May 21, 2001

Office of Regulations
California Department of Health Services
714 P Street, Room 1000
P.O. Box 942732
Sacramento, CA 94234-7320

by fax: (916) 657-1459

Re: Proposed HIV Disease Surveillance Reporting Regulations Control Number R-19-00

Dear Sir/Madam:

We are writing, on behalf of the ACLU of Southern California, the ACLU of Northern California, and Lambda Legal Defense & Education Fund, to provide comments on the California Department of Health Services' (DHS) proposed regulations concerning the implementation of HIV surveillance through reporting of confirmed HIV tests to local health officials and thereafter to DHS.

Whether mandatory HIV case reporting is a sound public health measure is a complex question. Although case reporting has been strongly recommended by the Centers for Disease Control and Prevention as a method of gathering data about the HIV epidemic, it also raises serious privacy concerns, risks of deterring HIV+ individuals from seeking testing and treatment, and concerns about the accuracy of the data it generates about the HIV epidemic.

If DHS is committed to implementing an HIV case reporting system, we strongly support DHS's proposed use of a Unique Identifier (UI) system rather than a name-based system. As the experience of other states has shown, UI systems are as effective as name-based systems in generating data about the HIV epidemic and have less potential for invading patients' privacy and deterring testing and treatment.

Our principal comments on the proposed regulations are as follows: (1) the proposed method of generating the UI should be modified to protect patient confidentiality better and to reduce the possibility of deterring at-risk populations from seeking testing and treatment; (2) anonymous testing without reporting requirements must be preserved as a trusted alternative; and (3) DHS should not rely on case reporting alone to track the HIV epidemic, but should supplement this data with other methods of gathering information on the incidence of HIV to correct for the underreporting and demographic biases that are inherent in case reporting.

1. The proposed method of generating the Unique Identifier (UI) should be amended.

To minimize deterrence of testing and treatment, the method of generating the UI should address both actual risk of breaches of confidentiality, and community perceptions regarding such risk. The UI method should also seek to avoid disproportionate impacts on at-risk subpopulations (e.g. immigrants).

Patients' fears about violations of confidentiality of HIV testing are not illusory. There have been several known instances of breaches of confidentiality. For example, computer disks containing the names of over 4000 HIV+ individuals were misplaced or stolen from the Florida State Health Department AIDS Registry in 1996.1

The UI method described in the proposed regulations contains enough unencrypted information -- complete date of birth, first initial of last name, gender, and partial Social Security number -- to create a significant risk that individual patients could be identified. (For example, consider a male-to-female transsexual living in a rural area; this person might easily be identified from the gender and birth date elements of the UI alone, given that the forms also include zip code.)

We urge DHS to modify the proposed UI system to ensure that the UIs cannot be traced back to patient names. For instance, the UI system could utilize information that is unique and accessible to patients but harder to trace, such as mother's name, place of birth, etc. Also, DHS should consider the use of computer scrambling techniques that would further encrypt the UIs, while still ensuring that they are unique and unduplicated.

Moreover, in addition to minimizing actual risks of breaches of confidentiality, the UI method must be sensitive to community perceptions of risk, and fears of government intrusion that are prevalent in many at-risk populations (e.g. injection drug users, men who have sex with men, persons of color and immigrants). Specifically, we strongly urge DHS to modify the proposed UI method to avoid the use of partial Social Security numbers. Many people do not have SSNs, do not remember them, or regard them as sensitive information and are reluctant to disclose them. The use of SSNs as part of the UI is especially problematic in many areas of California where there are large immigrant populations.2 Asking patients for SSNs will generate fear of INS reporting within immigrant communities, which could have a serious deterrent effect on testing and treatment.

For these reasons, DHS should amend the proposed regulations to omit the use of partial SSNs, and use an alternative such as the unique record number currently used by the San Francisco Department of Public Health, or use patient-chosen personal identification numbers or PINs (akin to those routinely used by banks).

We also concur in the comments submitted by the California HIV Surveillance Coalition and the San Francisco Department of Public Health concerning the need for explicit policies and procedures to ensure confidentiality of reported information at the state level; the need to resolve confidentiality concerns regarding matching of databases; the importance of outreach and education for HIV-impacted communities about the reporting system and confidentiality protections; and the need to explain to confidential testers why information is being requested from them and how it will be used. It is also critical that the state provide all outreach and patient-education information, both written and verbal, in a range of non-English languages used by local at-risk communities.

All of these safeguards are necessary to avoid deterring people from getting tested and seeking treatment-and thus worsening the very epidemic that case reporting is intended to help combat. Moreover, amending the proposed regulations to better protect patient confidentiality will serve DHS's overall goals of encouraging at-risk individuals to get tested, learn their HIV status, take precautions to avoid infecting others, and get treatment.

