Bay Area Reporter - May 11, 2001
David Fraser

At issue: how secure your identity is once the mandatory reporting of new HIV cases takes effect.

Fresh regulations currently under review would ratchet up personal data collection by the state to help get a better handle on the HIV/AIDS epidemic. The rules would require all new HIV diagnoses to be reported to local health agencies, which then would report them to the Office of AIDS in the state Department of Health Services.

Top state health officials see the reporting as necessary to accurately analyze trends in seroprevalence and overall epidemiology, to focus program efforts, and to keep federal funding.

But critics say that the protections promised by the rules are flawed in their attempts to guarantee privacy of individuals and ripe for misuse or abuse.

The state will hold a hearing on the proposed rules at 10 a.m. this Wednesday, May 16, at 714 P Street, Sacramento. Public comments may be made; the overall 45-day comment period will end May 21 at 5 p.m.

No names are good names?

The new system would use a complex no-names code called a unique identifier. It encodes pieces of people's surname, keeping the last letter of the surname, and includes birth date and part of their Social Security number.

"We are developing a system that should be invisible to clients completely, so they can go in and get counseling and referrals, if needed," Vanessa Baird, deputy chief of the state Office of AIDS, told the Bay Area Reporter. "It affects only confidential testing sites, not anonymous ones. We very much support anonymous testing as an important option."

Mandatory HIV case reporting would bring California in line with the vast majority of states.

As written, the new rules require health providers from HMOs to local clinics that do confidential testing to leave names off the forms when reporting new HIV cases.

"If the name is mistakenly on a report," said Baird, "we would ask local health jurisdictions to destroy it. We ourselves would shred it. We don't want names; we're not trying to get the names."

She said the state is interested in preventing accidental dissemination of data that could identify people and is "very strict" on keeping information private.

"All state and local staff in AIDS surveillance also do HIV surveillance, and they all are trained in current laws. These are very clear about protecting against the inappropriate disclosure of HIV results. They know that the law protects clients, and that there are penalties for violation."

Also, Baird said, "We require that workers sign confidentiality agreements. If they have documents, these are locked in a briefcase, not left in cars. The documents go back to work sites in separate locations from staff, so the data are secure."

As well as HIV diagnosis and unique identifier, the proposed state reporting forms require clinicians to provide your DHS patient number; lab report number; race/ethnicity; country of birth; city, county, and Zip code of residence at time of diagnosis; facility of diagnosis; plus some information on sexual history, intravenous drug use, insurance, and treatment.

Cracking codes

A skeptical view comes from Professor Latanya Sweeney of Carnegie-Mellon University, an expert on privacy issues and the robustness of coded identifiers.

"To what extent is the promise of privacy at odds with the state's needs?" Sweeney asked in an interview with the B.A.R. "A lot of states claim that HIV testing should only be done anonymously. By that, I mean that nothing I can do to the data, using readily available information, could identify an individual.

"This [proposed] code in combination with other data collected will not meet that criterion, due to the ease of identification."

Sweeney added that her research shows that most people can be personally identified through a very simple set of factors including gender and Zip code.

Proponents of reporting say there has been virtually no harm done, even in the states where names of HIV-positive persons are reported.

The exception is Florida, where a high-profile 1997 case highlighted the system's fragility after the names of AIDS patients were released at a state agency.

Among the many larger issues is whether coded reporting of HIV cases would deter people - especially those who may fear exposure.

A 1998 multi-state study of new AIDS cases in the Journal of the American Medical Association (Bindman et. al.) found that "The mean time from learning they were HIV-positive to the diagnosis of AIDS was 1,246 days for persons tested anonymously versus 718 days for persons tested confidentially."

The study, which did not include California, concluded: "Anonymous testing contributes to early HIV testing and medical care."

Alameda and anonymity

"This [proposed] system seems to really ask for everything but your name," said Susan Black, HIV testing and HCV coordinator at the Alameda County Office of AIDS. "I'm concerned that the state health department is mixing apples with oranges, and may use the reporting system for gathering other information."

Black said Alameda County "still has a growing epidemic. Among the disenfranchised people in the county, it's hard to convince people to get tested. If you're an IV drug user, there's more important things you're focused on. You're probably going to think if you test positive, your drug habit may be exposed.

"I am really opposed to anything that creates a barrier to testing, anything that makes testing other than what it should be is going to backfire, especially the new regulations.

