Beginning December 31, 2003, the State of Georgia will implement HIV names reporting. As a follow-up to a town hall meeting organized by AIDS Survival Project in August 2003, we have asked Dr. Luke Shouse, Department of Human Resources HIV/AIDS Surveillance Unit, to respond to questions commonly asked peer counselors about names reporting.
What Is HIV Names Reporting?
HIV reporting is a system of collecting information about the HIV epidemic. The Georgia Department of Human Resources Division of Public Health will begin collecting information such as age, gender, race, ethnicity, county of residence and transmission risks of persons diagnosed with HIV. This information will be used to understand the epidemic in Georgia and to aid in planning for HIV prevention and care activities such as HIV testing, prevention programs and Ryan White clinics. The information collected is also required when applying for federal funding like the Ryan White Title II grant. For a name-based system, the information is collected using a person's name as the identifier. An identifier is necessary to ensure each report is unique and not a duplicate report so that the count of infected people is more accurate.
Isn't Georgia Already Doing This?
A 1988 law made HIV reportable, but without identifiers. Providers are required to report to the Division of Public Health the age, sex, race and county of residence of persons confirmed to be HIV+. Because these reports lack identifiers, they are unable to be de-duplicated, rendering them useless for many of public health's needs. The reporting change will require reports to include identifying information.
Why Is Georgia Going to Start Doing This Now?
Although Georgia has been reporting cases of AIDS by name for many years, Georgia is the last state in the nation to implement identified HIV reporting. With improved treatments, people with HIV are not progressing to AIDS and are not being included in our data of individuals with HIV/AIDS. This means the information collected does not represent the entire HIV epidemic, but only those who are the sickest or who have longstanding infections. The Division of Public Health needs data that represents the entire epidemic if we are to have targeted, effective prevention programs. It means many people with HIV are not represented in our requests for financial assistance to provide prevention and care services, but are still utilizing the services. As a result, Georgia's HIV Prevention and Care program struggles to provide state-of-the-art services on a shoestring budget.
What Kind of Protection of Confidentiality Exists?
The data collected on individuals with HIV is protected by very strict security and confidentiality guidelines. There are physical, process and virtual protections to ensure the data are secure. In twenty years of collecting AIDS data by name, the Division of Public Health has not had a single breach. The data is collected and stored at the State Public Health office. The HIV Epidemiology office is behind locked doors to which only HIV Epidemiology staff has access. The entire staff has signed security agreements and is subject to criminal prosecution for any intentional breach. We do not share the identifying information we collect with any other individuals or organizations such as insurance companies, landlords or even physicians. Simply put: once reported to our office, your name would never leave.
The one exception is when the Division of Public Health de-duplicates our list with other states. For de-duplication purposes, we may have to verify if a particular individual has already been reported in Georgia so that national statistics are correct. In these limited situations, patient identifiers are only shared between HIV/AIDS surveillance staff in the two states and only following a verification process to identify the individual as appropriate surveillance staff of that state.
Why Can't We Have Unique Identifiers Like Some Other States?
The Centers for Disease Control and Prevention (CDC) evaluated unique identifier-based surveillance systems that did not include patient names and found several problems with such systems, including incomplete reporting, missing critical information, difficulty following up on specific cases and absence of behavioral risk data. Additionally, unique identifier-based systems are more cumbersome for private medical providers and have served as a barrier to reporting in some areas with unique identifier systems. Finally, Georgia utilizes names on all reports for all notifiable disease reporting, including AIDS. For these reasons and more, unique identifier systems provide less reliable and complete data for public health.
How Can This Be Legal? Aren't People's Medical Records Private? What About HIPPA?
HIV disease reporting is not new or unique and is authorized by law. States have the legal authority to establish which diseases will be reportable and how reporting should be done. In Georgia, there are more than sixty diseases or conditions reportable, including syphilis, meningitis, anthrax, influenza, smallpox, Hepatitis A, B, & C, West Nile virus and E. coli. All are reportable using the name of the individual with the disease. Information collected about individuals with these diseases is the basis for the Division of Public Health activities that seek to protect the public from these diseases. Recent examples include the anthrax terrorism, the Hepatitis A outbreak associated with green onions and the more virulent strain of influenza circulating this year.
Medical records are private. However, for purposes of notifiable disease reporting, your provider is required by law to share the information with the Division of Public Health. The Division of Public Health only requires the reporting of information that is absolutely necessary for disease surveillance and takes great precaution to protect the confidentiality of individuals. Additionally, laws protect the information collected by the Division of Public Health, ensuring the information's security and confidentiality.
The Health Insurance Portability and Accountability Act (HIPAA) is federal legislation intended to protect an individual's medical information. However, the legislation specifically states that the HIPAA Privacy Rule does not prohibit notifiable disease reporting.
Are People Who Go to a Private Doctor Included in the Reporting Process?
Yes. Public health infectious disease reporting only works to provide accurate information on the entire epidemic if all providers offering HIV testing and care are included in the system.
Will People Still Be Able to Get an Anonymous HIV Test?
Yes! The Division of Public Health is committed to supporting anonymous testing throughout Georgia. Anyone should be able to request an anonymous HIV test at any public health facility offering HIV tests. Private physicians may offer anonymous tests, as well as local community-based organizations in your area, such as AID Atlanta.
Will There Be a List of Names Available to People Like Insurers, Hospitals, Jails, Employers?
Absolutely not! The identity of persons with HIV or AIDS collected by the Division of Public Health is never shared with anyone outside the HIV/AIDS Epidemiology office. The names are never shared with insurance companies, Medicare, Medicaid, hospitals, physicians, jails, employers, family members or landlords. In certain circumstances, the law requires the Division of Public Health to notify an individual of another's HIV+ status. For example, the Division of Public Health is required by law to notify a spouse of their spouse's HIV status when the HIV+ spouse refuses to disclose their status to the spouse. The Division of Public Health is also required by law to notify a victim of a sexual crime if the sex offender tests positive for HIV.
Who Can People Contact if They Have More Questions About This?
Questions can be emailed to Luke Shouse, M.D., M.P.H., HIV Epidemiology Director at firstname.lastname@example.org.
Will This Apply to People Who Tested Positive Before Dec. 31, 2003?
Providers are not required to report individuals tested before December 31, 2003, but are allowed to do so if they choose. However, the HIV Epidemiology office will receive all laboratory reports indicative of HIV infection, such as CD4 lymphocyte tests and viral load tests. These reports will be followed up with the provider that ordered the tests. This follow-up will most often lead to a report, meaning many individuals living with HIV before December 31, 2003, will eventually be reported.
Does a Person Living With HIV Have a Way to Find Out if Their Name Has Been Reported?
No. The Division of Public Health does not release information regarding who is in the HIV/AIDS database to anyone -- even to an individual who is on the list. This operating procedure is to protect the privacy of individuals with HIV who may be in our database. If an individual is HIV+, they should assume they have been reported.