Whenever someone in the USA tests positive for certain diseases with substantial public health impact, information about that person is reported to the appropriate state and local public health agencies. Until this month, California had been one of a dozen or so states that reported HIV infections without revealing the name of the patient; patients were instead identified by a code number assigned by the testing organization.
Due to passage and signing of Senate Bill 699, California now "require[s] health care providers and laboratories to report cases of HIV infection to the local health officer using patient names." The Bay Area Reporter reveals that prominent California public health organizations finally dropped their opposition to the switch. Why? Threats from "federal health officials . . . to drastically reduce California's allotment in HIV funding from Washington if it did not change reporting systems" no doubt hit home in cash-strapped California. Data from "other states that made a similar switch and saw no adverse impacts on privacy or drops in HIV testing" is also reported to have helped win over some San Francisco-based AIDS organizations.
I wonder whether the study reports on whether the test subjects actually knew that some states reported names and some states didn't, or whether people simply trust their public health agencies. After all, California has collected the names of patients found to have active tuberculosis for years, and many categories of California employees must be tested for TB annually by law.
The law creates civil and criminal liability for inappropriate disclosure under a range of circumstances, including for inappropriate disclosure of electronic medical records and inappropriate disclosure via electronic communications. In a broad exception clause, though, the law states that disclosure to a "person reasonably believed to be the spouse, or to a person reasonably believed to be a sexual partner or a person with whom the patient has shared the use of hypodermic needles, or to the local health officer" cannot create civil or criminal liability. How is this not at least partially preempted by HIPAA's confidentiality laws?