January 11, 1999
The CDC's standard, first-line justification for the collection of HIV testing data is, briefly stated, that the advent of antiretroviral therapies has reduced the number of AIDS cases, that consequently the national AIDS case reporting system is no longer adequate to track the size and scope of the epidemic, and that the appropriate targeting of treatment and prevention resources hinges on securing the data which HIV test reporting will provide.(1) However, this threshold principal finds little or no support in available data or research. Moreover, frequent conflict between the original stated need for HIV test reporting and the labyrinthine proposals introduced to effectuate this, reveal a lack of clarity and agreement about what the uses of HIV surveillance data will or should be. While an important goal of HIV testing and counseling is to connect individuals to health care and other needed services, this is not the goal or even a likely outcome of HIV surveillance.
The CDC states that the purpose of its HIV surveillance proposal is "to gain more reliable information about the prevalence, incidence, and future directions of HIV infection and the impact on specific populations such as racial and ethnic minorities and women." CDC Draft Guidelines at 1. There is little reason to accept the representation that the goal will be served by these means. As a long-time expert in the field recently observed:
Unfortunately, HIV reporting does not serve our purposes of describing current HIV incidence or prevalence, since, in order to be reported, people have to seek healthcare (and be assessed for HIV infection) or have to seek counseling and testing for HIV at a non-anonymous testing site. Many people with HIV infection might not seek healthcare until they are aware that they are ill. That delay would range from weeks to years -- even more than 10 years -- after infection. Among those with HIV infection who seek healthcare for non-HIV related reasons, some will not be evaluated for HIV. A cross-section of those who seek healthcare or who seek HIV testing will not closely represent a cross-section of those who are HIV infected. The inner-city poor...are likely to be less represented than those with adequate health insurance who are also not alienated from the healthcare system. Thus HIV reporting will provide some picture of HIV prevalence, but not of HIV incidence in a community. Data on the prevalence of HIV infection will be inaccurate because of delays in seeking care or testing; incidence will really not be measured at all...
Alvin Novick, M.D., HIV Surveillance: What's Hot, What's Not, 13 AIDS & Public Policy Journal 51, 51-52 (Summer 1998).
The primary problem with reliance on HIV test reporting is the shocking shortage of data showing that it will work, i.e., provide a good picture of the scope of the HIV epidemic. While CDC epidemiologists insist that such data exist, they have yet to offer it to the public. Because a substantial percentage of people do not get tested or typically delay testing until long after infection has occurred, the value of HIV test reporting as a tool to measure the size of the epidemic is questionable. Other established methods of surveillance (e.g., anonymous seroprevalence surveys of STD clinic clients) would better determine the extent of HIV infection.
The larger question of why so few people exposed to HIV get tested has yet to be adequately addressed, but numerous studies show that name-based testing causes significant numbers of people to avoid testing. Statistics from New Jersey, which adopted mandatory name-based HIV test reporting in 1992, suggest the folly of relying on name-based HIV case reporting. As of September 1997, New Jersey reported 13,441 individuals living with AIDS (35,681 total cases, minus 22,240 known dead). However, New Jersey has reported only 12,955 cases of non-AIDS HIV. That is less than one-third of the CDC's conservative estimate of how many people actually are infected. Clearly, reliance on the inaccurate data which names-based HIV test reporting produces can suggest to policymakers that the HIV epidemic is far less extensive than more reliable means of estimating the size of the epidemic have suggested for years. Our fear, then, is that a names-based reporting system will further discourage testing in exchange for data that will be useless for its proposed purposes.
