Comments on the Department of Health's Revised, Proposed Regulations Implementing the 1998 HIV Reporting and Partner Notification Law (Amending Articles 21 and 27 of the Public Health Law)
January 14, 2000
Commissioner Antonia C. Novello, M.D., M.P.H.
c/o Mr. William R. Johnson
New York State Department of Health
Office of Regulatory Reform
Room 2415 ESP Tower Building
Albany, New York 12237-7488
By Facsimile and E-Mail
Dear Commissioner Novello:
We submit the attached comments on the revised, proposed regulations released by the Department of Health on December 15, 1999 on behalf of members of the Ad Hoc Committee on Smart AIDS Laws, a coalition of organizations and individuals dedicated to ensuring that laws and policies on HIV and AIDS reflect current knowledge and experience on treating and preventing HIV infection.
The current set of proposed regulations are an improvement over the original proposal in several important respects. The purging of the names of index patients' contacts one year following contact notification, and the elimination of a provision allowing disclosure of the identity of HIV positive index patients to officials in other jurisdictions are safeguards that better protect individual privacy interests.
Nevertheless, the proposed regulations do not sufficiently and fairly reflect or respond to the weight of public comment, public health science, or applicable law. A number of major recommendations and comments of community-based service providers, based on the experience of being, or serving, people with HIV, were categorically rejected. In addressing several of the issues raised by many members of the community, the DOH summarizes comments and then rejects them with little or no explanation; other comments and recommendations on important issues such as the availability of anonymous testing are not even acknowledged, let alone addressed. Some of the Department's responses discount or ignore the weight of public and expert opinion, experience and research on issues such as domestic violence and genuine transmission risks. Since the agency declined to hold public hearings on these regulations, its legal obligation to respond is significantly determined by written comments, which must be addressed through an assessment containing "a summary and an analysis of the issues raised and significant alternatives suggested" in the comments, a "statement of the reasons why any significant alternatives were not incorporated," and "a description of any changes made in the rule as a result." New York State Administrative Procedure Act §202 (4-a)(b).
Finally, the Department's explanations for provisions such as those requiring the repeated reporting of CD4 counts under 500, or insisting that federal law requires provision of HIV-related information to emergency response personnel without requiring a baseline HIV test, represent a misinterpretation or clear violation of applicable law.
In short, we believe that the regulations as drafted still fail to reflect the carefully thought-out, medically sound policies that invite at-risk persons into testing and care, reverse the stigmatization of people with HIV, and provide the public with accurate information about risks of transmission. In several important respects, they still violate basic rights to informed consent and confidentiality, exceed statutory authority, reinforce unsound popular assumptions about HIV transmission and fail to adequately balance the potential benefits of contact tracing with the profound danger of domestic violence. For these reasons, the proposed regulations unnecessarily risk deterring people from testing and care, and dangerously mislead members of the public into believing that government warnings about exposure to infected individuals, rather than the consistent practice of sound risk-reduction practices, is the single most important way to protect one's health.
Comments and Recommendations
- The definition of "domestic violence" reflected in the domestic violence screening protocol does not reflect either testimony or the commonly-understood meaning of domestic violence. Domestic violence justifying deferral of partner notification cannot be limited to threats of "severe physical harm," or "severe and substantive risk to physical health and safety."
Requiring that an index patient document a threat of severe physical harm to defer notification artificially elevates the potential benefits of partner notification over a range of harmful consequences to the index patient-- emotional and financial as well as physical -- that can profoundly affect not only the health of the patient but the safety and well-being of individuals in her/his care.
By limiting deferral of contact notification to situations involving a risk of "severe negative effect on the physical health and safety" of individuals, the DOH has again ignored the universally accepted definition of domestic violence used by the State Office for the Prevention of Domestic Violence (OPDV). This provision is unnecessarily restrictive, offering no real protection to individuals at risk of other forms of recognized violence and rendering them vulnerable to continued or increased abuse. The protocol should be revised to focus on the total health and safety of individuals, rather than merely their "physical" well-being. The regulations also must make clear, at a minimum, that an index patient will not be expected or requested to sacrifice secure housing in order to allow partner notification to proceed.
