Background

The technical assistance request raised the following concerns:

An individual who hosted a graduation party that a COVID-19 positive individual attended is refusing to cooperate by providing the names and contact information of the approximately 20 close contacts from the party. The COVID-19 positive individual does not live at the address where the party took place. The event took place at a private residence. The health department is exploring the option of a warrant through our legal counsel to require the information be provided. Would there be potential legal concerns if we issued a press release indicating that individuals who attended a party on this date at this address, may have been exposed to COVID-19? My concern is the event took place at a private residence.

To answer the request, we first set forth our executive decision-making framework for addressing similar questions. Then we focus on the key legal and policy questions.

The Executive Decision-Making Framework

Michigan’s Public Health Code grants public health officials considerable discretion to protect the public against communicable disease and environmental health threats. To exercise their broad grant of authority, the executive must ask three key questions: Can I? Must I? Should I?

Can I? focuses on whether the agency has the legal authority to act, and if so, in what way? The public health agency’s authority is based on the police power, which provides the authority for states to protect the public’s health. The parameters of authority are broad, but include constitutional safeguards for individual rights to liberty and due process.

Must I? asks whether there are legal requirements, including funding source directives, that mandate action and define how the agency must act. Usually, the agency has considerable discretion in deciding how to fulfill its obligation. Even if the agency must act, the activity need not address every aspect of the problem.

Should I? is a policy question requiring the executive to determine whether and how to exercise discretionary authority. Discretionary authority must be used reasonably and impartially; never in an arbitrary or capricious manner.

Addressing the Legal Issues

Can I? Ordinarily, public health officials are obligated to protect the privacy of individuals in connection with public health surveillance, investigations, and interventions. However, a health official is legally authorized – based on professional judgment and discretion – to release information to the public that is connected to an investigation if necessary to protect the public’s health. Michigan’s Public Health Code, MCL 333.2433, provides a broad grant of authority to local health departments to take necessary action, including the release of information:

(1) A local health department shall continually and diligently endeavor to prevent disease, prolong life, and promote the public health through organized programs, including…prevention and control of diseases

(2) A local health department shall:

(c) Make investigations and inquiries as to:

(i) The causes of disease and especially of epidemics….

(f) Have powers necessary or appropriate to perform the duties and exercise the powers given by law to the local health officer and which are not otherwise prohibited by law.

Similarly, under MCL 333.2428, “The local health officer… may take actions and make determinations necessary or appropriate to carry out the local health department’s functions under this part or functions delegated under this part and to protect the public health and prevent disease.”

Taken together, these provisions provide ample authority for issuing the press release. If so, the next question would be whether confidentiality provisions in Michigan or federal law would prohibit the release of personally identifiable information.

Privacy/Confidentiality. The Public Health Code provides broad power for the local health department to obtain information, including private information, for the investigation of an outbreak and to conduct contact tracing. In this regard, the health department “may inspect, investigate, or authorize an inspection or investigation to be made of, any matter, thing, premise, place, person, record, vehicle, incident, or event” in carrying out its duties. Local health department investigators who present their identification MUST be promptly provided with medical, epidemiologic, or other information relevant to a public health investigation. This includes, but is not limited to, information about persons who may be a health threat to others, who may have been exposed to a disease or whose information is needed for an investigation. MCL 333.2446 R. 325.174(2)-(3).

Ideally, it would be better to avoid disclosing private or confidential data. In this instance, that may not be possible, since the individual with the information refuses to provide it.

The Communicable Disease Rules require that identifiable information obtained by the health department be kept private, and protects identifiable information against public requests for it:  

R 325.181 Confidentiality of reports, records, and data pertaining to testing, diagnosis, care, treatment, reporting, and research.

Rule 11. (1) This rule applies to the communicable, serious communicable, chronic and noncommunicable diseases, infections, and disabilities listed and maintained by the department as required in MCL 333.5111 (1), except for human immunodeficiency virus (HIV) infection and acquired immunodeficiency syndrome (AIDS).

