Disclosing Information about People with COVID-19 to First Responders

About the author

Jill Moore

View Other Posts

linkedin
Share on Google+
Share on Reddit
Share on Tumblr

UPDATE (May 13, 2020): On May 4, changes to North Carolina’s communicable disease confidentiality law went into effect, including important modifications to the parts of the law that permit information to be released to law enforcement officials. Please see this post for details.

UPDATE (March 24, 2020): After this was posted, the HHS Office for Civil Rights (OCR) released guidance for HIPAA-covered entities on disclosures of protected health information to first responders. The OCR guidance addresses the requirements of the HIPAA Privacy Rule and reminds readers to take state laws into account as well. There are some specific examples in the OCR guidance that reach different conclusions than this post, but that is because the OCR guidance focuses solely on HIPAA. This blog post integrates both HIPAA and North Carolina law. 

 

As more COVID-19 cases are identified in North Carolina, some local health departments may be asked to give first responders addresses or other information about local residents who are known or suspected of having the disease or having been exposed to it.

First responders who go to the homes of infected or exposed persons are at risk of being exposed to the virus that causes COVID-19. Both medical and non-medical responders need information about using personal protective equipment (PPE) or other actions they should take to protect their own health and safety. Medical first responders such as EMS need additional information to provide appropriate care, and to alert hospitals when they are transporting a patient who may have COVID-19. At the same time, information that identifies a person who has or may have COVID-19 is protected by confidentiality laws that limit the amount of information that may be disclosed.

The CDC has provided important guidance for 911 and other emergency call centers about screening questions that should be asked before emergency services are dispatched, and the PPE that first responders may need. In addition, the North Carolina Office of Emergency Medical Services has developed guidance for EMS dispatch about screening for the virus that causes COVID-19. The HIPAA oversight agency, U.S. DHHS’s Office for Civil Rights (OCR), has also released a document that includes information about disclosures of individually identifiable information in emergency circumstances. I urge readers to read these documents for more detailed information about these issues.

This post is focused on whether and to what extent information about COVID-19 infections or exposures that are known to public health officials may be disclosed, but it is essential to remember that many infections and exposures will be unknown to public health officials.

It is also important to bear in mind that, like everything else associated with COVID-19, this is an evolving situation. The recommendations for how to respond may change over time as the situation changes and as different agencies work together to further develop and align their guidance.

Providing Information while Maintaining Confidentiality

Time is scarce for local governments in the midst of a pandemic, so before describing the relevant laws, I will briefly summarize current CDC guidance and my views about how information that is known to public health officials may be managed in a way that maintains confidentiality while providing information that first responders may need:

  • Current CDC guidance advises 911 and other public safety answering points (PSAPs) to ask screening questions before emergency services are dispatched. For medical calls, the questions should be designed to assess whether the call concerns a person who may have signs, symptoms, or risk factors for COVID-19 (however, the query process must never supersede providing essential pre-arrival instructions for lifesaving interventions, such as the administration of naloxone for an overdose). For non-medical calls, the guidance recommends that local governments and EMS authorities coordinate with state and local public health and emergency call centers to determine the need for modified caller queries. The guidance also addresses the recommended PPE for EMS personnel, including care providers and drivers, and reminds all first responders to perform hand hygiene and avoid touching their faces.
  • When local health departments have information about individuals with known or suspected COVID-19, individually identifiable information about such individuals may be given to 911 call centers or other PSAPs. Dispatchers should be informed that the information is strictly confidential and not public record under North Carolina laws and HIPAA.
  • When medical first responders are dispatched, confidentiality laws permit the dispatcher to disclose individually identifiable information about COVID-19, whether it is from the health department or based on screening queries. Further, the CDC advises that dispatchers should notify pre-hospital healthcare providers (such as EMS) and hospitals in advance when they may be caring for, transporting, or receiving a patient with COVID-19, or when COVID-19 is suspected.
  • When a non-medical first responder (such as fire or law enforcement) is dispatched, the first responder should be informed of the PPE needed and any other measures the responder should take to protect the health and safety of the responder or others. However, specific information about the health of individuals at the address may not be disclosed to non-medical first responders unless a specific exception to the applicable confidentiality laws applies.

For more detailed information, keep reading, and please remember that this is information but not legal advice. The relevant local actors–including but not limited to health departments, EMS, other first responders, and occupational safety personnel–should work together to determine local procedures, taking into account federal and state guidance and seeking the advice of agency attorneys as needed.

