Overview

Public health agencies need to collect, use, and share information to prevent disease and injury and protect the public against natural, accidental, and intentional health threats. Various federal and state laws may impact public health activities regarding such information.

Public health agencies may collect and maintain information that identifies an individual or is sensitive in nature, such as information about communications systems or detailed emergency response plans. In these situations, freedom of information (FOI) laws establish parameters for information that must be shared, upon request, and that which may be exempted from public disclosure. In applying the laws, public health agencies may need to juggle competing interests and balance individual privacy against the need to protect or inform the public.

Public health agencies face additional challenges when sharing information with law enforcement, especially when conducting a joint investigation where a public health threat may involve criminal activity. (See ASTHO Public Health Collection, Use, Sharing and Protection of Information Issue Brief  and Authorities and Limitations in Sharing Information Between Public Health Agencies and Law Enforcement Issue Brieffor detailed analyses of issues and law.) (Download a printable PDF.)

Constitutional Considerations

Generally, state and local public health agencies have broad and flexible authority to protect the public health. However, the exercise of governmental power has limits. The United States Constitution contains a Bill of Rights¹ that sets out individual liberties and protects individuals from the arbitrary use of governmental power. These rights may impact public health collection and sharing of information.

Right to Privacy
The Constitution provides a limited right to privacy, including “informational privacy.”² State laws that require reporting of or public health agency access to identifiable information are permissible when they are reasonably directed to the preservation of health and properly respect a patient’s confidentiality and privacy.³

Right Against Unreasonable Search and Seizure
With the owner’s permission,⁴ public health agencies may enter or search the premises of an individual or business, take biological specimens or environmental samples for testing, copy records, and remove evidence that might be relevant to a public health concern. However, absent consent or the applicability of another exception, public health agencies must comply with requirements in the U.S. Constitution’s Fourth Amendment.

The Fourth Amendment requires that a warrant be obtained, based upon probable cause, to search someone’s premises or seize their property. The Fourth Amendment applies to both criminal investigations and health and safety inspections and investigations.⁵ In addition to consent, other exceptions to the warrant and probable cause requirement might apply to public health inspections and investigations, including searches of pervasively regulated businesses,⁶searches of premises or items open to the public,⁷ and searches based on exigent circumstances if delay is likely to lead to injury, public harm, or the destruction of evidence.⁸

Right Against Self-Incrimination
The Fifth Amendment right against self-incrimination prevents the government from forcing an individual to be a witness against himself or herself during trial or a custodial interrogation. If an individual is not informed of his or her right against self-incrimination, the individual’s statements and evidence obtained as a result of these statements may be suppressed in criminal proceedings. This right may arise when a public health incident involves criminal activity, especially when law enforcement and public health investigators are conducting joint interviews or public health agencies assist law enforcement to gather evidence.⁹

---

Practice Notes

• Identify information to be obtained or shared.
• Identify the purpose for which the information is needed.
• Determine whether this is the minimum necessary for the purpose or whether de-identified information will serve the purpose.
• Identify sources for the information, such as healthcare providers, schools, other businesses, and individuals.
• Identify applicable federal or state laws.
• Determine and meet conditions or requirements for obtaining or sharing information; in some situations, an individual’s consent may avoid legal issues when disclosing private information.
• If privacy protections prevent disclosures necessary to protect the public, consult with counsel to identify relevant legal responsibilities, evaluate competing moral claims, and document determined course of action.

---

State Constitutions
State constitutions, along with court decisions that interpret state constitutions, must be reviewed to identify individual rights that exceed the U.S. Constitution. State constitutions may be sources of additional provisions that govern information sharing; for example, some constitutions define individual privacy rights or cover the public’s right to obtain governmental records.

State Statutes

Generally, state law governs state and local public health agencies’ authority and responsibilities regarding collection, use, disclosure, and protection of information. State laws vary in nature and scope. Authority may be based on general statutes, such as public health laws that grant public health agencies communicable disease control authority. Specific laws may also apply.

Case Reporting
These laws mandate that healthcare providers, laboratories, and others report specific communicable diseases and other illness of public health concern. Reporting requirements vary by state, and may also include poisonings, chemical or radiological exposures, suspected acts of terrorism, and other conditions.

Syndromic Surveillance
State laws may require or authorize reporting to electronic syndromic surveillance systems of information that is routinely gathered in emergency rooms or other places that may indicate an emerging disease or other public health threat before confirmed diagnoses are made.

Investigatory Authority
State laws may specifically grant public health agencies authority to conduct investigations and gather evidence, or such authority may arise from general statutory powers. State laws may also establish procedures for obtaining warrants to search the premises of an individual or business and seize evidence related to a public health threat.

Privacy Provisions
Public health or other laws may contain provisions to protect the confidentiality of information that identifies an individual and to limit its disclosure by public health agencies. Exceptions may be provided, for example, for disclosing information to other agencies, law enforcement, or the public when necessary to protect the public’s health.