"Among people of color, we have a 5 to 7 percent HIV infection rate in Alameda County, specifically among African Americans who are tested. Anything we can do to lower the barriers to testing is really good."

Avoiding duplication

Paradoxically, considering the potential damage from exposure of HIV-diagnosed persons, reporting by name is nothing new. Diseases from measles to tuberculosis to AIDS are reported by name in many states. California's proposed new rules on reporting of HIV cases would assign a non-name code unique to each individual who tests positive for HIV. Health care providers such as hospitals, clinics, and laboratories would be required to use the code when reporting new HIV cases to public authorities as the new regulations mandate.

The Department of Health Services proposal (regulation control number R-19-00) notes that officials considered and rejected the options of reporting by name, by a hybrid of name and code, and reporting without any identifier at all. The proposed code meets Centers for Disease Control and Prevention guidelines.

California law prohibits reporting the name of an HIV-infected individual "except under special circumstances." AIDS cases, on the other hand, must be reported by name.

The idea of a hybrid name and code meant that infected persons' names would go to local health departments such as the San Francisco Department of Public Health. They would encode the name and destroy evidence of the name, simplifying procedures and helping avoid duplication of case reports.

DPH concerns

Dr. Sandy Schwarcz, director of the AIDS surveillance unit at DPH, said she had not yet evaluated how well the proposed codes protect identities. "I do think that DHS should do this prior to adopting the codes," Schwarcz said in a statement to the B.A.R.

Asked about increased workload, she added: "It is difficult to determine how much extra work and time will be taken up with HIV reporting. We estimate that we have approximately 8,000 people living with HIV infection but not AIDS. Most are in care and we will need to complete reporting forms for these people.

"This will double our work load for a couple of years. After that things will slow down somewhat but I am not sure just how much extra work will be involved once the initial case report forms are in."

In fact the new rules are designed to cover only new diagnoses.

Laboratories getting test orders would have to report back to local public health officers all HIV-positive results, plus data that includes gender, birth date, and first and third letters of patient's last name (or DHS client number).

"What if your last name is Ng?" asked a local HIV specialist at a San Francisco clinic, ironically alluding to a common last name among Cantonese-speaking ethnic Chinese here.

The proposal is modeled on encoding used in several states; others report names.

Reporting without identifier creates the probability of duplicate case reports for the same individual, and could potentially lead to inflated numbers of case reports.

A state spokeswoman said if the rules, which do not require legislative action, are approved, it will still be several months before they take effect.

CDC guidelines

The CDC is critical in this issue because it sets guidelines for public health research and provides considerable funding for HIV/AIDS - and numerous other illnesses - to state and local health agencies.

State and local officials take very seriously the CDC guidelines because they put their agencies explicitly at risk for funding cuts if they don't follow the rules. The regulation proposal mentions the need for California public health to maintain its competitiveness for federal funding.

Beginning in 2005, the proposal states, funding under the federal Ryan White Comprehensive AIDS Resources Emergency (CARE) Act will depend on "the number of estimated living HIV and AIDS cases, rather than estimated living AIDS cases alone."

In 2004, the secretary of Health and Human Services will decide if a state's reported cases, channeled through CDC, are "unreliable or inaccurate." If so, subsequent funding will count only AIDS cases.

Now, it often takes 10 years for HIV to become AIDS.

Atlanta's requirements - that is to say, Washington's - thus are drawing an ever thicker line on the playground of medical politics. Agencies and states that step forward to challenge the pecking order could get a federal fist in their fiscal nose.

The DHS proposal sets aside $1.43 million for California fiscal year 2000-2001 to help local health departments carry out the federal mandate on HIV reporting. The CDC has granted the Office of AIDS $500,000 to study effective types of coding. One major concern is duplication, which local health departments will be expected to help weed out.

Range of reactions

A University of California, San Francisco researcher familiar with the HIV privacy issue was highly critical of the new regulations, on condition of anonymity: "The state Office of AIDS told us where they feel the biggest possible mischief might occur is at the local level. We agree.

"There's no question that in smaller communities, where [health] workers have closer relationships with law enforcement and health in a variety of other services, leakages will occur.

"There needs to be anonymous, truly anonymous testing. And there needs to be, in the case of HIV reporting of a confidential test, a way that people cannot be backtracked by the use of information."

