Medical Records and the Law

348 CHAPTER 9: HIV/AIDS: MANDATORY REPORTING AND CONFIDENTIALITYIn at least one state, a state supreme court has ruled that a mandatorydisclosure statute that requires physicians to report to the state departmentof health the names and addresses of patients who areHIV-positive or suffer from AIDS is not unconstitutional. 17 An Alabamastatute imposing this requirement was challenged by a physicianwho was willing to report certain statistical data, but refused to providethe names and addresses of patients; the department of health sued tocompel the physician’s full compliance with the reporting statute. Thephysician argued that the statute violates the equal protection clausebecause sellers of confidential HIV-testing kits and out-of-state laboratoriesthat evaluate test results are not required to report the namesand addresses of purchasers. In rejecting this argument, the court concludedthat out-of-state testing labs and testing kit vendors are notsimilarly situated to those individuals required to report HIV andAIDS cases. The court therefore ruled that the reporting requirementwas constitutional. The labs do not know the identity of the personswho are being tested, and the testing-kit vendors sell kits withoutknowing whether a particular purchaser is HIV-positive or suffers fromAIDS, the court explained.The court thus affirmed a lower court decisionordering the physician to disclose identifying information as requiredby the statute.Protecting Confidentiality of HIV-Related InformationThe Privacy Rule and the Security RuleAs a general rule, a covered entity may not disclose PHI without thepatient’s authorization, unless the Privacy Rule specifically permits thedisclosure. If the information is created in a blind HIV test, so that thedata contain no patient identifiers, the information is not PHI and isnot entitled to HIPAA Privacy Rule protection. If the HIV/AIDS informationcontains patient identifiers, covered entities may disclose it ifrequired to do so by state law (for example, mandatory reportingstatutes), in connection with public health agency activities (such asdisease prevention), protection of individuals’ health or safety (for example,permitted disclosures to individuals who may be exposed toHIV or AIDS), and other purposes described in the rule. (For a more17Middlebrooks v. State Board of Health, 710 So. 2d 891 (Ala. 1998).