4. Infectious disease and health epidemics

Reports and records kept of sexually transmitted and other infectious diseases are confidential by statute and not subject to inspection under the Public Records Law. See Ala. Code § 22-11A-1, et. seq.

The Department of Health and Social Services may inspect health care records that would identify cancers, birth defects or infectious disease required to be reported, and may conduct research using such health care data. Data obtained or a records inspected under this section that identify a particular individual are confidential, and are not subject to inspection or copying under the public records act. AS 18.05.042.

(This section is blank. See the point above.)

The Arkansas Department of Health and Human Services maintains reports of positive HIV and AIDS tests. Those records are exempt from the FOIA. Ark. Code Ann. § 20-15-904. Records of healthcare-acquired infections collected by the Arkansas Department of Health and Human Services are exempt from the FOIA. Ark. Code Ann. § 20-9-1206. The records maintained by the Cancer Registry of Arkansas are also exempt from disclosure. Ark. Code Ann. § 20-15-203.

Information about an ongoing outbreak of an infectious disease at a public facility is not expressly exempt and strong public policies support disclosure of such information to inform the public, dissuade undue panic and allow the public to judge the agency’s response. It can be anticipated that some concerns about whether disclosure will violate the Health Insurance Portability and Accountability Act (“HIPAA”) will be expressed, if not directly asserted to thwart disclosure. HIPAA would only apply, however, if the facility fell within the definition of a “health care provider” and the disclosure was of “individually identifiable health information,” as those terms are defined under 42 USCA Section 1320(d); 45 CFR 160.103. Even so, HIPAA expressly authorizes disclosure pursuant to other legal mandates, such as a state‘s public records act. CFR § 164.512(a). In a CPRA case over access to location and address information contained on a spreadsheet showing confirmed cases of COVID-19 outbreaks, the court held that the county was justified in redacting this information from the spreadsheet of confirmed cases under [Section 7922.000’s] catchall exemption where disclosure would discourage candid public cooperation with contract tracing, according to the county’s declarant. Voice of San Diego v. Superior Court, 66 Cal. App. 5th 669, 692, 280 Cal. Rptr. 3d 906 (2021).

See Conn. Gen. Stat. §19a-581 et. Seq. re: confidential HIV-related information.

Not specified.

Fla. Stat. § 384.29(1) (2020) provides that: “All information and records held by the department or its authorized representatives relating to known or suspected cases of sexually transmissible diseases are strictly confidential and exempt from the provisions of s. 119.07(1).”

Infectious disease and health epidemic case reports and data are confidential, but the Department of Public Health may release such reports and data in statistical form or for valid research purposes.  O.C.G.A. § 31-12-2(a).

Medical opinions recorded in records maintained by a treatment center operated by the Research Corporation of the University of Hawaii are within the scope of the physician-patient privilege and, therefore, protected from public disclosure under the UIPA. Medical Opinions Protected, OIP Op. Ltr. No. 93-15 (Oct. 1, 1993).

Idaho Code § 74-106(19) exempts records and information contained in the registry of immunizations against childhood diseases maintained by the Department of Health and Welfare. Idaho Code § 74-106(12) exempts records of the Department of Health and Welfare that identify a person infected with a reportable disease.

Open if the data does not identify any specific patient or reveal medical information belonging to a specific person.  See Southern Illinoisan v. Illinois Dept. of Pub. Health, 218 Ill. 2d 390, 844 N.E.2d 1 (2006).

There is no statutory or case law addressing this issue specifically. However, local health officers must keep full and permanent records of the local health department’s public health work. Ind. Code § 16-20-1-10. Additionally, the state department must publicly release inspection reports, but not until the recipient of an inspection report has had ten days to respond. Ind. Code § 16-19-3-25(b). However, the state department may release the report earlier than ten days after it is issued to protect the public or consumers of health services from an “imminent threat to health or safety.”

Reports of infectious diseases prepared pursuant to chapter 139A are confidential. Iowa Code § 139A.3.

There is no statutory or case law addressing this issue.

“All records of interviews, questionnaires, reports, statements, notes, and memoranda procured by and prepared by employees or agents of the office of public health . . . in connection with special morbidity and mortality studies and research investigations to determine any cause or condition of health, . . . are confidential and shall be used solely for statistical, scientific, and medical research purposes relating to the cause or condition of health. . . .”  La. Rev. Stat. Ann. 40:3.1(A).

