HIV status and reporting requirements raise legal issues related to patient confidentiality. Legal protection of patient privacy and confidentiality depends on whether or not public health concerns outweigh the interest in preserving the doctor-patient privilege. The balancing of these interests is a particular challenge when it comes to privacy concerns associated with HIV status.
A core legal dilemma in the case of HIV/AIDS is determining when the need to protect others, such as sex partners to whom the patient is likely to transmit HIV, supersedes the patient's right to confidentiality. Public policy encourages high-risk groups to submit to HIV testing because those individuals who know they are HIV-positive are more likely to seek treatment and take precautions that may prevent transmission of the virus. However, if HIV-related information is readily disclosed by health care providers, individuals may become more reluctant to seek testing. When does the protection of others through a breach of patient confidentiality, ie, reporting cases to the authorities, become worth the risk to that individual who may be HIV-positive will avoid testing in order to avoid being reported?
All 50 states require both physicians and laboratories to report to local or state health departments the names of persons newly diagnosed with Centers for Disease Control-defined AIDS. 1 However, because AIDS cases represent onset of the disease caused by HIV, HIV data is necessary to monitor the epidemic.
But HIV reporting requirements currently differ among states. The 3 main HIV reporting systems are name-based reporting, code-based reporting, and name-to-code-based reporting. In code-based reporting, coded identifiers are substituted for names. Name-to-code-based reporting means that cases were initially reported by name, but were converted to code after public health follow-up and collection of epidemiologic data.
In 1999, the CDC recommended that all states implement HIV reporting systems; however, the CDC does not accept HIV reporting data from the 9 states that use code-based systems due to their unreliability. 2 Beyond their use as an epidemiologic tool, reliable data are important under the reauthorization of the Ryan White CARE Act, since the federal government may include CDC-confirmed HIV case data in applying the Ryan White CARE Act funding formula. 3,4
Forty-three state (including New York, Florida, Texas, Ohio, and New Jersey,) and local health departments have implemented confidential name-based HIV reporting, 5 while approximately 14 other state and local health departments use code-based or name-to-code reporting methods. 6 States that use name-to-code systems include Oregon and Washington; California and Massachusetts use a code-only system. 7 Some states, Texas and Kentucky, for example, that once used code-based HIV reporting, have changed to name-based systems.
Many argue that code-based reporting systems are not as effective as name-based systems and have prevented physicians and public health officials from contacting those who have had sexual contact or shared needles with HIV-positive individuals. 8 Such results have produced demands for more name-based reporting for the purposes of tracking, public health, and allocation of resources for outreach.
Partner notification is critical so that individuals know they are at risk, receive HIV counseling and testing, and get appropriate medical care. One of the most controversial issues is whether physicians may disclose the HIV status of their patients to known contacts and, further, whether failure to do so may give rise to liability if the known contact becomes HIV-positive. Though the threat of the contact is clear and immediate, individuals may be discouraged from undergoing testing if they know someone will notify contacts.
In other contexts, physicians have faced liability for not warning third parties of foreseeable harm. For example, a California court held that a psychotherapist had a legal duty to warn a third party of foreseeable harm, despite the presence of the client-therapist privilege. 9 A Tennessee Court held that a physician has a duty to warn possible third parties of the risks of exposure to a noninfectious disease, ie, Rocky Mountain Spotted Fever. 10 Thus, case law contains legal precedent that justifies dissemination of information to prevent third-party harm. Yet, to date, attempts to create a duty for physicians to protect endangered third parties in HIV cases have been unsuccessful. In 2 such cases, the courts refused to impose an affirmative duty on the physicians to notify a third party. Both parties sued, alleging intentional infliction of emotional distress because of their fear of contracting AIDS. 11 Laws to determine the boundaries of liability and reporting in HIV and AIDS will have to be developed because, clearly, there are conflicting legal doctrines at work in the mandatory reporting case law that judges have made.
To add to the confusion, state statutes vary as to whether a patient's HIV status can be disclosed to contacts. Many states have laws about informing contacts of their HIV exposure, and some health departments require that if a patient refuses to report a partner who may have been exposed, the clinician must report to the health department any partner of whom the clinician is aware. 12 Some states also have laws mandating a duty to warn, thus requiring disclosure by clinicians to third parties known to be at significant risk for future HIV transmission from patients known to be infected. 12 And health departments that receive Ryan White funds are required to show good faith efforts to notify marriage partners of HIV-infected patients. 12
Overall, state statutes generally fall into 3 types: (1) some state statutes mandate that the physician provide the contact's name to the state health agency; the state health agency then notifies the contact; (2) some states give the physician the choice of notifying either the state health agency or the third-party contacts directly; and (3) other states make such disclosures to a state agency optional. 13 The tremendous variation of these provisions indicates that physicians should always seek advice from public health departments and their own attorneys to understand their legal responsibilities.
