County social services employees are regularly out in our communities during this public health emergency. Staff are

• Responding to reports of abuse, neglect, and dependency of children,
• Responding to reports of abuse and exploitation of disabled adults,
• Helping individuals and families enroll in programs such as Medicaid and food and nutrition assistance, and
• Providing other needed social services in the community during this extraordinary time.

All of the programs and services administered by these county agencies are subject to bodies of law that require them to protect the information that they collect, use, and share with others.  Several questions have come up about how social services agencies should interpret and apply these laws during the current pandemic. Read on for a Q&A discussion of several of these key questions.

Are social services employees required to alert public health officials if they suspect that a person has or may have COVID-19?

Short answer: No.

State law requires some people and organizations, such as physicians, to submit reports to local health departments. Social services directors, attorneys, and employees are not required to alert public health officials about known or suspected cases of COVID-19.  For more details about mandatory reporting requirements, see Jill Moore’s March 2 post here. In addition to the legal mandates discussed in that post, the State Health Director issued a temporary order on March 23 requiring physicians to report suspected or confirmed deaths due to novel coronavirus infections.

Are social services employees allowed to voluntarily alert public health officials if they suspect that a client has or may have COVID-19? Or if they suspect that a client who has the virus is refusing to comply with communicable disease control measures, such as isolation?

Short answer: Probably not.

The key here is that the person involved is a “client” of the agency. This term is defined expansively to mean “any applicant for, or recipient of, public assistance or services, or someone who makes inquiries, is interviewed, or is or has been otherwise served to some extent by the agency.” 10A NCAC 69 .0101(1). The term includes, for example, a child who is the subject of an abuse or neglect report, a family member who is involved with in-home family preservation services, a disabled adult’s neighbor who is interviewed in the course of a financial exploitation investigation, or a person who applies for food and nutrition assistance.

State and federal social services laws require county agencies to keep identifiable information about clients confidential. Within the applicable bodies of law, there are opportunities for social services agencies and officials to disclose information without a client’s consent. No specific provisions allow disclosures for the purposes of protecting the public’s health or in the event of a public health emergency.

One state regulation allows disclosure without consent “to federal, State, or county employees … or to facilitate the administration of other State and federal programs, provided that the need for the disclosure of confidential information is justifiable for the purpose, as determined by the agency, and that safeguards, as described in 45 CFR 205.50 … are maintained to protect the information from re-disclosure.” 10A NCAC 69 .0503. The regulation implements G.S. 108A-80, which is the foundational confidentiality law for all social services information. It applies to adult services, economic services, and services for children and families.

If I were to try to hang my hat on one state law that allowed the voluntary disclosure to public health, this would probably be the one. There are, however, holes in this argument. The most significant hole is that G.S. 108A-80 is not the only law that applies to some of this information. Child welfare information is subject to another body of law in Chapter 7B that is more stringent. Some economic services programs are also subject to federal laws that are more stringent, including 45 CFR 205.50, the regulation referenced in the state regulation. . If G.S. 108A-80 is the only law that applied, it would be easier to justify this voluntary disclosure to public health. But the various confidentiality laws must be read together. Confidentiality laws governing social services information are collected in this online database if you are interested in taking the deep dive.

Must social services employees be told if a client or a member of the public they are in contact with has or may have COVID-19?

Short answer:  Sometimes.

Social services employees will clearly have access to this information in a few situations:

• A child has been placed in the custody of the county social services agency,
• The social services director or assistant director has been appointed the guardian of an adult (S. 35A-1241), or
• The social services agency is involved with an assessment of a report involving suspected abuse, neglect, or dependency of a child and the agency requests this information because the agency believes it may be relevant to the assessment (S. 7B-302(e)).

In addition, health care providers may alert social services employees about the need for personal protective equipment (PPE) if close contact is expected. Recent HIPAA guidance from the US DHHS Office of Civil Rights goes a bit further by stating that disclosure of the diagnosis is allowed:

For example, HIPAA permits a covered entity, consistent with applicable law and standards of ethical conduct, to disclose PHI about individuals who have tested positive for COVID-19 to fire department personnel, child welfare workers, mental health crisis services personnel, or others charged with protecting the health or safety of the public if the covered entity believes in good faith that the disclosure of the information is necessary to prevent or minimize the threat of imminent exposure to such personnel in the discharge of their duties. 45 CFR 164.512(j)(1).