Maine Department of Health and Human Service records that contain personally identifying medical information that are created or obtained in connection with the department's public health activities or programs are confidential.  These records include, but are not limited to, information on genetic, communicable, occupational or environmental disease entities, and information gathered from public health nurse activities, or any program for which the department collects personally identifying medical information.  22 M.R.S.A. § 42(5).  However, medical and epidemiologic information in which an individual cannot be identified is public.  Id.  The prevalence of infectious disease and vaccination rates have been made public by the Department.

The names of individuals having or suspected of having a notifiable disease or condition are confidential.  22 M.R.S.A. § 824.  Information concerning a notifiable disease or condition or suspected epidemic that is provided by a doctor to the Bureau of Health must also be kept confidential.  22 M.R.S.A. § 815.

Any report on human immunodeficiency virus or acquired immunodeficiency syndrome submitted in accordance with Title 18 of the Health-General Article is exempt from disclosure. § 4-329(b)(3). A request by a person in interest may not be denied, however, by an agency merely because the person seeks the identity of the source of infection, or because the information sought was gathered in the course of an agency's investigation of an outbreak or an infectious disease. See Haigley v. Department of Health and Mental Hygiene, 128 Md. App. 194, 228, 736 A.2d 1185, 1202-03 (1999).

“As a general rule, medical information [about an identifiable individual] will always be of a sufficiently personal nature to warrant exemption” under the privacy exemption. Guide to Mass. Pub. Recs. Law at 17 (Sec’y of State, rev. Mar. 2020), https://www.sec.state.ma.us/pre/prepdf/guide.pdf.

Not specifically addressed.

These records are not specifically addressed in the Act.

No specific state law.

Mo.Rev.Stat. § 191.656: HIV Testing. Any information or records containing a person’s HIV infection status or the results of any individual’s HIV testing are confidential, and may be disclosed only to certain persons designated in Mo.Rev.Stat. § 191.656 (e.g., certain public agencies, adoptive or foster parents, day care facilities, group homes). The statute authorizes civil actions for violation. Mo.Rev.Stat. § 191.686 authorizes the Department of Health to identify children who test positive for HIV to schools that adopted a policy consistent with the recommendations of the Centers for Disease Control. Such schools may in turn release that information to certain persons who “need to know” the child’s identity in order to provide proper health care.

No statutory or case law on this issue.

Medical records of individuals are not public. Otherwise, not addressed by public records statutes.

There is no statutory or case law addressing the issue

Neither the Statute nor case law addresses this issue.

N.J.S.A. 47:1A-1.1 exempts from the definition of “Government Record:”

emergency or security information or procedures for any buildings or facility which, if disclosed, would jeopardize security of the building or facility or persons therein;

security measures and surveillance techniques which, if disclosed, would create a risk to the safety of persons, property, electronic data or software.

Additionally, N.J.S.A. 47:1A-5(i)(2) provides:

(2) During a period declared pursuant to the laws of this State as a state of emergency, public health emergency, or state of local disaster emergency, the deadlines by which to respond to a request for, or grant or deny access to, a government record under paragraph (1) of this subsection or subsection e. of this section shall not apply, provided, however, that the custodian of a government record shall make a reasonable effort, as the circumstances permit, to respond to a request for access to a government record within seven business days or as soon as possible thereafter.

Any person may obtain any aggregate data publicly disseminated by the Department of Health.  NMSA 1978 § 24-14A-6(C).

No law addresses the issue directly.

All information and records, whether publicly or privately maintained, that identify a person who has AIDS virus infection or who has or may have a disease or condition required to be reported is confidential. However, such information may be released or made public under the following circumstances:

(1) Release is made of specific medical or epidemiological information for statistical purposes in a way that no person can be identified;

(2) Release is made of all or part of the medical record with the written consent of the person or persons identified or their guardian;

(3) Release is made for purposes of treatment, payment, research, or health care operations to the extent that disclosure is permitted under 45 Code of Federal Regulations §§ 164.506 and 164.512(i).;

(4) Release is necessary to protect the public health and is made as provided by the Commission in its rules regarding control measures for communicable diseases and conditions;

(5) Release is made pursuant to law;

(6) Release is made pursuant to subpoena or court order;

(7) Release is made by the state or local health department to a court or a law enforcement official for the purpose of enforcement, or investigating a terrorist incident using nuclear, biological, or chemical agents;

(8) Release is made by the state or local health department to another federal, state or local public health agency for the purpose of preventing or controlling the spread of a communicable disease or communicable condition;

(9) Release is made by the state health department for bona fide research purposes. The Commission shall adopt rules providing for the use of the information for research purposes;

(10) Release is made pursuant to applicable statute; or

(11) Release is made pursuant to any other provisions of law that specifically authorize or require the release of information or records related to AIDS. G.S. § 130A-143.