- Contact notification priorities and clear guidance on addressing the needs of special populations should be clearly defined by the Commissioner.
Section 63.8(a)(3) and (b), which addresses prioritizing cases meriting contact notification, in fact leaves the setting of priorities to the discretion of local health officials, vaguely suggesting only that these officials consider contacts who have been reported, and contacts of individuals newly diagnosed with HIV, in determining which cases merit follow-up. These "factors" are far too broad to ensure that local priorities for use of available resources are appropriate and consistent state-wide. The Commissioner should provide meaningful, explicit direction. The regulations and the informed consent form also should make it clear that index patients can state a preference as to who should complete notification; some individuals may prefer assistance through DOH personnel, while others will prefer contact notification by their physicians or by doing it themselves.
A serious shortcoming of Section 63.8(d) is its failure to include any criteria for ensuring that contact notification activities will reflect the unique circumstances of younger people, individuals in group residential and institutional settings, and other members of vulnerable populations. Instead, the regulations merely require that notification activities be "consistent with guidelines acceptable to the commissioner." Contact notification standards that meet the needs of special populations can best be developed with the input of the community-based providers who serve these populations. This is particularly important for adolescents, a population in which risk-taking behavior is high and where the consequences of mishandling counseling and partner notification activities can be disastrous. Guidelines for dealing with this populations should be made available for appropriate public input prior to their implementation.
- The regulations' provisions on notification of contacts following an occupational exposure represent an abdication of the NY Department of Health's responsibility to take aggressive measures to end ignorance about HIV. The inclusion of unsupported transmission "risks" in the definition of "contacts" also reflects a misapprehension of law and applicable agency guidance.
At a time when unfounded fears persist about risks posed by individuals with HIV, it is disturbing that the Commissioner and other state health officials are abdicating their responsibility to eliminate this root cause of discrimination. Rather than demonstrate leadership by refusing to accommodate the fears and biases reflected in much of the HIV-related legislation proposed around the country, the Commissioner inappropriately exercises her discretion by adopting provisions which reflect political rather than public health concerns.
The identification of occupational exposure for emergency response and criminal justice personnel as a transmission risk justifying breach of an index patient's confidentiality perpetuates unwarranted fears of infection. There is no evidence that HIV transmission has ever occurred as a result of occupational exposures for emergency response personnel. There also is a complete lack of evidence that occupational transmission of HIV is anything more than an extremely remote risk for criminal justice personnel, and the potential for misuse of this information in the correctional setting militates against including such personnel in the definition of "contacts" through occupational exposure. We are aware that the DOH has adopted the policy for notification of emergency response personnel in order to secure additional federal Ryan White funding; even if we believed that the availability of funding for such an initiative is sufficient basis for the state's health officials to endorse it, it clearly is inappropriate to incorporate this type of funding-driven provision into formal regulations.
Putting aside for the moment the legitimacy of including emergency response personnel in the definition of "contact," there is no sound legal or medical basis, in the Ryan White Act or elsewhere, to exclude such personnel from the regulations' requirement of HIV testing of potential contacts prior to release of HIV-related information of the index patient. There certainly is no basis for the Department's odd assertion that "federal preemption" somehow ties the Department's hands in this aspect of the regulations.
Ultimately, Section 63.8(m) of the proposed regulations, establishing a protocol for "significant occupational disclosure [sic]," does not reflect the prevailing positions of medical experts. The CDC does not recommend post-exposure prophylaxis following occupational exposures occurring in non-health care settings, likely recognizing that all but a few cases of occupation HIV transmission have occurred through needle-stick accidents involving hollow-bore needles. By relying on political rather than medical or scientific considerations in determining the definition of "contact," the Commissioner has abused her discretion by effectively using the rule making process to implement legislative proposals with the NY legislature repeatedly has declined to adopt.