In theory, better data could serve the goals of convincing the public and public officials that the epidemic is not over, and of better targeting prevention and treatment resources where they are needed most. However, existing data about the increase in infection rates among young adults and the efficacy of syringe exchange programs in slowing transmission among intravenous drug users has done virtually nothing to foster federal government support of aggressive prevention measures targeting these groups, nor do all states that have adopted such testing appear to use it as a basis for their HIV prevention plans.(2)
The common assumption that current legal protections and systems are adequate to protect the confidentiality of HIV surveillance data, even if correct, does not address the heart of the issue as it affects the willingness to test: what is the perception of the protection government will afford to persons at risk of HIV infection? In determining whether a particular proposal such as names-based reporting of HIV test results will serve or undermine a specific public health goal, public perception is important. Perceptions among affected communities of the extent to which government entities can be trusted to protect their confidentiality and interests are as relevant as actual confidentiality laws and policies in determining the impact of HIV surveillance on testing behavior. Relying on legal protections of government-maintained surveillance data ignores not only the distinction between the letter of the law and the reality of the protection it affords, but more importantly, the relevance of individuals' perception of the law or whether they typically view public officials as friends or foes. For those who mistrust government or its enthusiasm for protecting them -- and people of color historically have good reason to do so -- reassurances about the safety of surveillance data will be unpersuasive.
The report of the Texas Department of Health on its experience with a unique identifier system, which acknowledges that a number of both clients and providers are unwilling to provide or report social security numbers for fear that the information will be misused or disclosed, only underscores this point. Most state HIV confidentiality laws have numerous exceptions to the general requirement of consent prior to disclosure, and the standard for issuance of a court order for disclosures outside of these exceptions allows for widely subjective judgments as to when the "need" for disclosure outweighs the subject's interests in privacy. Disclosures within the criminal justice system in particular are only loosely controlled. The incident involving Nushawn Williams in Chattaqua County, New York, in which Williams' picture was displayed in classrooms and broadcast on national television and the press, followed by numerous tabloid and mainstream press stories on "AIDS murderers," raised troubling questions on the ability or willingness of public health officials to control inappropriate exploitation of individuals' HIV-related records.
As University of California research psychologist Gregory Herek observed recently, public health officials and policy makers "may be underestimating the continuing importance of AIDS stigma in the United States" in their advocacy of new HIV case reporting and partner notification policies.(3) The University of California survey documented that "the public may be becoming more suspicious and less tolerant of those who contract the virus," and that the extent to which people with AIDS are blamed for their illness and deemed to have gotten what they deserve has increased.(4)The same survey showed that the percentages of persons who incorrectly believe that HIV can be transmitted through various types of casual, risk-free contact actually has increased in recent years.(5) These types of perceptions can cause incidents of discrimination against people with HIV to increase.(6)
The Herek study also is a telling indictment of the state of AIDS education in this country, and the state and federal public health officials responsible for it. The parallel rates of HIV ignorance and infection should be no surprise in view of the shocking silence of these officials in the face of dangerous political approaches to HIV: laws that criminalize spitting and consensual, protected sex; and bans on condom distribution and factually explicit sex education in favor of abstinence-only curricula.
There is ample reason to fear that the collection of names could be used, with the wave of a legislative pen, for purposes beyond monitoring the epidemic. The use of Social Security numbers offers a relevant lesson. When the Social Security number -- an example of a "unique identifier" -- was introduced in 1936, the federal government responded to citizen protests with assurances that individuals' identifying numbers would be used only for purposes of administering Social Security, and that confidentiality would be maintained. Today, the Social Security number is the country's most frequently used record keeping identifier, leading to increased fraud and invasions of privacy.
There already are disturbing instances of the easy legislative segue to misuse of AIDS-related surveillance data. In Texas, for example, the State Health Department provides HIV test results of persons charged with sex offenses to prosecutors for the purpose of enhanced criminal penalties. Illinois has adopted a measure, not yet implemented, which allows use of AIDS case reports to track down HIV infected health care workers.
In a February 6, 1998 report, the CDC acknowledged that "public support is critical to the success of public health programs and agencies." Because public perception and support of government health interventions are central to their success, the failure to appreciate the impact of class and social group differences on views of the value, and safety, of government intervention fatally flaws the current rationale offered to support a change to name-based reporting. Those who have had no experience with the criminal justice system, with reliance on government-sponsored benefits programs for subsistence or health care, or with having their family relationships monitored and judged by a government case worker, cannot comprehend the contribution of these experiences to the perception of government and the legal system as a hostile force to be avoided.
