The McHenry County Health Department in Illinois were not providing 911 dispatchers with the names of COVID-19 patients to safeguard patient privacy, just as what they do with patients that caught other infectious diseases like hepatitis and HIV.
Under the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy Rule, PHI may be disclosed to law enforcement officials, paramedics, and 911 dispatchers in particular situations. In March 24, 2020, the HHS’ Office for Civil Rights provided a guidance document entitled COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and public health authorities.
It was explained in the document that the HIPAA allows a covered county health department to disclose PHI to a police official or other individual who might get in touch with someone who tested positive for COVID-19 in order to prevent or control contracting COVID-19, as per 45 CFR 164.512(b)(1)(iv). OCR additionally stated that it is necessary to disclose PHI including patient names to first responders to avoid or minimize a serious and impending threat to the wellness and protection of an individual or the public.
Although the disclosures are allowable, the County Health Department reported on Friday that it won’t disclose that data because it violates patient privacy and gives first responders a false sense of security. First responders should presume that the person living in the home they go to is infected with COVID-19 and may transmit the virus. The Country Health Department advised first responders to take similar precautions as with other community interactions.
Based on MCDH’s professional public health opinion, considering what is known with regards to the way this disease spreads, the basic insufficiency of testing, epidemiological information as well as the stay-at-home arrangement, giving the personal names of cases goes beyond the minimum data required to safeguard law enforcement.
A number of law enforcement agencies located in McHenry County filed a lawsuit to compel the County Health Department to disclose the data to give better protection to first responders. MCDH is currently facing two lawsuits, one was filed on behalf of the County’s four police departments and the other was filed by the County Sheriff’s office. The lawsuit by the police department seeks the release of the data to the McHenry County Emergency Telephone System Board to ensure that the responding officers would be alerted in case they ought to take extra safety measures. The County Sheriff contended in its lawsuit that officers cannot take similar precautions in all public interactions because the personal protective equipment available are not enough.
The court issued a temporary order asking MCDH to disclose the data. It was explained in the ruling that making the involved names available helps police officers do their job well and secure the community.
Because of the court order, MCDH is going to begin giving patient names upon request, though only to dispatchers on a case-to-case basis. MCDH has required the tightest control when disclosing any information to secure patient privacy.