To protect the integrity of disease control records, to ensure their proper use, and to ensure efficient and proper administration of the department of health’s disease control function, it is unlawful for any person to permit inspection of or to disclose information contained in disease control records, including results of laboratory tests, or to copy or issue a copy of all or part of any such records. N.D.C.C. § 23-07-20.1.

The Ohio Revised Code sets forth a specialized process for obtaining records regarding HIV status from the Department of Health. Ohio Rev. Code § 3701.243. Information obtained by the Department of Health’s partner notification system in conjunction with AIDS task forces are specifically excluded from public records; disclosure of these records requires an application using the process set forth in § 3701.243. Ohio Rev. Code § 3701.241(A)(7).

Not within the scope of vital statistics in Oklahoma, which are confidential and defined as “records of birth, death, fetal death and data related thereto.” 63 O.S. § 1-301.

ORS 433.008 exempts “[i]nformation obtained by the Oregon Health Authority or a local public health administrator in the course of an investigation of a reportable disease or disease outbreak,” with enumerated exceptions for disclosure to state and federal agencies, health care workers, persons with communicable diseases, and certain others, unless there is “clear and convincing evidence that the release is necessary to avoid an immediate danger to other individuals or to the public.”

Records of AIDS-related testing, treatment and counseling are confidential and may not be released except as specified by the Pennsylvania Confidentiality of HIV-Related Information Act. See 35 P. S. §§ 7607-7608. The person who is the subject of such records may give his or her written consent to disclose HIV-related information, but the form, content, and expiration dates of such consensual disclosures are strictly regulated by law. Id. § 7607. Courts may also release AIDS records when the person seeking the information or the person seeking to disclose the information establishes a “compelling need” for the information. Id. § 7608. This is a very high standard of proof that rarely will be met.

There is no statutory or case law addressing this issue.

Individual medical records are exempt from disclosure under federal law, and sexually transmitted disease records are confidential.  S.C. Code Ann. § 44-29-135. Reports are required to be made to the State Department of Health and Environmental Control in instances of deaths from contagious or infectious diseases and chemical or other terrorism. The reports are to include the name and address of the patient and the nature of the disease. S.C. Code Ann. § 44-29-10.  It is possible that the information without the patient identifying information would constitute a public record under state law.

Generally closed. See SDCL §34-22-12.1

Frequently closed. T.C.A. §§ 68-5-604, 703; 68-10-113, 116, 117; 68-11-222.

Not specifically addressed.

Communicable disease information relating to an individual is confidential and may be released only in accordance with enumerated requirements. See Utah Code § 26-6-27.

Healthcare providers are required to report diagnoses of certain communicable diseases as well as any illness, disease, injury or death identified by the department of health as likely to be caused by a weapon of mass destruction. 13 V.S.A. § 3504(a)(1); 18 V.S.A. § 1001. Information collected pursuant to 13 V.S.A. § 3504(a)(1) or 18 V.S.A. § 1001 is considered privileged and confidential. 13 V.S.A. § 3504(g); 18 V.S.A. § 1001.

All information and reports in connection with persons who have venereal diseases shall be regarded as absolutely confidential and for the sole use of the Board of Health in the performance of its duties hereunder, and such records shall not be accessible to the public nor shall such records be deemed public records. 18 V.S.A. § 1099.

Vermont will provide medical testing to the victims of sexual violence and the results of such testing shall remain confidential. 13 V.S.A. § 3256(g)(2).

Patient level information that is collected for health case data reporting purposes are exempt from the Act and publicly released data must be a format so to ensure patients cannot be identified. Va. Code Ann. § 32.1-276.9.  A person making a disclosure of information subject to this confidentiality provision is subject to a civil penalty of up to $5,000 per violation.

While the Public Records Act contains numerous exemptions related to personal health care information, no specific provision governs access to statistics regarding epidemics.  The state Department of Health gathers and periodically reports on incidents of certain diseases.  See WAC 246-100; id. 246-101.

(This section is blank. See the point above.)

Wisconsin has not addressed these records.

Closed to the extent they reveal personally identifiable medical data on individuals.