Information about Who is Infectious is Incomplete

There are people in North Carolina with COVID-19 who are not known to public health officials. Further, it is likely that some infected people are unaware that they have COVID-19. There are a number of reasons for this, including constraints on the availability of tests, the possibility that some individuals with milder symptoms have not sought health care, and emerging evidence that suggests that some people could be infectious even before developing symptoms.

Because we can’t actually know for sure who has it and who doesn’t, the safest approach would be to assume that any given individual might have it and use universal precautions. That said, at present personal protective equipment is in short supply, and occupational safety personnel will need to work within any practical limitations when developing recommendations or protocols. It is in part because of these practical limitations that I believe it reasonable for the information that is known to public health officials to be used and disclosed to non-medical first responders. However, public health officials must still take care not to provide more information than they are authorized by law to disclose.

It’s also important to recognize the critical role confidentiality plays in protecting the public health, as well as the autonomy and dignity of the individuals whose health information is protected. There is a long history of social stigma being attached to communicable diseases, going back to ancient times but continuing during the 21st century’s pandemics of SARS and H1N1 flu. Researchers have demonstrated that this can affect the public health, if people are deterred from seeking care for fear that their illness will be exposed to the public and they’ll be stigmatized as a result. I hope readers will not see confidentiality laws as insignificant or mere administrative burdens. They are actually integral to communicable disease control.

Confidentiality Laws

Information that identifies a person who has or may have COVID-19 is protected by North Carolina’s communicable disease confidentiality law, G.S. 130A-143. When the information is maintained by a local health department, it is likely protected by the HIPAA Privacy Rule as well. Information about emergency medical services is also subject to another state confidentiality law, G.S. 143-518.

I’ll discuss each of these laws in turn, beginning with HIPAA.

HIPAA Privacy Rule

The HIPAA Privacy Rule governs how covered entities may use or disclose protected health information (PHI). The term covered entity is defined to include most health care providers, as well as health insurers and certain others. Local health departments are covered entities under HIPAA, so they must comply with the HIPAA Privacy Rule when disclosing PHI. EMS agencies may be assumed to be covered as well. Other local agencies, or parts of agencies, may also be covered. A full treatment of the question of which local entities are covered is beyond the scope of this post and depends in part on local decision-making (for more information, see this post by my colleague Aimee Wall).

Protected health information (PHI) is defined as individually identifiable information that relates to any of the following:

  • An individual’s health status or condition,
  • Provision of health care to an individual, or
  • Payment for the provision of health care to an individual.

Information that can be used to identify an individual is considered PHI even if it doesn’t include the person’s name. For example, an address that is associated with an individual with a particular health status or condition, such as COVID-19, constitutes PHI when the information is created or maintained by a covered entity.

A covered entity may disclose PHI only as permitted by the HIPAA Privacy Rule. The Privacy Rule specifically allows disclosures of PHI that are necessary for a variety of purposes. Many of the allowed disclosures are subject to a HIPAA provision known as the minimum necessary standard, which directs covered entities to limit the amount of PHI that is disclosed to that which is necessary to accomplish the purpose of the disclosure. 45 C.F.R. 164.514(d).

Two types of disclosures that are particularly relevant to the question of health departments providing COVID-19 information to 911 centers or other PSAPs are disclosures for treatment purposes, and disclosures for public health purposes.

Disclosures for treatment purposes. The HIPAA Privacy Rule allows covered entities to disclose individuals’ PHI for treatment purposes. 45 C.F.R. 164.506. Treatment is defined to include the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another. 45 C.F.R. 164.501. The rule does not require a written authorization, consent, or any other form of release for disclosures made for treatment purposes.

Disclosures for treatment purposes are not subject to the minimum necessary standard. 45 C.F.R. 164.502(b). Health departments and other covered entities therefore have broad authority to disclose PHI that is needed for the treatment of patients to medical first responders and other health care providers.

Disclosures for public health purposes. The HIPAA Privacy Rule also allows covered entities to disclose PHI for specified public health purposes. 45 C.F.R. 164.512(b). This section of the rule is not as broad as the section for treatment-related disclosures. It is important to read it carefully to determine whether a disclosure for any particular public health purpose is authorized. Also, disclosures made under the public health provision are subject to the minimum necessary rule.