Adoption of any system of HIV surveillance which further discourages people at risk of infection from getting tested by ignoring the views of the communities the system targets is doomed to failure. It is critical that a proposal to significantly change current HIV surveillance reflect that reality.
Even those who support application of so-called "traditional" public health measures to HIV acknowledge that anonymous seroprevalence studies provide better surveillance data than name reporting.(9) Additionally, reporting methods that do not require names would better ensure privacy and confidentiality and reduce fears of nonconsensual disclosure. Other alternatives include unique identifier systems (where individuals are identified only by characteristics such as date of birth, gender, risk factor, or zip code) or delinked identification systems which allow individuals to choose their own, unique codes (like choosing an on-line internet alias or bank pass code).
In its intractable endorsement of names-based HIV reporting, the CDC has failed to explore creative alternatives, or to explain why on-line internet access services easily can accommodate millions of users who create, use and remember their own unique identifiers while such systems are beyond the abilities of medical and public health officials.The CDC should create a balanced, impartial, and qualified task force to study such alternatives before instituting a broad-based HIV reporting system which clearly threatens to undermine the very goals which the CDC exists to serve.
The recent HIV Testing Survey (HITS) and AIDS Patient Survey (APS) (hereinafter "HITS and APS Survey") funded by the CDC, while cited to support the claim that reporting is not a major concern, actually confirms that name reporting deters testing. One of five participants in that survey (19%) acknowledged name reporting as a reason notto get HIV testing. Given that about half of the people estimated to be HIV-positive in the United States do not know their serostatus,(12) a measure that reduces willingness to test to this degree is a serious public health concern. Moreover, the CDC acknowledges that the survey may underestimate concerns about reporting and fail to reflect actual behavior. The real issue is whether, when informed of name reporting, people will decline to test. An individual seeking HIV testing must be informed regarding the disclosure of test results before giving informed consent for the test.(13) Available data indicates that, when informed that test results are reportable by name to a health department, many people will not test.(14) The HITS and APS Survey participants were not surveyed at testing sites or at a time when they actually were seeking testing, and the survey indicated that many participants were unaware of their own state's testing policy (i.e., whether the state had anonymous testing, confidential testing with no name reporting, or name reporting). While this has been cited to support the claim that people are not concerned about reporting, it may more accurately reflect the quality or accuracy of counseling and information provided during pre-test and post-test counseling. Further, as the CDC essentially acknowledges, survey participants' stated intent regarding testing may not reflect their actual behavior when they seek HIV testing if they are accurately informed at that time about their state's HIV reporting law.15
People living with HIV and AIDS routinely experience housing discrimination, loss of employment, and refusal of treatment by health care workers.(16) HIV and AIDS are the only medical conditions other than mental health illness that insurance companies routinely target for limits on benefits not applied to any other catastrophic illness.(17) Twenty-seven states criminalize acts viewed as risking HIV transmission, making acts from spitting to sex a felony for someone who has a record of a positive test for HIV.(18) This kind of stigma and discrimination causes many people to avoid testing.(19)
Proponents of name reporting argue that such fears are unwarranted because laws protect persons with HIV from discrimination and public health officials will not breach confidentiality. These assurances are inadequate and largely unreliable. They cannot overcome people's fears of name reporting and general mistrust of governmental bureaucracies. Despite best efforts, there still exists a risk of illegal disclosures by individuals. For example, a computer disk containing 4,000 AIDS registry names was obtained illegally and sent to two local newspapers in St. Petersburg, Florida.(20) In California, two computers containing 60 AIDS registry names were stolen from the state Health Department.(21) There are numerous examples of smaller leaks by health care workers, police, and others with access to lists of names.(22)
Once names have been gathered, confidentiality can be ended by judicial, legislative, or administrative order or rule.(23) Existing confidentiality laws can be modified or repealed. The proliferation of oppressive HIV-related legislation proposed and enacted in many states in recent years validates this concern. For example, the Illinois General Assembly has enacted laws that: (a) require an HIV test as a condition for marriage;(24) (b) criminalize intimate contact by someone with HIV;(25) and (c) require identification of health care workers with HIV.(26) In 1997, the Illinois Department proposed an internal policy that would allow the disclosure of HIV-positive persons to the State's Attorney,(27) who could then prosecute such individuals under Illinois' Criminal Transmission Act.(28)More than half of all states have adopted laws criminalizing sexual and other conduct by persons based on their knowledge, through testing of their HIV status; severe criminal penalties attach in many instances even when condoms are used, no transmission occurs, or the criminalized act poses little or no risk of transmission.(29)
