Your ketchup is safe, but what about your privacy?

Two stories have been circulating the internet concerning HIV databases. One turned out to be a hoax, the more disturbing one didn’t.

As the Arkansas News Bureau reported yesterday, an email warning of possible HIV-infected blood in the ketchup of a fast food restaurant is a hoax. According to the circulating email, which appears to come from a state Department of Health and Human Services employee, an HIV-positive man was caught putting his blood in a ketchup dispenser. But Department officials explain this is an urban legend that’s been around since 2004 and isn’t true. In addition, the employee listed on the email has no access to the closely guarded medical records of the department’s HIV program, said DHHS spokesperson, Julie Munsell. Barbara and David P. Mikkelson explain the history and medical fallacies behind this internet hoax at their popular Urban Legends Reference Pages.

The second story circulating the internet is true.

Health departments in all 50 states will soon be tracking everyone with positive HIV tests individually, using their full names. Anonymous patient code identifiers will no longer be accepted. To force compliance, any agency not using name-based surveillance records will have their federal funds for HIV/AIDS care cut off, according to new provisions in the Ryan White CARE Act. As a Kaiser Family Foundation HIV/AIDS Policy Fact Sheet explains, $13.2 billion in the 2007 federal budget will go towards health care for those with HIV/AIDS alone, mostly provided through Medicare and Medicaid. This is significant money and has proven to be effective pressure with state and metropolitan agencies that the government needed.

As part of our continuing coverage of medical electronic databases and privacy issues, this is worthy of note because it affects all of us. According to news reports:

HIV patient names to be tracked

The names of people infected with HIV will be tracked in all 50 states by the end of 2007....The states are bowing to federal pressure so they won't lose money for medications and health services for patients. This is the first year federal funding has been tied to names-based surveillance of HIV. More than $1.4 billion in federal money will be distributed this fiscal year based on new formulas that include numbers of people with HIV counted by states using names. In some states, including Illinois, millions of dollars are at stake.

[Advocates] still worry that collecting names will deter some people from getting tested and seeking treatment, and about the possibility of names being released due to security breaches. “I have patients who are very high-profile individuals - physicians in practice, people who are politicians" who don't want their real names reported, said Dr. Dan Berger, medical director of NorthStar Healthcare in Chicago's Lincoln Park.

In a 2005 security breach in Palm Beach County, Fla., the names of 6,500 HIV and AIDS patients were mistakenly e-mailed to 800 county health workers. Other security breaches have occurred in California and Kentucky. Some worry that names-based reporting could have the greatest effect on whether minorities and the poor get tested and treated because they may be less likely to trust the government to keep their names secret....

Some states, including Illinois, and the city of Philadelphia previously tracked HIV with identifying codes that preserved anonymity and were unique to each patient. Illinois' code-based system was "instituted to protect people's confidentiality because of fears of stigmatization and potential disclosure to insurance companies and family members," said Dr. William Wong, medical director of the AIDS division of the Chicago Department of Public Health.

Illinois started names-based HIV surveillance Jan. 1, 2006, because of federal pressure....For now, public health officials are trying to reassure people who test positive for HIV that stiff security measures protect state databases of names.

A similar story made the news last year when Massachusetts, facing cuts in federal funding of $15 million, adopted its HIV reporting system using people’s names:

State may track names in HIV registry

...After years of using a confidential code-based reporting system to track HIV-positive patients, the state plans to implement the new name-based system by fall of this year. The federal government has put pressure on states that use code-based reporting... to implement a single, uniform system for tracking HIV cases that uses names instead of codes...

"The name-based system makes it easier to make sure that everyone gets counted individually," said Brigida Guyot, HIV counselor and tester at La Clinica del Pueblo, a Washington, D.C.-based clinic....However, Guyot said that the major drawback for a name-based system would be guaranteeing patient confidentiality, which could potentially be a deterrent for people who may want to get tested, especially when many of those at risk are illegal immigrants. “People are deeply concerned about their confidentiality with HIV," said Denise McWilliams, director of Public Policy and Legal Affairs for the AIDS Action Committee in Massachusetts. “The switch to reporting by name is going to discourage some people from coming in to get tested."