- The regulations expand the scope of HIV reporting permitted under the law by including all CD4 tests under 500 and all positive HIV nucleic acid detection tests as reportable diagnosis of initial HIV infection. The reporting provisions also fail to make clear that antibody testing results from the newborn screening program are not reportable.
The plain language of the law does not provide for including the first CD4 or viral load test after implementation of the law as an initial diagnosis of HIV.
The public health law limits case reporting to, at most, three instances over the course of each individual's HIV disease progression:
upon the initial determination that a person is infected with HIV;
upon the initial diagnosis that a person is diagnosed with AIDS; and
upon the initial diagnosis that a person is diagnosed with HIV-related illness.
Section 63.4 of the regulations exceeds the statute's authority by requiring laboratories to make unlimited reports to the DOH concerning a test subject, whenever the individual's test results show the presence of HIV antibodies, a detectable viral load, or CD4 count less than 500. The proposed regulations define "initial diagnosis" for laboratory purposes to mean "the first such test... performed on a specimen submitted after the effective date of the regulations." Section 63.4(a)(4)(i). Because an HIV positive individual in treatment will have, on average, 6-10 blood specimens submitted for viral load and CD4 testing each year, under the proposed regulations only laboratories that maintain lists of individuals who have positive HIV-related tests can avoid multiple case reports per individual, even when no change has occurred in that individual's clinical diagnosis.
Moreover, it should be noted that a CD4 count between 200 and 500 has no independent clinical diagnostic significance to physicians, public health officers, or the Centers for Disease Control, nor is such information in any way relevant to the legislation enacted. In fact, the CDC's Revised Surveillance Case Definition for HIV Infection (December 10, 1999) does not recognize CD4 counts of greater than 200 as a basis to include an individual in an HIV surveillance report. Even if reporting of this information were not beyond the authority granted the Department under the law, it is unclear how the DOH and other local health authorities will manage the collection and analysis of data that includes information that is not reportable to the CDC or usable to document the incidence of HIV diagnoses as a basis for funding.
The DOH's scheme to mandate duplicate reporting by laboratories and then to employ "designated staff" to "unduplicate" the multiple reports is more than a clear violation of the law's authority and intent. This scheme also does nothing to further public health objectives and is a waste of precious public resources. Better solutions would be:
to limit laboratory reporting to initial diagnosis of a case, as required by the law, rather than the reporting of specimen test results;
to eliminate reporting of viral load and CD4 testing, since the law does not require these; or
to require only diagnosticians, and not laboratories, to report cases to the DOH.
Finally, the reference in the reporting and notification regulations to the comprehensive newborn testing program, through the addition of Section 63.3(b)(2)(vi) (as a situation in which informed consent is not required), fosters confusion on the reporting of newborn testing results. Section 63.8 should clarify that such tests are not reportable as to either the newborn or the mother, as Dr. Gus Birkhead confirmed at an April 7, 1999 meeting of the AIDS Advisory Council. Such clarification is consistent with the requirements of the CDC's Revised Surveillance Case Definition for HIV Infection (December 10, 1999), in which reporting criteria for children aged less than 18 months requires positive results through HIV nucleic acid detection, HIV p24 antigen test (for a children one month of age or older), or HIV isolation through viral culture.
- The DOH fails to adequately address the input of the New York AIDS Advisory Council and a significant majority of individuals and organizations representing people with HIV, including physicians with significant HIV practices, who recommended that the state collect HIV case information by using a "delinked identifier" reporting system.
