. 130A-143(7). It allows a local health department or the state Department of Health and Human Services to disclose information to a court or a law enforcement official for the purpose of enforcing the state’s communicable disease laws. This provision will likely come into play if public health officials decide to seek criminal charges against a person who violates communicable disease laws or an isolation or quarantine order. The provision strictly limits the redisclosure of information that law enforcement officials receive under this provision.

Regardless of which provision of this law applies to allow a first responder to receive information about a person who has or may have COVID-19, it is important to remember that the information is strictly confidential, not a public record, and should not be disclosed further except as allowed by G.S. 130A-143.

North Carolina EMS Confidentiality Law (G.S. 143-518)

Finally, I want to acknowledge that EMS information is subject to a specific state confidentiality law, G.S. 143-518. EMS agencies are also likely to be covered entities that are subject to HIPAA.

G.S. 143-518 protects medical records and other patient identifiable data that are compiled and maintained by hospitals, the statewide trauma system, or EMS providers in connection with the dispatch, response, treatment, or transport of patients. These records and data are strictly confidential, not a public record, and may be disclosed only as provided by the statute.

The law specifically allows disclosures to health care personnel providing medical care to a patient. G.S. 143-518(a)(3). It also allows disclosures made “pursuant to any other law,” G.S. 143-518(a)(8), which could be interpreted to include any disclosures allowed by the HIPAA Privacy Rule (the provision was added to the statute in 2002, a time when many state laws were being examined and amended to align with HIPAA).

Summary

First responders who go to the homes of infected or exposed persons are at risk of being exposed to the virus that causes COVID-19, and need information about using personal protective equipment (PPE) or other actions they should take to protect their own health and safety. Medical first responders need additional information for treatment purposes.

Information that identifies a person who has or may have COVID-19 is protected by confidentiality laws that must be taken into account in developing local procedures for providing information to medical and non-medical first responders.

This post provides ideas for how information that is known to public health officials may be managed in a way that maintains confidentiality, while providing the information that first responders need. Like everything else associated with COVID-19, this is an evolving situation. Recommendations for how to respond may change over time as the situation changes and as different agencies work together to further develop and align their guidance on these issues.