Skip to Content
Network for Public Health Law
Guidance Health Data Sharing and Privacy

Disclosure of Individuals’ COVID-19 Status to Emergency Responders

March 18, 2020

by Colleen Healy Boufides and Denise Chrysler

Overview

Emergency responders (EMS) request that public health officials provide the name and residential address/location of each positive COVID-19 case in their area in order to protect the health of EMS personnel.

Considerations:

In our trainings, the Network uses the “Can I?” “Must I?” and “Should I?” framework for public health decision-making.

With regard to “Can I?” – does the health officer have the legal authority to disclose this information? Most likely, yes, as discussed below. Must the health officer warn EMS of COVID-19 status for all individuals in the community who have tested positive? Usually not; while the health officer must protect the public and prevent and control the spread of disease, the health officer has a great deal of discretion in determining how to do this.

Should I? This is where most public health decision-making lies. Most decisions are discretionary, based on professional judgement with input from subject-matter experts, if indicated. Here, a health officer will need to weigh competing interests – balancing the individual’s privacy interest against protecting EMS employees, the health care system, and the general public.

With regard to legal authority, namely restrictions under the HIPAA Privacy Rule to disclosing the requested information (45 CFR Part 164): HIPAA may or may not apply to a health department, depending on whether it has separated its HIPAA covered functions (such as the health department’s health care clinics) from those functions that are not covered by HIPAA (such as the health department’s public health disease control functions) through a “hybrid designation.” Even if it does not apply, HIPAA represents a minimum standard that is commonly accepted for health information privacy, so it is often a good starting point.

HIPAA prohibits the use and disclosure of identifiable health information (known as “protected health information” or “PHI”) unless the rule requires or permits disclosure. For example, the Rule requires disclosure to an individual who requests his or her own health information or for an investigation by the federal government of an alleged HIPAA violation (45 CFR 164.502).

HIPAA also includes provisions that permit, but do not require, a HIPAA-covered entity to disclose PHI. A covered entity may disclose PHI to a health care provider for treatment activities (45 CFR 164.506). It appears EMS is requesting information about individuals who have tested positive even though the information is not – or may not be – needed to transport or treat a particular patient.

HIPAA permits disclosure of PHI in emergency situations, such as to assist patients in receiving the care they need, to assist public health response, or to prevent a serious or imminent threat. The Office for Civil Rights, which enforces HIPAA, has materials on its website regarding HIPAA and Emergency Situations: Preparedness, Planning, and Response, that might be helpful. In particular, review Office for Civil Rights, U.S. Department of Health and Human Services BULLETIN: HIPAA Privacy and Novel Coronavirus, which was recently posted.

HIPAA permits a covered entity to disclose PHI to anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public (45 CFR 164.512(j)). The disclosure must be consistent with applicable law and standards of ethical conduct and made to a person or persons reasonably able to prevent or lessen the threat. Additionally, the covered entity must make reasonable efforts to limit information disclosed to that which is the minimum necessary for the intended purpose (45 CFR 164.502(b)). A covered entity that believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public, is presumed to have acted in good faith if the belief is based upon the covered entity’s actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority. (45 CFR 164.512(j)(4)).

Whether or not HIPAA applies, states may have their own requirements that apply to disclosure by a local health department identifying an individual who has or is being monitored for potential development of a communicable disease. For example, Michigan’s Communicable and Related Disease Rules (Rule R 325.181)  make confidential medical and epidemiological information that identifies an individual, and limit disclosure of this information, absent the individual’s consent, unless necessary to protect the public’s health as determined by the local or state health officer.

In Texas, on the other hand, the state’s Communicable Disease Prevention and Control Act requires confidentiality of information relating to reportable diseases, but expressly allows for the release of certain information to EMS providers. Tex. Health & Safety Code § 81.001 et seq. Specifically, the law allows for release of medical or epidemiological information “to governmental entities that provide first responders who may respond to a situation involving a potential communicable disease of concern and need the information to properly respond to the situation” or to the designated infection control officer for an emergency response provider (e.g., an entity employing EMS personnel, fire fighters, or peace officers). Tex. Health & Safety Code § 81.046(c)(6)-(7). Moreover, the law requires that a local health department or authority “shall provide to first responders the physical address of a person who is being monitored by the local department or authority for a communicable disease for the duration of the disease’s incubation period.” Tex. Health & Safety Code § 81.046(c-1) (emphasis added) (the person’s physical address must be removed from computer-aided dispatch systems once the monitoring period expires). In carrying out these provisions, the local health department or authority may release “only the minimum necessary information” as determined by the state or local health department, health authority, or other governmental entity. Tex. Health & Safety Code § 81.046(c-2).

In instances where disclosure is permitted but not required, a local health officer should determine whether the disclosure of names and addresses of individuals who have tested positive for COVID-19 is necessary to protect the public’s health including the general public, EMS, and other health care workers. A more recent consideration is whether disclosure might assist EMS in choosing whether and what Personal Protective Equipment (PPE) it should use during its encounter, with current concerns that PPE is or may be in short supply.

Determining whether or not disclosure is necessary requires considering other options, including those which do not involve identifying all individuals, especially individuals who may not need transport or the assistance of EMS. For example, a health department can instruct individuals who test positive that they should inform EMS of their COVID-19 status. The CDC has provided Interim Guidance for Emergency Medical Services (EMS) Systems and 911 Public Safety Answering Points (PSAPs) for COVID-19 in the United States that includes a process to identify a possible Person Under Investigation (PUI) before EMS’s arrival on the scene. In an ideal world, EMS would be provided with COVID-19 status for only those individuals who need to be transported, but it might not be feasible to develop and implement a system and protocol while health departments are spread thin in their response efforts. Also, now that private laboratories are testing for COVID-19, there may be concerns about whether individuals are clearly instructed to inform EMS of their test results.

Whatever decision is made, the health officer should:

  1. Be able to articulate the basis for the decision.
  2. Consider what other health departments are doing.
  3. Show that alternatives have been considered and weighed. In considering options (such as informing EMS of only those individuals who need transport): is this feasible, are there enough time and resources, and would this create delay for someone who needs emergency services?
  4. Does the decision make sense from the perspective of the patient or the EMS?
  5. Is there a way to be transparent with individuals – for example, informing individuals both that they should inform EMS if transport is needed and, additionally, the health department will be providing EMS with names and addresses of individuals who have tested positive.
  6. Document the decision and the basis for it.
  7. Absent a clear answer, on what side to err?

Update as of April 1, 2020: For further discussion of this and related issues, please see the Network’s Frequently Asked Questions regarding COVID-19 and Health Data Privacy which is being continuously updated. In particular, review the section on Disclosures to First Responders, which provides up-to-date information on HHS Office of Civil Rights guidance and CDC National Institute for Occupational Safety and Health (NIOSH) notification requirements.

The Network for Public Health Law provides information and education about laws related to the public’s health. We do not provide legal representation or provide advice on a particular course of action.