After examining all of the available data on the viability of the unique identifier, including the CDC-sponsored evaluation of the Maryland and Texas systems, we concluded that a unique identifier case reporting system would accurately track the HIV epidemic without triggering the privacy and social risk issues which deter individuals from testing and unnecessarily increase the level of government acquisition of sensitive personal information about already-marginalized individuals. We specifically recommended that a unique identifier system be adopted at least on a pilot basis to accommodate the legitimate concerns and suggestions on development of a workable system that would respond to the majority concerns and meet the goals for the epidemiological tracking of HIV.(1) The DOH fails to adequately address these concerns, repeating instead the same justification for names-based reporting on which it relied prior to the public comment period.
- Patients must be fully informed of the nature of the new law, and their rights under that law.
The regulations do not recommend, and the approved consent form does not contain, reassurances that the law prohibits the imposition of civil or criminal penalties for failure to provide names of contacts. The Department of Health explains this rejection of requested clarification for patients facing the possible trauma of a positive HIV test by stating that, "63.3 was not amended to require counseling on the absence of penalties for non-cooperation in partner notification, because this would send a confusing message to persons whose cooperation was being sought." In this response, the DOH appears concerned that advising index patients of their rights under the law might encourage them to exercise those rights, and deals with this concern by approving a consent form that seems to suggest that these rights do not exist. Withholding information about an individual's rights as a way of increasing patient participation in identifying contacts is unethical and contrary to the fundamental concept of informed consent.(2)
Also, written informed consent should precede, at minimum, a physician's initial administration of any form of HIV-related test that will trigger reporting and contact notification procedures; counseling must include the same range of information for all forms of HIV-related testing. Consent forms should include confirmation that counseling was provided in the language of the individual to be tested.
Finally, although both Public Health Law Sec. 2781(1)(2)(b) and the proposed regulation 63.3(a)(1)(iv) require that individuals be informed that their consent to an HIV test may be withdrawn at any time, no mechanisms are proposed to insure this right or to address specific situations, such as where an individual tests and does not return for test results. Indeed, the proposed informed consent form does not even mention that individuals have a right to withdraw consent, a clear violation of PHL Sec. 2781(1)(2) that requires the informed consent "statement" to include such information.
- All non-consensual releases of HIV-related information must be documented.
Responsible staff must record any release of HIV-related information, whether with or without informed consent. Access of non-medical staff reviewing confidential records for purposes related to program administration also must be documented in, at minimum, a central file. Preservation of confidentiality, and the potential for inappropriate disclosures, cannot be monitored without tracking all disclosures of private patient information.
- The regulations and the response to written comments are silent as to the requested expansion of anonymous testing opportunities.
In their comments to the Department of Health, dozens of organizations endorsed the expansion of access to anonymous HIV testing. Additional anonymous testing opportunities, particularly through clinics, are warranted in view of the state law requirement that such testing be a real alternative, and the recognition, most recently in the CDC's Guidelines for National HIV Case Surveillance, that the availability of anonymous testing is an important component of an HIV testing and surveillance scheme. Studies have shown that the availability of anonymous HIV testing is associated with increased numbers of individuals seeking testing services,(3) and that those who test anonymously enter care earlier.(4)
- Expansion of criminal justice personnel's access to confidential HIV-related information threatens severe consequences for incarcerated individuals with HIV.
Inmates retain the right to the confidentiality of HIV-related information. See., e.g., Powell v. Schriver, 175 F.3d 107 (2nd Cir. 1999) (disclosure of inmate's HIV positive status absent legitimate penological purposes could constitute deliberate indifference to substantial risk of harm); Nolley v. County of Erie, 776 F. Supp. 715 (W.D.N.Y. 1991) (finding inmate's privacy rights were violated by unwarranted disclosure of HIV+ status by holding center's policy of placing red sticker on outside of HIV+ inmate's medical files); Hetzel v. Swartz, 917 F. Supp. 344 (M.D. Pa. 1996) (approving appointment of counsel for HIV+ former inmate who claimed prison officials invaded his privacy by disclosing HIV status to prison staff). Given the documented instances of illegal disclosure of HIV information in the criminal justice setting and the widely recognized fact that it is nearly impossible to maintain the confidentiality of private medical information in a correctional setting, it is unwise and inappropriate to permit disclosure of HIV information to criminal justice personnel without patient consent or a court order. See Section 63.8(m).