A subsection of the rule gives public health agencies and other covered entities the limited authority to disclose PHI to a person who may have been exposed to a communicable disease, or who may otherwise be at risk of contracting or spreading a disease or condition, but only if the public health agency or other covered entity is authorized by law to notify the person of the exposure risk “as necessary in the conduct of a public health intervention or investigation.” 45 C.F.R. 164.512(b)(1)(iv).

In North Carolina, several laws authorize public health to obtain, use, and disclose information about individuals with communicable diseases for public health investigations and interventions. See G.S. Ch. 130A, Art. 6, Part 1. One of these laws, the communicable disease confidentiality law described below, constrains how information about reportable communicable diseases may be used or disclosed.

North Carolina’s Communicable Disease Confidentiality Law (G.S. 130A-143)

Under North Carolina law, information that identifies an individual who has or may have a reportable communicable disease is strictly confidential, is not a public record, and may be disclosed only as allowed by G.S. 130A-143. Violation of this law is a class 1 misdemeanor. G.S. 130A-25; 14-3. COVID-19 is a reportable communicable disease that is subject to this law.

The law does not define what is meant by “information that identifies an individual.” In practice, it is reasonable to use HIPAA’s concept of individually identifiable and assume that information that could be used to identify an individual is captured by this phrase, even if it doesn’t include the person’s name.

For disclosures for treatment purposes, the communicable disease confidentiality law is aligned with the HIPAA Privacy Rule. If the disclosure is permitted by the HIPAA Privacy Rule, it is permitted under this state law as well. G.S. 130A-143(3).

The law also allows disclosures that are both necessary to protect the public health and made in accordance with statewide communicable disease rules. G.S. 130A-143(4). Because the disclosures must be consistent with the state rules, this is not broad permission for public health officials to share information in the interest of public health. Rather, it is limited permission to make disclosures when state rules allow it. Here is where things get complicated. COVID-19 is an emerging disease—that is, a disease that has not previously been seen in human populations. As a result, the N.C. communicable disease rules do not include provisions that are specific to COVID-19. Instead, the disease falls under a rule that: (1) incorporates by reference CDC guidelines and recommended actions, and (2) provides guidelines for state public health officials to use when they devise control measures for communicable disease control measures not otherwise addressed in the rules. 10A N.C.A.C. 41A .0201.

What does this mean for disclosures about COVID-19 for first responders? While it is not entirely clear, I believe public health officials should refer to CDC guidance in determining which disclosures of PHI may be made. The bullet-point summary earlier in this post reflects my views about how to use the current CDC guidance, which distinguishes between medical and non-medical first responders, to determine which disclosures may be made to which first responders, under both HIPAA and the state communicable disease confidentiality law. I am also taking into account practices that have developed to provide limited information to non-medical first responders who need PPE or other instructions before interacting with individuals with other communicable diseases with which the state has more experience, such as tuberculosis.

The communicable disease confidentiality law also includes a provision for disclosing information about a person with a reportable communicable disease or condition to law enforcement, but this provision is quite limited. G.S. 130A-143(7). It allows a local health department or the state Department of Health and Human Services to disclose information to a court or a law enforcement official for the purpose of enforcing the state’s communicable disease laws. This provision will likely come into play if public health officials decide to seek criminal charges against a person who violates communicable disease laws or an isolation or quarantine order. The provision strictly limits the redisclosure of information that law enforcement officials receive under this provision.

Regardless of which provision of this law applies to allow a first responder to receive information about a person who has or may have COVID-19, it is important to remember that the information is strictly confidential, not a public record, and should not be disclosed further except as allowed by G.S. 130A-143.

North Carolina EMS Confidentiality Law (G.S. 143-518)

Finally, I want to acknowledge that EMS information is subject to a specific state confidentiality law, G.S. 143-518. EMS agencies are also likely to be covered entities that are subject to HIPAA.

G.S. 143-518 protects medical records and other patient identifiable data that are compiled and maintained by hospitals, the statewide trauma system, or EMS providers in connection with the dispatch, response, treatment, or transport of patients. These records and data are strictly confidential, not a public record, and may be disclosed only as provided by the statute.

The law specifically allows disclosures to health care personnel providing medical care to a patient. G.S. 143-518(a)(3). It also allows disclosures made “pursuant to any other law,” G.S. 143-518(a)(8), which could be interpreted to include any disclosures allowed by the HIPAA Privacy Rule (the provision was added to the statute in 2002, a time when many state laws were being examined and amended to align with HIPAA).