Among the critical broader issues raised by the overall public health versus privacy question is what to do if you test positive. This gets at the heart of the moral and professional dilemmas faced by people being tested and the public health establishment.

The UCSF researcher said, "Many states retain anonymous testing as an important way to help people feel secure if they test positive. The problem is, if you want help after testing positive, you need to go to other agencies or clinics for help. Most people don't realize that a great deal of their medical data are already being reported.

"My concern about no-name testing is they've chosen identifiers which can be so easily linked to a person's name. It's scary to me with the shift in the political climate that the foundations are being laid for potential mischief at increasingly higher levels [of government]. And to have state and national databases that can so easily be linked to specific individuals is a very powerful tool that can, in my opinion, only be misused."

The CDC, the researcher added, "has spent a lot of time creating compatibility between the states. They already are sending in technical support. CDC has worked to have a system that can identify individuals concerned. There is reliance on people's names, birth dates, and Social Security numbers."

The researcher concluded, "To truly have this be a public process, the state needs to extend the public hearing dates. I'm concerned about the lack of public awareness on this issue.

"Nobody has the time to put this stuff together [for analysis]. It's very clear by the way they set this up that they don't want feedback. The hearing process has no intention of responding to anyone's concerns."

Good for whom?

Robert Kim, staff attorney with the American Civil Liberties Union of Northern California, was cautiously optimistic: "We are always vigilant on government storage of sensitive private data and sensitive medical information. We share those concerns [about exposure].

"There could be the possibility of abuse or people not following the system properly. There's always a balance between the need for information and the need for privacy. For the time being I think the [proposed] system falls in the range where both concerns are being met. But this is not set in stone forever."

"Some unique identifier systems are pretty easy to crack," said Steve Gibson of the Stop AIDS Project, speaking for himself only. "I hope this one is not. The qualitative data suggest that people are less likely to be tested if they think they can be identified.

"I personally go to anonymous sites to be tested. I asked my doctor and she said, 'Test anonymously.'

"But public health is also critically important. I appreciate that California is trying to prevent names reporting. Whatever system is put in place, you have to have community-based agencies who are trusted, like the Mission Center, the AIDS Health Project ... they will be key as to whether people get tested or not.

"Using the non-names code may push people who are not comfortable to not get tested ... for example, the Mission Neighborhood Health Center works with a lot of undocumented residents, who may have more pressing issues that they don't want made public.

"Also, the political climate can change; it's in flux, especially at the national level."

Weighing relative risk

At the San Francisco AIDS Foundation, Dana Van Gorder, director of state and local affairs, focuses on the relative values of testing and reporting.

"At the AIDS foundation, advocacy groups need to make damn good and sure this information is guarded to the utmost," Van Gorder said. "I don't think it can be guaranteed 100 percent effective, but it is important to make health care good.

"The state has a very good track record. We need to be vigilant, but there's certainly a commitment to a high level of confidentiality."

Many names of people who are HIV-positive without AIDS are maintained on a variety of lists, including ADAP services, Van Gorder said. "The Office of AIDS has done an effective job of maintaining confidentiality around California for the most part."

The key, he said, is that "people who think they're at risk should get tested, whatever the setting. This is true if you compare the potential risk of not knowing your status with the risk of breach of privacy. It would be unfortunate if people used the [proposed regulations] as an excuse not to get tested."

The state AIDS office Web site is

http://www.dhs.cahwnet.gov/ps/ooa/ooaindex.htm.

The regulations can be downloaded at

http://www.dhs.cahwnet.gov/ps/ooa

/Programs/Epidemiology/HIVReporting/HIVReporting.h
010511
BR010505

Always watch for outdated information. This article first appeared in 2001. This material is designed to support, not replace, the relationship that exists between you and your doctor.

AEGiS presents published material, reprinted with permission and neither endorses nor opposes any material. All information contained on this website, including information relating to health conditions, products, and treatments, is for informational purposes only. It is often presented in summary or aggregate form. It is not meant to be a substitute for the advice provided by your own physician or other medical professionals. Always discuss treatment options with a doctor who specializes in treating HIV.

Copyright ©1980, 2001. AEGiS. All materials appearing on AEGiS are protected by copyright as a collective work or compilation under U.S. copyright and other laws and are the property of AEGiS, or the party credited as the provider of the content. .