Dr. Herek aptly summarizes the risks of the reporting system which the Guidelines propose:
...Access to a list (of names) could be (and has been) gained by state law or by other legal authority. A state might, for example, pass legislation that anyone accused of rape or convicted of rape would be checked against a list of persons reported with HIV disease so that law enforcement authorities could decide whether to enhance the criminal charges. Or a state could pass legislation stating that no one reported as being HIV infected could obtain a license to marry or a license to be a barber or a beautician or a pharmacist. From another point of view, people who know themselves to be vulnerable to HIV or who are highly suspicious of authority or of the healthcare system might be fearful of seeking care or of being HIV tested if they knew they would be named and listed. That would be bad for them and for society.
I believe that some of the same accidental, inadvertent, or unwise violations of privacy could also occur -- or even be planned -- with the use of unique identifiers. If we put people at risk by collecting their names (or identities) and information about them that can be used against them, that is, if we violate a person's fundamental right to privacy, we ought to have a compelling reason. Unfortunately, we seem unable to identify that compelling reason.
Novick, HIV Surveillance: What's Hot, What's Not, 13 AIDS & Pub. Pol. J. at 52-53 (emphasis in last paragraph added).
The contention that names-based reporting is necessary to get people into medical care and services appears to be disproved by the CDC-funded HITS and APS Survey. That study indicates that contact by a health department is not associated with access to care.(33) People with HIV do not get into care after testing positive at sites where names are reportable any faster than after being tested at anonymous sites (where names are not used).(34)In fact, a recent study demonstrates that the contrary is true -- that is, that individuals who test anonymously enter care at a significantly earlier point in their infection than do those who test confidentially. Andrew Bindman et al., Multistate Evaluation of Anonymous HIV Testing and Access to Medical Care, 280 J.A.M.A. 1416 (October 28, 1998).
Name reporting also is not necessary for partner notification, nor does it ensure better follow-up. The success of any partner notification system depends upon at least three things: (1) willingness to test; (2) willingness to return for test results; and (3)willingness to identify other at-risk persons. Name reporting frustrates all three elements. Not only is name reporting likely to deter people from testing altogether, but among those who do test, those testing anonymously are more likely to return for test results than those who provide their name.(35) And those testing anonymously supply the same number of partners as those testing confidentially.(36)
Available data indicates that people who refuse to participate in partner notification do so because of fear that their anonymity will be compromised or that their partners might retaliate against them.(37) The current trend of linking name reporting to partner notification will lead many members of the public to conclude that health officials intend to disclose names when notifying partners; certainly they will have the power to do so. Additionally, current confidentiality measures which prevent such disclosure now will be seen as safe only until the next legislative session or internal department policy. The reality and perception of an increased risk to anonymity from name reporting will undermine state and local health officials' efforts to gain sufficient trust and cooperation for successful partner notification and other prevention interventions.
For example, the CDC's recitation of the history of AIDS surveillance states: "In the absence of effective therapy for HIV, AIDS surveillance data have reliably detected changing patterns of HIV transmission ...Because of these attributes, AIDS surveillance data have been used as a basis for the allocation of many Federal resources for HIV treatment and care services...With the advent of more effective therapy that slows the progression of HIV disease, AIDS surveillance data no longer reliably reflect trends in HIV transmission and do not accurately represent the extent of the need for prevention and care services." Draft Guidelines at 2. In support of the efficacy of AIDS surveillance data in "reliably detecting changing patterns of HIV transmission," the Guidelines cite one 1989 study of persons infected through blood transfusions, and a study of a cohort of HIV infected men who participated in an 11-year follow-up study -- neither of which relied on AIDS surveillance data.In support of the assertion that more effective therapy has slowed the progression of HIV disease and no longer reflects trends in HIV transmission, the Guidelines cite two small trials of combination therapy in men already diagnosed with AIDS, reported in 1996 and covering a short period of time preceding the wider availability of these therapies to the general public.
