This guidance is intended to clarify guidance issued April 1, 2020 that may have caused confusion regarding the disclosure of COVID-19-positive persons to law enforcement and address questions that have been raised.
Guidance from the Illinois Attorney General
The Office of the Illinois Attorney General (OAG) was asked to address whether the Health Insurance Portability and Accountability Act (HIPAA) allows local health departments to provide information to law enforcement regarding individuals with positive tests for COVID-19. In response, on March 27, 2020, during a presentation to state’s attorneys, the OAG advised such disclosure is permissible because of a HIPAA exception. Specifically, the OAG affirmed the exception applies because “disclosure to first responders will enable them to use personal protective equipment (PPE) to reduce the risk of COVID-19 transmission.”
Public Health Background
Along with clarifying the legality of disclosure of this information, this guidance seeks to provide law enforcement with background information given that COVID-19 is widespread in Illinois. First, there are likely a large number of asymptomatic cases in each community that have not been confirmed by a test. Second, many people who are ill may not have been tested yet. Third, many who have tested positive are no longer contagious.
The safety of first responders and law enforcement is of paramount importance. Because of the limits on the usefulness of current test result information, the Illinois Department of Public Health (IDPH) recommends that whenever possible first responders and law enforcement take appropriate protective precautions when answering calls for service.
This document provides legal and infection control guidance to inform the decisions of local health departments (LHDs) that may be asked to identify persons with COVID-19 positive tests to first responders or law enforcement.
HIPAA and Additional Statutory Considerations
Many questions have arisen regarding legal authority and the role of the HIPAA Privacy Rule as to whether requested information can be disclosed (45 CFR Part 164). HIPAA may or may not apply to a local health department depending on whether it has any HIPAA covered functions and how it is designated.
HIPAA prohibits the use and disclosure of identifiable health information (known as “protected health information” or “PHI”) unless the rule requires or permits disclosure.
HIPAA also includes provisions that permit, but do not require, a HIPAA-covered entity to disclose PHI in certain instances, such as when necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public (45 CFR 164.512(j)). The disclosure must be consistent with applicable law and standards of ethical conduct and made to a person or persons reasonably able to prevent or lessen the threat. A covered entity must make reasonable efforts to limit the information used or disclosed to that which is the “minimum necessary” to accomplish the purpose for the disclosure (45 CFR 164.502(b)).
Additional Illinois laws apply to the disclosure of information related to COVID-19 cases by LHDs, including, but not limited to, the Department of Public Health Act, 20 ILCS 2305/2.1 (regarding sharing with law enforcement for criminal or prosecution purposes), and the Communicable Disease Code, 77 Ill. Adm. Code 690 (regarding confidentiality of information that would identify patients).
Specific Guidance Regarding Infection Control Considerations
Providing first responders and law enforcement with the identity of positive COVID-19 individuals has limited epidemiologic and infection control value, since there are likely a larger number of asymptomatic and cases that have not been confirmed by a laboratory in each community. Providing this information also could give first responders and law enforcement a false sense of security, as many people who are ill may not have been tested. Additionally, many who have tested positive are no longer contagious.
The safety of first responders and law enforcement is of paramount importance. Because of these concerns, IDPH recommends first responders and law enforcement take appropriate protective precautions when responding to calls instead of relying on reports of COVID-19 positive individuals. To that end, the Centers for Disease Control and Prevention (CDC) has issued guidance for Modified Caller Queries for first responders to assess the likelihood the person may be experiencing symptoms of COVID-19 or may be under investigation for COVID-19.
Efforts to protect the identity of individuals and prevent stigmatization of patients also is a priority. If information regarding an individual’s COVID-19 status needs to be released, such disclosure should be minimized to only necessary individuals. Persons with a need to know this information should be provided with guidance on how to prevent further disclosure of the information.
Last Updated: 6/30/2020