The Rogers Law Firm in Boston recently sent out a client advisory to physicians, informing them:

On November 14, 2006, the Public Health Council of the Massachusetts Department of Public Health voted unanimously to require physicians in Massachusetts to report to DPH the name of any patient who tests positive for HIV. The requirement will go into effect on January 1, 2007. Physicians in Massachusetts are already required to disclose the names of AIDS patients to DPH. However, up until now HIV cases were only reported using a code. DPH has stated that the basis for requiring physicians to disclose the names of HIV patients was in response to threats from the Federal Center for Disease Control to withhold approximately $15 million in funding for the state. The federal government is placing increased pressure on states to adopt uniform HIV reporting standards.

Pursuant to the HIPAA Privacy Rule, a physician is permitted to disclose protected health information to a public health authority without the written authorization of the individual or without providing the individual with an opportunity to agree to object to such disclosure.

And last spring in California, with more than $50 million annually in federal funding for HIV/AIDS care at stake, the Governor signed into law its HIV reporting law. In it, the “California Department of Health advises that health care providers, laboratories, and LHDs report cases of HIV infection by name if an HIV-related laboratory test has been performed on or after April 17, 2006.”

Schwarzenegger Signs Bill to Track HIV Cases by Name

The shift will ensure that California continues to receive more than $50 million annually for HIV/AIDS care from the federal government, which has ruled that code-based reporting is unreliable. With at least 38 states already signed on to use patient names, California is one of a handful of states still using alphanumeric codes to identify HIV cases. The bill, sponsored by Sen. Nell Soto (D-Pomona), unanimously cleared the state Senate and Assembly and was lauded by health officials around the state....

Under the code system, enacted in July 2002, healthcare providers and labs reported HIV infections to local health agencies and the state Department of Health Services using codes created from birth dates, gender and elements of the patient's last name. The practice of using codes was created to ensure patient confidentiality, but proved to be a bureaucratic nightmare for health officials....

According to new provisions in the Ryan White CARE Act, which provides funding to states and metropolitan areas for HIV/AIDS care, states using patient codes will no longer be eligible for funds, which will be allocated later this year....without switching to names-based reporting, California is "likely to lose an enormous amount of funding," Curtis said.

These developments won’t be news to those who’ve followed this issue for many years, but may be to many readers. The debate began when the CDC first issued its Guidelines for Improved Data on U.S. HIV Epidemic to “track the course of the HIV epidemic.” Its 1999 press release stated:

... To address the need for information to ensure effective targeting of prevention services, in September 1997, CDC called for all states and territories to conduct HIV case surveillance as an extension of their AIDS surveillance programs.....

Based on published evaluations to date, CDC has concluded that name-based HIV surveillance systems are currently the most likely system to meet the necessary performance standards and provide the quality data necessary to direct community prevention and treatment programs. CDC therefore advises that state and local surveillance programs use the same name-based approach for HIV surveillance as is currently used for AIDS surveillance nationwide.

The CDC’s recommendations for name-based registries were not without controversy within the medical community, either, and were widely debated in the medical literature from the get go, such as a 1999 issue of the British Medical Journal.

However, government officials, such as Julie Gerberding, director of the CDC, have been telling state agencies that because of the HIV epidemic it was critical to move as quickly as possible to adopt name-based reporting registries. According to the government, name-based tracking systems are more accurate and efficient than alternatives. This point has been criticized by groups such as the American Civil Liberties Union, which reported that non-name-based HIV monitoring programs using random, unique alpha-numeric codes to ensure privacy, have already proven successful.

Christopher Anders, a legislative counsel for the ACLU, lamented: “The clear weight of scientific studies shows that mandatory names reporting discourages people from getting tested for HIV....Why the CDC is proposing guidelines that violate basic privacy rights — and run counter to the weight of public health research — is simply incomprehensible."

Initially, the CDC allowed “for flexibility if states wish to implement alternative systems.” A 1998 CDC study had found that 19% of gay men cited fear of their name being reported as a reason they hadn’t been tested. The CDC recognized the problems with name-based registries in its original guidelines and said the “CDC has and will continue to provide financial and technical assistance to states working to design systems that rely on codes or ‘unique identifiers’ rather than names.” It went on to say:

CDC continues to strongly support anonymous HIV testing and recommends that all states provide anonymous testing options. CDC studies indicate that the lack of anonymous testing serves as a deterrent to testing in some high-risk populations. Unless prohibited by law, CDC requires that states receiving prevention funds make anonymous testing available in order to make testing as accessible as possible. Maintaining anonymous testing sites is important for prevention efforts and will not seriously inhibit our ability to track the epidemic.