Examples of this misuse of research to support otherwise largely unsupported assertions appear throughout the Guidelines.They suggest that the real rationale behind the proposal for names-based HIV test reporting, which the CDC has supported for years and before the availability of protease inhibitors, preceded the rationale now offered in its support.
A. The Draft Guidance Is In Conflict With Data on the Current Status of HIV Surveillance and the Critical Role of Anonymous Testing Opportunities
The draft Guidance relies on two largely inapposite tests to support its contention that HIV case reporting systems have no significant impact on testing behavior. The first is a CDC-sponsored study of testing numbers in the 12 months preceding and following the adoption of names-based HIV test reporting in 6 states: Louisiana, Nevada, Michigan, Nebraska, New Jersey, and Tennessee. See Allyn K. Nakashima et al., Effect of HIV Reporting by Name on Use of HIV Testing in Publicly Funded Counseling and Testing Programs; CDC Draft Guidance at 6. The authors conclude that HIV reporting by name did not appear to affect use of HIV testing in publicly-funded counseling and testing programs, based on the total number of tests reported in each state before and after the adoption of names reporting.
The meaning of the actual number of tests "before and after," and the foundation of the authors' conclusion, appear debatable at best when considering facts and factors the authors either discount or completely ignore in infusing raw testing numbers with this significance. While the test numbers showed increases in overall testing numbers in four of the states, they showed a decrease in two, and a significant decline in injection drug users' testing in Louisiana and Michigan. The tests also showed that testing among whites increased in all states but one, but two states had significant reduction in testing by Hispanics and blacks. The authors had access to information on percentages of persons who chose anonymous testing only in Louisiana and Nebraska (the latter showing 50% of those testing choosing to test anonymously), and offered no information on what percentage of those testing were HIV positive as opposed to the number of persons testing who were negative and/or in a low-risk group. With no information on the existence, or absence, of prevention programs or other HIV education campaigns occurring or expanded during the study period in each state, or the percentage of persons actually at risk for HIV infection who tested before, as opposed to after, the institution of name-based HIV test reporting, it is impossible to gauge whether a steady number of persons testing during the 25 month period in question actually represents an increase, a decrease, or maintenance of the status quo. Additionally troubling is the fact that while the authors go to great lengths to explain away the decrease in actual testing numbers, particularly among minorities, in Michigan, they give no consideration to the web of mandatory testing provisions in existence in each state, the existence of which also might have affected testing levels in some states.(38)
The second study on which the CDC Guidance relies consists of data collected during another CDC-sponsored survey comprised of multiple choice questions in which the survey subject was asked to choose, or rank, a list of possible answers to a series of questions about HIV testing. In view of the very high number of subjects who identified either a fear of knowing their HIV status or a belief that they were not at risk of infection as the primary reasons they had avoided testing, it is puzzling that the study authors do not appear to consider the importance of these answers in determining the significance of other answers. The presumptive significance the authors attach to the subjects' misunderstanding of HIV testing and reporting laws in their states is also intriguing. Putting aside for the moment the question of whether survey respondents understood the difference between "confidential" and "anonymous" testing, the survey results suggest a deficiency in the performance of testing counselors at publicly-funded sites whose pre- and post-test counseling responsibilities include an explanation of the consequence of testing for HIV and what happens with positive test results.
Hinging its rationale in support of names-based HIV reporting on this questionable data, the draft Guidelines ignore the significant number of studies which have reached the opposite conclusion and which, at their worst, are no more flawed than the studies which the CDC has supported or constructed to bolster its advocacy for names reporting. E.g., Geoffrey Reed, et al., The Impact of Mandatory Name Reporting on HIV Testing and Treatment, Poster Presentation at the XI International Conference on AIDS (July, 1996).