2. Anonymous testing must be preserved as a genuine and trusted alternative to confidential testing.

We strongly support DHS's decision to exclude alternative and anonymous HIV test sites from the proposed reporting requirements, and urge DHS to take steps to reassure HIV-impacted communities that anonymous testing remains available. The continued availability of anonymous testing is essential to mitigate the deterrent effects on testing that are unavoidable effects of any case-reporting system, no matter how secure the UI.

We share the concern expressed by the California HIV Surveillance Coalition that DHS's proposal to require collection of additional information at anonymous test sites - at the same time that DHS is proposing to implement reporting requirements for confidential test sites - will create fear and confusion in HIV-affected communities. It must remain clear to HIV-affected communities and at-risk individuals that anonymous testing remains available as a genuine and safe alternative to confidential testing. For this reason, we join in urging DHS to modify the new HIV Counseling and Information Form (DHS 8458 11/1/2000) to address this concern.

3. Case reporting data alone is inadequate to track the HIV epidemic.

Several recent studies have shown that case reporting data derived from confidential HIV tests has limited utility in tracking the HIV epidemic. First, case reporting data underestimates the actual incidence of HIV, because many asymptomatic HIV+ individuals do not seek testing. States with HIV case reporting systems (both name-based and UI-based) have reported far lower numbers of HIV cases than would be expected, given the number of AIDS cases in those states and the estimated ratio of HIV and AIDS cases.3

As recognized by former DHS Director Kimberly Belshé,

[M]andatory HIV reporting would not greatly increase our knowledge of incident HIV infections. In the absence of a reliable serologic marker for recency of infection, reporting HIV infection data would primarily identify prevalent infections. Misinterpretation of HIV infection data could lead to serious underestimation of the true prevalence and burden of HIV infection in California.4

In addition, the undercounting of HIV incidence through case reporting will be demographically biased, since certain subpopulations that are particularly likely to engage in high-risk behavior are also likely to avoid any testing system where personal information is requested, or to avoid testing altogether -- including immigrants, men who have sex with men, injection drug users, people who have engaged in prostitution, and people of color.5 Thus, case reporting alone fails to reveal crucial information about shifts in the HIV epidemic. For example, the recent highly publicized finding that one in three gay or bisexual African-American men is HIV+ was not revealed by case reporting data, but by a CDC prevalence study.

Moreover, given the possibility that future federal funding will be tied to HIV data,6 there is a serious risk that California's future funding will be adversely affected by the undercounting inherent in all HIV case-reporting methods.

For these reasons, we urge DHS to develop, fund, and implement additional methods of gathering HIV data, such as blinded incidence and prevalence studies and "sentinel" studies.7 The results of these supplemental methods of gathering HIV data should be used to determine the extent of, and to correct for, underreporting of the actual incidence of HIV and demographic bias in the HIV case-reporting data.

Thank you for the opportunity to provide comments on the proposed HIV surveillance regulations. Please do not hesitate to contact us if we can provide any further information about the basis for our comments.

Sincerely,

Martha Matthews, Bohnett Attorney
ACLU of Southern California

Jon W. Davidson, Senior Counsel
Lambda Legal Defense & Education Fund
Western Regional Office

Robert Kim, Staff Attorney
ACLU of Northern California

1 S. Landry, "AIDS List is Out: State Investigating Breach," St. Petersburg Times, Sept. 20, 1996, pp. 1-A, 10-A.
2 See Johri et al., "New Approaches to HIV Surveillance: Means and Ends," 14 J. AIDS & Public Policy 4, 136, at at p. 141 (Winter 1999).
3 Centers for Disease Control and Prevention, HIV/AIDS Surveillance Report, Mid-Year 2000 Edition, Vol. 12, No. 1 (Dec. 2000).
4 March 7, 1994 letter from S. Kimberly Belshé, Director of DHS, to David R. Holley, MD, President, California Medical Association.
5 Institute of Medicine, National Academy of Sciences, No Time to Lose: Getting More from HIV Prevention, pp. 17-18 (2000); Johri et al., "New Approaches to HIV Surveillance: Means and Ends," 14 J. AIDS & Public Policy 4, 136-146 (Winter 1999); Solomon et al, "Barriers to HIV Testing and Confidentiality: the Concerns of HIV-Positive and High-Risk Individuals," 14 J. AIDS & Public Policy 4, 147-156 (Winter 1999).
6 Ryan White CARE Act Amendments of 2000, Sec. 111(b)(1) & (2) (if Secretary determines that available data on HIV cases is sufficiently accurate and reliable, funding allocations starting in 2005 will be based on HIV case numbers in addition to AIDS cases).
7 See Institute of Medicine study, supra n. 5, at pp. 19-22; Johri et al. at pp. 142-143.

return to HIV Surveillance Page