When disclosure is appropriate or required, physicians should disclose HIV/AIDS information, which is protected health information, in accordance with its extremely confidential nature as required by city, state, and federal laws and regulations, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
A number of lawsuits have been filed by individuals who claim, among other things, that the information regarding their condition was disseminated publicly and needlessly. Furthermore, punitive damages have been allowed for wrongful disclosure of a plaintiff's HIV status in violation of a confidentiality statute. 14 However, reports to public health agencies and other public health authorities under state regulations are not violations of HIPAA. Further, sharing of HIV and AIDS information for the purposes of treatment, payment, or health care operation functions such as quality assurance and improvement is also permitted under the federal privacy rule. Therefore, physicians should not hesitate to follow the provisions of reporting requirements since appropriate reporting will not violate the HIPAA provisions for patient privacy.
Ethical issues are associated with any discussion of HIV reporting and contact notification. Ethical principles that come into conflict include the right to know, the right of confidentiality and privacy, protection against discrimination, the duty to warn, and the duty to protect the public health. While public health officials usually perceive being responsive to the greater good of the population as their duty, physicians see maintaining the bond between themselves and their individual patients as their duty. Mandatory reporting requirements may seem to conflict with the physician's ethical obligations, including the Hippocratic Oath, which prohibits inappropriate disclosure of any kind of personal health information.
However, the AMA Code of Medical Ethics Opinion 5.05 states that information disclosed to a physician by a patient is confidential but subject to certain exceptions that are ethically and legally justified because of overriding societal considerations:
Where a patient threatens to inflict serious bodily harm to another person or to him or herself and there is a reasonable probability that the patient may carry out the threat, the physician should take reasonable precautions for the protection of the intended victim, including notification of law enforcement authorities. 15
The Code also notes that communicable diseases should be reported as required by applicable law. This utilitarian approach fulfills the physician's duty to be an agent of the individual patient but in the context of the potentially greater good of the society in which he or she practices.
Specifically with regard to HIV-infected patients, exceptions to confidentiality do exist. As stated in Opinion E-2.23:
If a physician knows that a seropositive individual is endangering a third party, the physician should, within the constraints of the law (1) attempt to persuade the infected patient to cease endangering the third party; (2) if persuasion fails, notify authorities; and (3) if the authorities take no action, notify the endangered third party. 16
As a policy matter, the AMA strongly recommends that all states adopt requirements for confidential HIV reporting to appropriate public health authorities for the purpose of contact tracing and partner notification. 17 The AMA encourages uniform protection of the identity of HIV patients that is consistent with public health departments and vows to continue to address, through the Council on Ethical and Judicial Affairs, the patient confidentiality and ethical issues raised by known HIV-positive patients who refuse to inform their sexual partners or modify their behavior. 17 The AMA also supports legislation on the physician's right to exercise ethical and clinical judgment regarding whether or not to warn unsuspecting and endangered sexual or needle-sharing partners of HIV-infected patients and promulgates the standard that a physician attempt to persuade an HIV-infected patient to cease all activities that endanger unsuspecting others and to inform those whom he or she might have infected. As stated above, if such persuasion fails, the physician is urged to pursue notification through means other than by reliance on the patient, such as by the Public Health Department or by the physician directly. 17
The tension between reporting and confidentiality in HIV and AIDS cases is difficult for physicians. Although the ends of the spectrum may provide for relatively clear action—such as when an infected patient is known to engage in unsafe sexual practices without disclosure—the discussion of HIV disclosure is a difficult issue. Patients may be debilitated and physically vulnerable and may be subject to significant insurance and social discrimination if HIV status is wrongfully disclosed.
Physicians must be cognizant of their patients' circumstances and the sensitivities surrounding the discussion of HIV disclosure. This means that they should know their patients well and follow the well-worn aphorism to treat the patient as an individual, rather than as simply a disease. Although the discussions may not be any easier or the actions any less difficult to take, the path toward fulfilling the needs of the patient—and the society in which we all live—may become more clear. Ultimately, this approach will bring the physician-patient relationship back to the fundamentals: to a foundation of trust and open communications that can result in the best outcome for the patient.