Accordingly, the regulations must be clarified to ensure that only those personnel directly involved in the provision of medical care be provided information about the HIV status of a correctional facility inmate, probationer or parolee. HIV status is not an appropriate part of general institutional inmate files, or parole or probation files, particularly in that these files are frequently accessible by other members of the public.(5)
- A specific time period must be established for deletion of contact names and other identifying information where contact notification is not achieved or is not deemed necessary.
While we applaud the Commissioner for including a new provision providing for the elimination of identifying information within a year following completion of contact notification, the provision fails to address those circumstances when there is no final confirmation that notification to the contact has been completed, e.g., in those circumstances when the individual can't be located and the indefinite use of resources to attempt to locate the individual is unwarranted or unwise. We recommend that all such information should be purged within one year of the DOH's and other local health officials' receipt of such information.
- The Commissioner should provide for an independent evaluation of the HIV surveillance and partner notification system implemented through these regulations.
If the DOH is to ensure that the proposed program for name reporting and partner notification is genuinely effective with respect to encouraging testing and prevention and promoting access to health care, as well as accomplishing effective surveillance, it is essential that the Commissioner mandate an independent review of the program. The primary goal of any such public health initiative must be control and prevention of disease; it is critical that the DOH confirm that the new surveillance and notification program serves this overriding goal. The DOH repeatedly has asserted that "no instances of improper disclosure have resulted" from such a system while failing to explain the basis for this assertion, apparently assuming that the lack of wide publicity about such events constitutes sufficient confirmation. A proper system of evaluation will ensure that threatened or actual inappropriate disclosures of HIV-related information will be detected and documented.
- The Commissioner must take steps to ensure that all individuals seeking HIV-related testing and care have easy access to information on securing HIV-related services, as well as information on how to address problems of discrimination or violations of privacy that may occur as a consequence of their HIV status or the surveillance and contact notification program.
While the regulations and approved consent form reference the right to be tested anonymously, and the right of individuals with HIV to be free from discrimination and unwarranted disclosure related to their status, they offer no guidance as to how affected individuals can exercise their rights in the event they are violated. Telephone inquiries made to several HIV service providers suggests that even physicians who act as spokespersons on the issues of HIV testing, surveillance and reporting have failed to ensure that they and their staff fulfill their responsibility under the law to provide information on the availability of anonymous testing.(6) The DOH should ensure that all providers of HIV testing and health care services are able to provide location and contact information on available anonymous testing sites throughout the state, and legal service and advocacy organizations that will assist those who experience discrimination or violations of their privacy as a consequence of seeking diagnosis and treatment.
Lambda Legal, Inc.
The Legal Support Unit of Legal Services for New York City
Latino Commission on AIDS
New York City AIDS Housing Network
New York AIDS Coalition
Mano a Mano
Robyn D. Fisher
Comprehensive Rights Unit, HIV/AIDS Project, Brooklyn Legal Services Corp. A
Danielle Greene and Cyra Quinones-Borsy
Northern Manhattan Women and Children HIV Project
Elsa A. Rios and Kimberly M. Mutcherson
HIV Law Project
Laurell A. Lesaenburg
The Central Harlem HIV Care Network of the New York Urban League
William P. Nelson and Mildred Pinott
Community Law Offices HIV/AIDS Representation Project, The Legal Aid Society
Cynthia Schneider and Matthew Carmody
South Brooklyn Legal Services
The Audre Lorde Project, Inc.