The draft Guidelines recognize recent data confirming the importance of anonymous testing and the tendency among those who test anonymously to enter care significantly earlier than those who test confidentially. E.g., Draft Guidance at 6, citing A.B. Bindman et al., A Multi-State Evaluation of Anonymous HIV Testing and Access to Medical Care, 280 J.A.M.A. 1416 (October 28, 1998).(39)Inexplicably, the CDC nonetheless opts in its draft Guidance to continue to offer federal funding to the eleven names-reporting states (currently Alabama, Idaho, Iowa, Mississippi, Nevada, North Carolina, North Dakota, South Caroling, South Dakota, Tennessee, Wyoming) which have eliminated the option of anonymous testing.
It is logically inconsistent to concede, as the draft Guidelines do, that 1) "HIV surveillance data provide a minimum estimate of the number of infected persons and are most representative of persons who have been diagnosed with HIV infection in medical clinics and other confidential diagnostic settings," and that 2) "the availability of [anonymous] testing venues is highly important in promoting knowledge of HIV status among at-risk populations and...referrals to appropriate medical diagnosis and care," and then require 85% completion of HIV surveillance reports while continuing to fund the activities of states that legislate anonymous testing opportunities out of existence.
B. The Draft Guidance Misstates Available Data on the Impact of HIV Surveillance on Testing Behavior and Incorporates Unfounded Conclusions on the Viability of HIV Surveillance Based on Non-Name Unique Identifiers
The CDC's rush to judgment regarding the undesirability of unique identifiers is premature. To date, only two states have implemented unique identifier systems. Maryland has concluded that its system is meeting all major objectives and that it should be continued.(40) Much that has been learned could be used to create better systems that would provide more assurances of individual confidentiality.
For example, both Maryland and Texas used designs that required the last four digits of an individual's Social Security number as a mandatory part of the unique code. Dr. Liza Solomon of Maryland's Health Department believes that the use of Social Security numbers may have been unwise because many people either do not know, do not have or are reluctant to disclose their Social Security numbers.(41) Nor is such a traceable set of numbers truly confidential.(42) This problem could be remedied by choosing a system that does not require Social Security numbers. Despite the difficulty with Social Security numbers, over 71% of the 18,245 unique identifiers reported from laboratories in Maryland in the past three years have been complete (i.e., have included all code numbers), with the rate of completeness rising steadily every year.(43) Using a data element other than Social Security number in the unique identifier design might well result in a higher percentage of completeness.(44) Moreover, name-based reporting does not result in complete reporting of test results. Names are omitted, duplicated, or erroneously entered into dame-based registries. There is also wide use of pseudonyms by people seeking HIV testing.(45)
Contrary to claims of increased costs associated with unique identifier systems, evidence indicates that the costs of name reporting and unique identifier systems are comparable. The Maryland System costs about $100,000 to implement annually. New York's name reporting of low CD4 counts, which handles roughly twice the number of reports as Maryland, costs $200,000 per year.(46)
Finally, assuming that public health officials' ability to return to an individual index patient is necessary, this can be accomplished by HIV reporting using unique identifiers, by reversing the steps for reporting. However, "in a well-constructed system, the need to go back to individual patients for further information would be increasingly unlikely."(47)
C. The Draft Guidance Overstates Existing and Proposed Protections for the Confidentiality of HIV Surveillance Data
In the Commentary to the Draft Guidelines, CDC asserts that a pending model State privacy law project will provide a means to "protect confidential, identifiable information held by State and local public health departments against unauthorized and inappropriate use while still allowing the use of surveillance information to accomplish legitimate public health objectives" (15). Such protection is necessary because, as a CDC-commissioned survey found in 1996, current state laws "reveal significant problems that affect both the development of fair and effective public health information systems and the protection of privacy."(48) Current State statutes often allow disclosures to an inappropriately large group of persons; may fail to control the purposes for which information is used; may allow inappropriate disclosures of data pursuant to court order; and may exhibit such inconsistency among states or among data types that meaningful privacy protections are compromised.(49) Despite these systemic problems, it currently is unclear whether the Model State Public Health Privacy Act (MSPHPA) now being drafted will provide an alternative that meaningfully protects privacy, or even whether it will comport with basic standards set forth in the draft Guidelines.