Most people are diagnosed with HIV infection in care settings where their identities are known, and CDC recommends that individuals who test positive in anonymous settings be promptly referred to treatment and prevention services. Maintaining an anonymous testing option may help ensure that more individuals learn their status, and if infected, seek early treatment and care.

By the late 1990s, 34 states and the Virgin Islands had already implemented HIV surveillance registries. When the Illinois Department of Health established its statewide registry using the names of everyone testing positive for HIV; similar to registries for syphilis and gonorrhea; its provisions allowed for anonymous testing for those who didn’t want their names reported. Even so, the Chicago Tribune reported concerns very similar to those noted by the CDC:

Plan to Track HIV Raises Questions Loss of Confidentiality May Deter Testing for AIDS

[AIDS activists] raise several ethical issues regarding confidentiality. They contend that instead of helping to stop the spread of the disease, the requirement would actually deter people from getting tested and thus keep them from seeking counseling and medical care.

The issue is muddied by fears that such a registry could someday be accessible to insurers, the courts or employers.

“Once you add this element of name reporting, you introduce an element of fear," said Robert Rybicki, assistant commissioner of HIV/AIDS Public Policy and Programs for the Chicago Department of Public Health. “This disease, unlike any others, has ramifications for people," Rybicki said: “They can lose their job, they can lose their housing and they can lose their health insurance. As a disease, it's in a pretty unique category.”

As it turned out, despite the CDC’s initial allowance for anonymous reporting, it proved a moot point. After starting names reporting, many states had eliminated anonymous testing, according to the ACLU.

Advocates for the decision by the Tacoma-Pierce Country Health Department in Washington to do so said name registries were needed “as part of an aggressive effort to fight the epidemic....with such standard epidemic-fighting tactics as contact tracing, follow-up counseling and long-term case management” by the state. An un-bylined editorial said names would be “carefully guarded from public disclosure under CDC-recommended security guidelines.”

Assurances over privacy protections made by the CDC in its Guidelines were hardly reassuring to opponents. It stated that the Service Act governs how the government can use or release the data, saying it can only be used for public health purposes. “Most states also have specific statutory protections for public health data related to HIV,” it said. “However, state legal protections vary widely.”

With recent news, discussions are raging at boards of professional and HIV/AIDS patient advocacy groups, with growing concerns that these lists of names could be used by officials in over-reaching ways, such as targeting people for “forced medications.” Concerns are also being voiced about potential breaches of confidentiality and disclosures to insurers, the courts or employers. They also worry, as the CDC found back in 1998, that the inability to maintain anonymity could prove to be “devastatingly effective and a major argument for ‘don’t get tested.’”

You may think HIV issues are of no concern to you, but maybe they should be — whether your concerns are that people get the care and testing to help them, or over the Big Brother and privacy rights aspects. The distinction between public and personal health is becoming increasingly blurred. We might question the need for everyone’s name, address and phone number, and medical information to be on a government database and wonder where it will end. What next will be declared “a public health issue of epidemic proportions” and in need of government monitoring and mandatory interventions?

Already, in response to the “diabetes epidemic,” we’ve seen the creation of statewide diabetes registries. For example, mandatory electronic reporting of glycosylated hemoglobin (A1c) values by laboratories to the state Department of Health and Mental Hygiene was recently enacted in New York City. The mandatory program is without patient’s knowledge or informed consent, nor are people free to opt out, according to World Net Daily. Add to that, we’ve already had glimpses of how this information can and is being used by government officials. Pennsylvania’s new plan to manage “chronic illnesses, as described in a recent post, includes identifying and tracking those with diabetes first and putting them under state disease management. Are those with genetic tendencies towards high blood pressure or high “cholesterol” next? A number of states, including Maine and Colorado, have introduced legislation making all Medicaid and food assistance recipients, and state employees, who are deemed overweight be required to undergo weight loss interventions, including “behavior modification” and prescription drugs.

As Lawrence O. Gostin, director of the Center for Law and the Public's Health at Georgetown and Johns Hopkins universities, was quoted as saying:

Should the government be collecting this kind of information? Should it be intervening like this? You can imagine it getting to the point where you have a public health worker showing up at your door and asking, ‘Did you remember to exercise, eat right and take your medication today?’

© 2007 Sandy Szwarc