Data security consultants, working with DOH epidemiologists, easily could create a system of unique coding which would be easier and less subject to duplication than reliance on names and addresses (which change), and social security numbers (which a significant number of New Yorkers either do not have or will not reliably remember and which are employed by a wide range of public and private enterprises to track individuals, creating further risks of inappropriate cross-matching of data and confidentiality breaches). Despite the almost total lack of data, and relying exclusively on a limited and flawed study of the equally-flawed identifier systems employed in Maryland and Texas, the DOH has taken the position that a unique identifier system is unreliable and will create additional work for physicians. The truth of the matter is that alphanumeric codes are used routinely to track and store sensitive personal information, e.g., reporting of state abortion statistics, social security benefits, credit card and Internet accounts. One data security specialist recently suggested a code devoting five or six characters to a code word or number of the patient's choosing, 5 characters based on the first and/or last name, the date of birth, and the six-digit state medical license number which all practitioners know at least as well as their social security numbers. Such a code would likely reduce the duplication and errors inherent in a name-based system. April 29, 1999 conversation with John Marsh, retired data security consultant.
"Subjects are entitled to know the purposes for the data collection and how the information will be used.... Data should be acquired, stored, used, and transmitted consistent with the information provided to subjects." Gostin et al., "The Public Health Information Infrastructure: A National Review of the Law on Health Information Privacy," JAMA 1996:275.
A current case which Lambda Legal, Inc. is handling aptly illustrates the point. Lambda is representing an individual who provided information about his HIV status to a probation officer following a conviction for drunk driving. The information was incorporated into records maintained by the court and available to the public. The disgruntled ex-husband of the individual's fiancee secured access to this information simply by requesting it at the appropriate court, and subsequently broadcast the information, with the consequence that the individual's HIV status became an issue in a custody dispute between the fiancee and her ex-husband.
As the regulations make clear, pretest counseling must include "an explanation... that anonymous testing is available including the location and telephone numbers of anonymous test sites..." [Section 63.3(a)(1)(iv)]. On January 11-14, 2000, two staff members of Lambda Legal made repeated calls for information about anonymous testing to the offices of Conrad Thomas Fischer, a physician at the United Parents Center, Community Family Planning Council in Brooklyn, New York and the NYU Medical Center's Department of Pediatrics, where Keith Krasinski is Associate Professor of Pediatrics. Both Dr. Fischer and Dr. Krasinski were members of the New York State AIDS Advisory Council HIV Surveillance Work Group. In two calls to Dr. Fischer's clinic, a staff member who identified herself as Adrian, advised the caller that the clinic offered anonymous testing and informed the caller, in response to a question as to the difference between anonymous testing and confidential testing, that they are "the same thing." In fact the clinic offers only confidential testing, but in the initial and second call to Dr. Fischer's clinic, Adrian was unable to provide any information to the caller on the location of "other" anonymous testing sites, stating that there were none others in the area that she was aware of. Two additional calls to the clinic were made by another Lambda staff person. In the first of these later calls, when the caller asked if the clinic offered anonymous testing, he was told "yes" but then the clinic staffer abruptly hung up the phone. When the Lambda staff person called back, the following exchange (transcribed immediately following the phone conversation) took place:
Caller: Do you offer anonymous HIV tests?
Clinic staff person: Yes.
Caller: Does this mean that my name is not attached to my file?
Clinic: No, there is just a number.
Caller: Could you tell me then what the difference is between confidential tests and anonymous tests?
Clinic: Could you hold please? [a few minutes pass]... We actually offer confidential tests not anonymous tests. Your names does appear on the registration form.
Caller: Is that information reported to the state?
Clinic: Do you mean is the information reported to the Department of Health?
Clinic: Hold on [a few minutes pass]... No, the clinic does not reveal this information to the Department of Health.
A call by a Lambda staff person to Dr. Krasinski's number at the NYU Medical Center reached a staff person who had no idea where the caller could get an anonymous HIV test, although she indicated that their TOPS Program might be able to help, but the caller was able only to reach voice mail at the number she was provided despite repeated calls.