(2) Medical and epidemiological information that identifies an individual and that is gathered in connection with an investigation is confidential and is not open to public inspection without the individual’s consent or the consent of the individual’s guardian, unless public inspection is necessary to protect the public health as determined by a local health officer or the director.

(3) Medical and epidemiological information that is released to a legislative body shall not contain information that identifies a specific individual.

An individual’s address is epidemiological information connected to an investigation that identifies the individual. Although public inspection is not defined, it is reasonable to interpret the term as including publishing the information in a news release. In conjunction with what follows under HIPAA and the previous discussion of the health officer’s grant of authority, we do not believe that Rule 11 prohibits the disclosure of personally identifiable data.

HIPAA. Even if the county health department is a fully covered entity under HIPAA, and the information to be released would be considered “protected health information (PHI),” HIPAA permits disclosure of PHI if necessary to avert a serious threat to health or safety of the person or to the public. The disclosure must involve someone the covered entity believes can prevent or lessen the threat, and may include the target of the threat. See, 45 CFR 164.512(j), which reads in relevant part as follows:

(j) Standard: Uses and disclosures to avert a serious threat to health or safety

(1) Permitted disclosures. A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure: 

(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and 

(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or 

(ii) Is necessary for law enforcement authorities to identify or apprehend an individual…

In short, if HIPAA applies, it would not be a barrier to the proposed press release. See also, the attached memo from MDHHS Director Robert Gordon on HIPAA disclosure.

Must I? Nothing in Michigan law requires the suggested disclosure. Doing so is within the health officer’s discretion and is a policy decision.

Addressing the Policy Aspects

Should I? The answer to should I remains entirely within the health officer’s discretion. We would not presume to advise you on exercising your discretion, but offer the following comments for your further consideration.

As a general proposition, in the context of disclosing COVID-19 information, health departments should assess whether the press release is intended to avert a serious threat to health. Does the health department need the public to respond differently to the COVID-19 threat once a particular source of COVID-19 exposure is identified as having an active case? Health departments should establish a nexus between the information disclosed and the intended action by recipients of the information that will prevent or lessen the threat of COVID-19 spread.

Nevertheless, we would be remiss if we failed to acknowledge that these are not normal times. Nationally, public health officials have been attacked and threatened for enforcing COVID-19 mandates. Publishing a name or address associated with an individual is certainly more sensitive than for a business location and may have unintended consequences (including escalation of hostility toward public health, threats to members of the household, or the person who hosted the party, and generally accusing the government of interfering with their civil liberties).

For that reason, we would be happy to discuss other options that might achieve the same result without exposing the health department to external threats. For instance, another Michigan county health department responded to a similar episode in a small community but decided not to disclose the exact location. Even then, it appears that community members could figure out or knew who hosted the party and the host received threats as a result. In sharing this information with you, we take no position on what the appropriate approach should be.

In response to previous similar requests, we have encouraged health officers to consider the following questions in evaluating whether proposed disclosure to the media is advisable

1. Has the health department documented the factual analysis and thinking that led it to the decision to disclose or not?
2. Who at the health department formed the good faith belief under 45 CFR 164.512(j)? Is it the product of professional judgment based on professional services? What are the individual’s credentials? 
3. What is the context for the belief? Is it based upon the statement or action of a particular individual?
4. What are the alternative options that would achieve the same result without disclosing individually identifiable data?
5. Does state law provide a more stringent standard?

Likewise, the Association of State and Territorial Health Officials, the National Association of County & City Health Officials, and the Association of Health Care Journalists developed guidance regarding the release of information concerning deaths, epidemics or emerging diseases. This guidance may assist you in framing the press release.

Enforcement. For enforcement, certainly a court order or warrant is an option and might be useful for ensuring the legitimacy of releasing the specific location. But if the party host is concerned about privacy, the media would no doubt cover any sort of court filing unless the health department successfully requested sealing the order in the interests of privacy. The health officer could issue an order but might ultimately still be in court to enforce it; in the interim, the exposure clock is ticking.

The Network for Public Health Law provides information and technical assistance on issues related to public health. This memo should not be considered legal advice or representation. For legal advice, please contact your attorney.