States Without a Presumption
of Nondisclosure
We found that few, if any, of the
provisions recommended in the
MSHPA or MSEHPA had been
adopted in many states. We also
found that state approaches to the
use and disclosure of public health
information could be broken
down into 2 models (Table 1). In
the first model, state statutes offered
the public no general presumption
of the privacy, confi-
dentiality, or nondisclosure of
public health information, but
protect information associated
with specific diseases. About half
the jurisdictions (25 of 51) fit this
first model. The others (26 of 51)
established a general protection
for personally identifiable health
information maintained by the
health department, but allowed for
exceptions to disclosure and offered
more stringent protections
for specific disease information.
In the states that fit the first
model, it is worth noting that silence
on the protection of public health
data does not necessarily mean that
data were not protected in practice,
but the absence of clear statutes did
give rise to questions about what
approaches were being applied to
protect data and who was the responsible
party. One possible explanation
for the absence of an
overarching provision is that until
the mid-20th century, when understanding
of disease and treatment
options were limited, state
and local public health authorities
routinely disclosed the names and
addresses of individuals with infectious
diseases in newspapers to
warn or protect others from exposure.27
Although such disclosures
are usually not necessary in today’s
society, silence in the law may be
reflective of historical factors. Another
possibility is that the common
law privacy right under which
a health care provider is expected
to maintain the confidentiality of
a person’s health information,
known as the patient---physician
privilege, is misunderstood to apply
to public health authorities as well.
The patient---physician privilege is
the duty of physicians––or, in some
cases, all health care providers––to
maintain the confidentiality of information
obtained in the course of
treatment, in accordance with state
laws and HIPAA provisions.
In most of the states that lacked
an overarching provision protecting
all health information (model
1), there were statutes that provided
special protections for certain
types of disease information
related to HIV, sexually transmitted
infections (STIs), or other specific
health conditions. Eighteen
states had provisions for the protection
of HIV-related information,
11 had restrictions on the disclosure
of STI information (still called venereal disease in some state
statutes), and 2 had provisions
related to other disease-specific
information, such as tuberculosis.
This type of policy approach,
known as exceptionalism, is controversial
even within public
health. Whereas advocates are
more likely to have success in
pursuing legislation that addresses
specific, narrow objectives on
a single disease, state officials and
public health officials find that
the resulting policies have unintended
consequences, are not
supported by scientific evidence,
create disease-based silos within
the public health system, and can
quickly become outdated. For example,
in some states, laws that
were passed in the 1950s through
1970s provided special protections
for ‘‘venereal disease,’’ a term
that is not commonly used in
practice and that is not clearly
applicable to infections that may
be bloodborne or sexually transmitted.
In South Dakota, the law
required that ‘‘The identity of any
individual... pursuant to a report
of a venereal disease shall be
maintained in the strictest confi-
dence within the venereal disease
control system.’’28 Similarly, in
Tennessee the statute also explicitly
stated that disclosure of ‘‘venereal
disease’’ case reports was limited.