Freedom of Information
All states have laws that require information held by governmental agencies to be provided upon request. FOI laws promote transparency and accountability of governments, facilitate consumers’ ability to make informed choices, and safeguard citizens against mismanagement and corruption. Public health agencies—like other governmental agencies—need to be sensitive to these important considerations in responding to FOI requests. At the same time, these laws may create challenges for public health agencies with regard to requests for private information about individuals or sensitive information, such as information that is preliminary, incomplete, or might present a national or state security risk. FOI laws include exemptions that may allow public health agencies to withhold private or sensitive information under certain circumstances. These exemptions vary among states in nature, scope, and prerequisites for denying disclosure.

Federal Statutes

Federal laws that impact collection, use, disclosure, and protection of information by public health agencies include, but are not limited to, the following.

HIPAA Privacy Rule
The Privacy Rule¹⁰ adopted under the Health Insurance Portability and Accountability Act (HIPAA)¹¹ established national privacy protections for individually identifiable health information. The Privacy Rule may apply to healthcare providers or others that provide information to public health agencies. Depending on a public health agency’s organization, the Privacy Rule may apply to a public health agency when it discloses individually identifiable information. The Privacy Rule is not intended to interfere with public health functions and contains provisions that allow public health agencies to collect identifiable health information and disclose it, including to law enforcement, when authorized by law or when necessary to protect the public from an imminent threat.

FERPA
Privacy protections established by the Family Educational Rights and Privacy Act (FERPA)¹² limit information that schools may provide to public health agencies about students. However, exceptions allow schools to provide certain directory information, such as student name and contact information, and necessary information to appropriate officials in cases of health and safety emergencies.¹³

Surveillance Data Systems
Various federal laws, such as the Public Health Security and Bioterrorism Preparedness Act of 2002,¹⁴ establish surveillance data systems that allow collection of information provided by state and local governmental agencies and integration of federal, state, and local data systems.

Critical Infrastructure
Confidentiality requirements apply to federal disclosure of certain information to state or local governmental agencies related to critical infrastructure and supplies and resources to protect the public’s health. For example, federal law protects the confidentiality of information voluntarily provided by the private sector to the federal government regarding vaccine tracking and distribution¹⁵ and information about critical infrastructure.¹⁶ Although the federal government may share this information with state and local government and agencies, those agencies must protect its confidentiality.

---

Practice Resource

The Reporters Committee for Freedom of the Press provides the Open Government Guide at http://www.rcfp.org/open-government-guide, which is a complete compendium of information on every state’s open records and open meetings laws. Each state’s section is arranged according to a standard outline, making it easy to compare laws in various states.

---

Sources

1. U.S. Const., Amds 1-10.
2. Whalen v. Roe, 429 U.S. 589 (1977).
3. Whalen v. Roe, 429 U.S. 589 (1977); Planned Parenthood of Missouri v. Danforth, 428 U.S. 52 (1976).
4. Florida v. Jimeno, 500 U.S. 248 (1991).
5. Camara v. Municipal Court, 387 U.S. 523 (1967) (search of residences); See v. City of Seattle, 387 US 541 (1967) (search of commercial property).
6. New York v. Burger, 482 US 691 (1987).
7. Gostin LO. Public Health Law – Power, Duty, Restraint. (2008), p 468, 699-700. See endnotes 57-58.
8. Michigan v. Tyler, 436 U.S. 499 (1978).
9. Richards, EP. “Collaboration between Public Health and Law Enforcement: The Constitutional Challenge. Emerging Infectious Diseases.” Available at http://wwwnc.cdc.gov/eid/article/8/10/02-0465_article.htm. Accessed 11-15-2012. Goodman, R.A., Munson, JW, Dammer, K., Lazzarini, Z., and Barkely JP. “Forensic Epidemiology: Law at the Intersection of Public Health and Criminal Investigations.” Journal of the American Society of Law, Medicine & Ethics. Available at http://www.ncbi.nlm.nih.gov/pubmed/14968670. Accessed on 2-7-2013.
10. 45 C.F.R. Parts 160 and 164.
11. Pub. L. 104-191, 42 U.S.C. § 300gg et seq.
12. Pub. L. 93-380, 20 U.S.C. § 1232g, implemented by 34 C.F.R. Part 99.
13. 34 C.F.R. § 99.31.
14. Pub. L. 107-188, 42 U.S.C. 300hh et seq.
15. Public Health Service Act, 42 U.S.C. § 247d-1.
16. Critical Infrastructure Information Act of 2002, Pub. L. 107-296, 6 U.S.C. 131 et seq., which is part of the Homeland Security Act of 2002.

Note: This document was compiled from April–November 2012 and reflects the laws and programs current then. It reflects only portions of the laws relevant to public health emergencies and is not intended to be exhaustive of all relevant legal authority. This resource is for informational purposes only and is not intended as a substitute for professional legal or other advice. The document was funded by CDC Award No. 1U38HM000454 to the Association of State and Territorial Health Officials; Subcontractor Subcontractor University of Michigan School of Public Health, Network for Public Health Law – Mid-States Region.

Source: ASTHO