As Jill Moore explained in her March 24 blog post, HIPAA must be read and applied together with state law. Reading HIPAA together with state law, Jill recommended that rather than disclose the diagnosis, the health care provider should simply alert a non-medical first responder that PPE should be used. This same analysis could apply to social services employees. Social services employees may also ask clients and other members of the public if they have been diagnosed, are symptomatic or may have been exposed.

In all of these circumstances, it would be ideal if the social services employee could use PPE to minimize the risk of exposure. Unfortunately, the virus is spreading quickly throughout our communities and it may be spreading before individuals are symptomatic. At the same time, there is a shortage of PPE to acccomodate the growing demands.  Many social services agencies have not been able to acquire enough to provide their employees.

While there is not a great solution to this multi-faceted problem, at least there are options for obtaining necessary information or taking appropriate precautions:

• Request information about clients who are the responsibility of the agency, such as children in DSS custody and persons under guardianship;
• Exercise the agency’s authority to demand access to information when allowed by law, such as when investigating a report of abuse or neglect;
• Ask health care providers if PPE or best available precautions should be used;
• As individuals directly if they have symptoms or believe they may have been exposed to someone with COVID-19; and
• If at all possible, use PPE in every encounter during this public health emergency.

If a social services employee has been exposed to or is suspected of having COVID-19 and public health officials ask the agency to identify clients the employee may have had contact with, should the agency share that information? 

Short answer: Yes.

During a communicable disease investigation, public health officials may need to identify and contact people who have been exposed to the disease. In the course of such investigations, they have the authority to obtain access to records that are otherwise confidential. G.S. 130A-144(b). Because these disclosures are required by law, social services agencies should comply with any such requests.

As I mentioned earlier, there are many different confidentiality laws that could apply depending on the type of employee involved, the work they were doing, and the clients who may have been exposed. Some of these laws expressly state that a disclosure may be made when required by other law. For example, the overarching social services confidentiality law, G.S. 108A-80, has an implementing regulation that allows disclosure without client consent “for purposes of complying with … any applicable State and federal regulations. 10A NCAC 69 .0504. Other applicable bodies of law, such as those in Chapter 7B governing child welfare records, are silent in this regard. One could argue that because the law does not expressly permit disclosure, the agency should not identify children or families the social services employee may have exposed. Alternatively, one could argue that the provisions in Chapter 7B must be read and applied together with those in Chapter 108A-80 (and the implementing regulations), and therefore disclosure is permitted. I am inclined to favor the second argument both from a legal perspective and also from a public policy perspective. It seems reasonable that social services agencies should be able to identify for public health officials those individuals who may have been exposed to the virus by one of the agency’s employees. The agency should limit the information disclosed to the minimum necessary, which means that it should not identify the potentially exposed individuals as clients of the agency. Rather, clients may be included in a broader list of contacts including colleagues and others the employee had contact with in the course of his or her work.

If a social services agency receives a request from the media about whether there has been an increase or decrease in the number of abuse or neglect reports, should the agency share that information?

Short answer: Yes, if such a record is maintained by the agency.

A data point, such as the number of reports received, is not confidential.  Therefore, if the agency has the information in a record already (such as a weekly trend report), it must provide that record to the requester consistent with state public records law. If the agency does not have the information in a record but has it in another format, it can discuss options with the person making the request so he or she can decide what records to request. It is important to remember that the agency is not required to create a record it does not already have, but if there is a record or group of records (including electronic records) that would be responsive to the request, the agency must comply. See Frayda Bluestein’s May 2017 blog post about information in databases.

Please continue to reach out as more questions arise.  I would be happy to expand this list of FAQs as new issues arise.

For more more information about confidentiality and information sharing during the pandemic, see the School’s COVID-19 microsite. A recording of the “Office Hours” session offered on April 2 is now available for viewing on demand.