The Guidelines contemplate a data set that uniquely identifies the subject and that includes his or her HIV risk factor. Draft Guidelines at 8. It assumes that cross-matching of HIV data with other lists will occur as a matter of course; it requires collection in a manner that facilitates unspecified "supplemental surveillance data on all or a representative sample of cases" and "identification and follow-up of individual cases of public health importance." Draft Guidelines at 8, 9. By requiring and routinizing such vaguely defined, and potentially broad, interventions into individuals' lives, the Guidelines elevate the importance of strong privacy protections for identifiable public health data. Yet the current draft of the MSPHPA poorly constrains exchanges of identifiable information within the public health system, requiring only a weak nexus between the data's acquisition purpose and the purpose for which it is to be used upon transfer from an acquiring public health authority to another such authority.(50) Although the model statute includes appropriately rigorous criteria for acquisition of public health data,(51) its protections dissolve in a pool of agency discretion once sensitive, identifiable material is "in the door." The Model Act's porousness further lessens confidence in the Guidelines' assurance that CDC's surveillance standards can be met in an atmosphere of true concern for privacyDraft Guidelines at 7, 14-15.
The loose standard for dissemination of data is emblematic of a larger concern, that the MSPHPA in its current form fails even to comport with the security and confidentiality practices set forth in the Guidelines. CDC recommends that states articulate "the objectives of the collection of personal identifying information." Draft Guidelines at 10. Yet the MSPHPA effort has eschewed any specification of substantive public health goals. Moreover, to effect the goal of content-neutrality, the MSPHPA's very definition of "public health purpose" is so elastic that the Model Act, could facilitate rather than constrain disclosures of identifiable information.(52) The Guidelines' recommendation that states be required to articulate, with specificity, the purposes for which they will use identifiable data is appropriate, but the suggestion that the effort now underway will achieve that end appears incorrect.
Similar deficiencies arise with respect to other recommendations contained in the Guidelines. While CDC suggests that states specify which officials shall have access to public health data, Draft Guidelines at 10, there is, as of yet, no consensus about which entities have the right to control and disseminate it. The Model Act in is current form lacks a time frame for expungement of material no longer serving a public health purpose,(53) contrary to the Guidelines' recommendation. Draft Guidelines at 10. It also is far from certain whether the Model Act will contain adequate "safeguards against disclosing HIV and AIDS case surveillance data through subpoena or court order." See Draft Guidelines at 10.(54)
CDC attempts to assure the public that its recommendations for HIV surveillance, including its clearly stated preference for reporting by name, may be accepted against a legal backdrop of strong and uniform privacy protection. There is considerable disparity between this assurance and the lesser guarantees that the CDC actually contemplates through MSPHPA, or that is actually available through enforcement of existing state and federal laws. Substantial revision of the Guidelines to acknowledge a continuing deficit in privacy protection, or substantial strengthening of the Model Act on which CDC now relies, is plainly in order.
D. The Draft Guidelines Set Forth Arbitrary Performance Standards for State HIV Surveillance Systems
The draft Guidelines' requirement that "state and local HIV/AIDS surveillance systems must use reporting methods that provide complete (> 85%) ...surveillance data," is included without explanation. This completeness requirement appears arbitrary, particularly in that the CDC characterizes as "high" the completeness of surveillance data from name reporting states which ranged as low as 79%. Draft Guidelines at 9, 14. The draft Guidelines give no indication of whether or how the CDC considered, let alone answered, the key preliminary questions:
...How accurately do we have to picture the epidemic: What do we need? That's a central and powerful issue. What do we need to know?
