The Health Insurance Portability and Accountability Act’s (HIPAA) Privacy Rule allows sharing of PHI to law enforcement officers, paramedics, and 911 dispatchers under certain circumstances, which was outlined by the HHS’ Office for Civil Rights in a March 24, 2020 guidance document, COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities.
In the document, OCR outlined that “HIPAA permits a covered county health department, in accordance with a state law, to disclose PHI to a police officer or other person who may come into contact with a person who tested positive for COVID-19, for purposes of preventing or controlling the spread of COVID-19. 45 CFR 164.512(b)(1)(iv).” OCR also explained that “disclosing PHI such as patient names to first responders is necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public.”
While the disclosures are allowable, the County Health department said on Friday it will not share that information as it violates the privacy of patients and instills a false sense of security for first responders, who must assume that every home they visit could house a person who has contracted COVID-19 and could transmit the coronavirus. The Country Health Department recommended first responders should take the same precautionary steps with all interactions with the community.
MCDH released a statement which read: “In MCDH’s professional public health opinion, given what we know about how this disease spreads, the general lack of testing, epidemiological data and the stay-at-home order, providing the personal names of cases exceeds the minimum information needed to protect law enforcement.”
A number of law enforcement agencies in McHenry County took legal action to force the County Health Department to disclose the information to better safeguard first responders. Two lawsuits were submitted, one on behalf of four police departments in the County and the other by the County Sheriff’s office. The police department lawsuit requested information be shared with the McHenry County Emergency Telephone System Board. That would ensure that any officers attending the incidents would be made aware if they need to take additional precautions. The County Sheriff argued in its legal action that it was not possible for officers to take the same precautions with every interaction with a member of the public as there was not enough personal protective equipment available.
On Friday evening, a temporary court order was announced requiring MCDH to disclose the data. In the ruling, it was explained that “The availability of the names at issue best enables police officers to do their job and protect the community to the fullest extent of their ability.”
Due to the court order, MCDH will start providing the names of patients, on request, but only to dispatchers on a call-by-call basis. MCDH has asked to have the “tightest control” applied to any information that is shareed, to protect the privacy of its patients.