COLORADO SPRINGS, Colo. -- (KRDO) — Public health officials in Colorado are sharing health information, including names and addresses, of people who have tested positive for COVID-19 with first responders.
The Colorado Department of Public Health and Environment told KRDO when conducting work as a public health authority, state and local public health agencies are not bound to HIPPA laws. In that scenario, agencies can provide patient health information about those who test positive for COVID-19. In Colorado, health officials say they can share that information with law enforcement, paramedics, and other first responders.
Public health officials in at least two-thirds of U.S. states are sharing these addresses with first responders, according to a report from the Associated Press. But only 10 states, Colorado included, are sharing names. The purpose of this is meant to protect first responders from possible infection, according to the AP.
CDPHE said in an email to KRDO it is "recommended that the minimum necessary" information be disclosed to accomplish the intended purpose of the disclosure. However, it doesn't appear that there is a limit on what they can release to law enforcement and other first responders.
According to an El Paso County Public Health spokesperson, local health officials are only providing addresses to first responders. The addresses reported to law enforcement in El Paso County are those who are still considered to be infectious, meaning symptoms began within the last 10 days.
"So, we don't have a name," Colorado Springs Department Lt. James Sokolik. "We're not providing that personal information. There's just an address. Also, with that address, we're going to receive a date when that person is no longer going to be considered infectious."
The Colorado Springs Police Department said once it receives the information a temporary be on the lookout, or BOLO is issued.
"It's a very standard, very generic message that doesn't identify anybody or doesn't identify exactly what that BOLO is there for," Sokolik said. "But it basically says there's a temporary BOLO here and personal protective equipment is recommended."
The American Civil Liberties Union of Colorado is raising concerns about the practice by Colorado public health officials. Legal Director Mark Silverstein believes people may feeling unfairly targeted if they tested positive for COVID-19.
"A list of everyone who has tested positive for COVID-19 probably represents a 10th or a 20th," Silverstein said. "So if first responders are only protecting themselves from people who have had positive tests, they aren't going to be protecting themselves very well."
ACLU Colorado wants strict guidelines and enforcement in place for preventing the data from being used in other ways.
"It's not going to achieve its intended purpose," Silverstein said. "It's invading privacy without achieving its intended purpose."
Colorado health officials are allowed to release "medical records and other individually identifiable health information used or disclosed by a covered entity in any form."
CDPHE released this list of reasons of why and when they can share COVID-19 patient data:
- When needed to provide treatment;
- When required by law. Colorado Board of Health Rule 6 CCR 1009-1, Epidemic and Communicable Disease Control requires all severe or novel coronavirus, including severe acute respiratory syndrome coronavirus (SARS-CoV) such as coronavirus (COVID-19) be reported immediately to CDPHE by laboratories, healthcare providers, or other persons knowing of or suspecting a case (e.g,. coroners, hospital staff, and school staff);
- When notifying a public health authority in order to prevent or control spread of disease;
- When first responders may be at risk for an infection;
- When disclosure is necessary to prevent or lessen a serious and imminent threat; and
- When responding to a request for PHI by a correctional institution or law enforcement official having lawful custody of an inmate or other individual.
If you have a story you'd like KRDO to investigate, please email email@example.com.