Do we need overall, current incidence data to a high level of precision? Do we need current incidence data by geography, age, sex, risk behavior, and race/ethnicity to a high level of precision? What level can we achieve? Can we work effectively with "adequate" precision? How can we verify how precise we are?
We need to recognize today's trends and how substantial the trends are. ...Much more is still needed in the way of applying current ideas and refining sampling.
If we can reasonably estimate current incidence by sub-population, that will enable us to provide valuable advice to community planning groups, to policy makers, to advocates, and to healthcare planners. We can enrich the targeting of prevention programs and resource allocation -- if we have the political will to do so. None of this requires, or may not even benefit from HIV case reporting, with or without names.
Novick, HIV Surveillance: What's Hot, What's Not, 13 AIDS & Public Policy J. at 54.
The CDC's proposal must be assessed on the basis of what we reasonably can expect its impact will be on the HIV testing and prevention behaviors we wish to encourage. It also is important to consider its secondary impact on those persons who most frequently are associated with HIV infection risks. While we realize that there is considerable political enthusiasm for the proposal advanced here, it will undermine rather than advance the goal of containing the HIV epidemic in this country. We also believe that it will have a disproportionately adverse impact on the communities we represent.
There is no evidence, and little reason to believe, that mandating the reporting by name of persons with positive HIV test results will provide the accurate picture of the epidemic missing from reliance on AIDS case reporting alone. Most public health experts believe that a significant number of people who are HIV positive avoid testing and have no idea of their status. Other studies overwhelmingly indicate that those considering testing, particularly racial and sexual minorities, will be deterred if they are required to provide their name. We believe that instituting a reporting system with little or no evidence of efficacy, in the face of evidence that it will undermine the goals of encouraging testing and of constructing an accurate picture of the epidemic on which to base the focusing of resources, is irresponsible.
We are nearing the second decade of the AIDS epidemic, yet during this time public health officials advocating the introduction of a potentially counter-productive surveillance system have done little to advocate for the related benefits they say will flow from this surveillance. Federal and state public health officials either support, or refuse to publically criticize, the forced HIV testing of persons charged with sex offenses and the incarcerated; the use of HIV test reports by criminal law enforcement authorities for prosecutions or segregated housing and punishment of prisoners; the exclusion of foreign travelers and immigrants; and the exclusion from schools of accurate, comprehensive prevention programs in favor or the wide-spread use of "abstinence only" propaganda. As a matter of policy, CDC officials, and most state public health officials, refuse to provide sound, science and medical-based testimony on behalf of health care workers and patients who are forced out of their jobs or are denied treatment on the basis of their HIV status. And CDC's current effort to standardize state confidentiality laws governing this information proposes new uses of names-based HIV test results by a wide range of public health agencies, and by private employees such as researchers, far beyond those whom the index patient consents to have this personal data.
We have a right to expect that the CDC, the nation's foremost public health agency, will advance public health policy based on the best medical and scientific evidence available. When the CDC lowers its standards of performance, the public pays -- as HIV positive health care workers continue to pay for the CDC's ill-advised adoption of guidelines that reflected political pressure over scientific fact. We ask the CDC to delay implementation of these draft Guidelines long enough to seriously study the possible injurious impact they will have on the need for accurate, representative data and on the health and welfare of vulnerable individuals at risk of HIV whom the CDC is created to serve. True alternatives that will better serve the multiple purposes of this proposal have yet to be seriously explored. We call on the CDC to support legitimate, impartial studies of reasonable alternatives to the names-based reporting approach to surveillance advocated here, and at the very least to require states seeking federal funding to adopt and maintain those measures, such as anonymous testing options, which indisputably are necessary to ensure all affected persons' access to testing and to care.
The expansion of national surveillance to include both HIV infection cases and AIDS cases is a necessary response to the advances in antiretroviral therapy, the implementation of new HIV treatment guidelines, and the increased need for epidemiologic data concerning persons at all stages of HIV disease. HIV and AIDS surveillance data will enhance federal, state, and local efforts to prevent HIV transmission, improve access to treatment services, and evaluate the impact of public health interventions.
Id. at 1.