Summary

First responders who go to the homes of infected or exposed persons are at risk of being exposed to the virus that causes COVID-19, and need information about using personal protective equipment (PPE) or other actions they should take to protect their own health and safety. Medical first responders need additional information for treatment purposes.

Information that identifies a person who has or may have COVID-19 is protected by confidentiality laws that must be taken into account in developing local procedures for providing information to medical and non-medical first responders.

This post provides ideas for how information that is known to public health officials may be managed in a way that maintains confidentiality, while providing the information that first responders need. Like everything else associated with COVID-19, this is an evolving situation. Recommendations for how to respond may change over time as the situation changes and as different agencies work together to further develop and align their guidance on these issues.

Leave a comment ?

One Response to Disclosing Information about People with COVID-19 to First Responders

  1. Jill Moore says:

    I have received several off-line inquiries about when G.S. 130A-143(7) authorizes local health departments to release individually identifiable communicable disease information to law enforcement. G.S. 130A-143 makes all information and records that identify a person who has or may have a reportable communicable disease strictly confidential, and allows the release of the information only as provided by the statute. Paragraph (7) is a provision authorizing certain releases of information to a court or to a law enforcement official. It states:

    “(7) Release is made by the Department or a local health department to a court or a law enforcement official for the purpose of enforcing this Article [Communicable Diseases] or Article 22 [A Terrorist Incident Using Nuclear, Biological, or Chemical Agents] of this Chapter, or investigating a terrorist incident using nuclear, biological, or chemical agents. A law enforcement official who receives the information shall not disclose it further, except (i) when necessary to enforce this Article or Article 22 of this Chapter, or when necessary to conduct an investigation of a terrorist incident using nuclear, biological, or chemical agents, or (ii) when the Department or a local health department seeks the assistance of the law enforcement official in preventing or controlling the spread of the disease or condition and expressly authorizes the disclosure as necessary for that purpose;”

    Disclosures to law enforcement under this provision are limited to circumstances in which public health officials seek the assistance of law enforcement in enforcing the communicable disease laws or the public health bioterrorism laws. For example, if public health needs law enforcement’s assistance in arresting and charging someone for violating an isolation or quarantine order, public health may disclose information to law enforcement that is needed to carry out that purpose. Law enforcement is restricted from redisclosing information that is provided under this subsection, as provided in the subsection’s second sentence.

    Local health departments are subject to HIPAA as well as G.S. 130A-143. As HIPAA covered entities, they may disclose information only as allowed by the HIPAA Privacy Rule. On March 24, the HIPAA enforcement agency, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR), released guidance that states that HIPAA covered entities may provide lists with individually identifiable information about persons with known or suspected COVID-19 to a 911 call center or similar entity, which may then disclose it on a per-case basis to EMS and other first responders. The OCR guidance clearly states that covered entities may not provide such lists directly to the first responder agencies. The guidance is available at https://www.hhs.gov/sites/default/files/covid-19-hipaa-and-first-responders-508.pdf (see page 3 for the discussion of providing lists).

    The OCR guidance also reminds covered entities that they must comply with applicable state laws as well as HIPAA. While G.S. 130A-143 does not directly address whether local health departments may disclose information in accordance with OCR guidance on HIPAA, G.S. 130A-143(4) allows local health departments to release information when it is necessary to protect the public health and the release is made in accordance with communicable disease control measures adopted by the Commission for Public Health. For emerging diseases such as COVID-19, the Commission’s rules incorporate by reference CDC guidelines and recommended actions. CDC guidelines for first responders that were posted on its website on March 10 and March 14 are consistent with the OCR guidance for HIPAA covered entities and support the conclusion that local health departments may provide information to 911 call centers for further disclosure to first responders on a per-call basis. The CDC guidelines are available at https://www.cdc.gov/coronavirus/2019-ncov/hcp/guidance-for-ems.html (EMS) and https://www.cdc.gov/coronavirus/2019-ncov/community/guidance-law-enforcement.html (law enforcement).

    As readers are aware, guidance may change or be updated as the pandemic unfolds. If the OCR or CDC guidance documents that this comment refers to change, I will post an update.

Leave a Comment

NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Time limit is exhausted. Please reload the CAPTCHA.

This site uses Akismet to reduce spam. Learn how your comment data is processed.