Privacy vs. Public Health

The UC San Diego AntiViral Research Center sponsors weekly presentations by infectious disease clinicians, physicians and researchers. The goal of these presentations is to provide the most current research, clinical practices and trends in HIV, HBV, HCV, TB and other infectious diseases of global significance. The slides from the AIDS Clinical Rounds presentation that you are about to view are intended for the educational purposes of our audience. They may not be used for other purposes without the presenter’s express permission.

AIDS CLINICAL ROUNDS

Privacy vs. Public Health

November 15,2013

Sanjay Mehta MD Susan Little MD

Molecular Epidemiology to Prevent HIV Infections

Vs.

www.dailytech.com and www.fanpop.com

http://www.dailytech.com

Question #1

What can be learned from a single pol HIV sequence (ie drug resistance test) added to a database of locally sampled HIV sequences?

A. Genotypic Drug Resistance B. Possible Transmission linkage (ie from who or to who HIV

may have been transmitted) C. Direction of an identified transmission D. Genotypic and Demographic Information about the individual E. Who may be at Increased Risk for HIV Acquisition F. A&B G. All of the Above

Question #2

How well does HIPAA protect patient privacy if guidelines are followed?

A. Extremely Well- privacy will remain unequivocally protected B. Very Well –privacy remains protected nearly all of the time C. Well – privacy remains protected most of the time, and is

usually adequate. D. Fair – privacy is somewhat protected, but better options do not

exist E. Poor – privacy is somewhat protected but better options do

exist

Question #3

Is an HIV sequence a HIPAA identifier? 1) Yes – all genetic data is explicitly

designated as a HIPAA identifier 2) Yes – since HIV sequence data is nearly

unique to an individual, it is an identifier 3) No – it is not listed as one of the 18 HIPAA

identifiers.

Question #4

Protected Health Information (PHI) can be released/used without authorization for the following purpose(s):

A. Treatment B. Billing C. Other Healthcare issues D. Public Health E. Research F. A&B G. A,B,&C H. A,B,C,&D I. All of the Above

Question #5

How worried are you that your personal health information would be unintentionally released during normal public health investigations?

Eg. 1) Partner notification 2) Epidemic Outbreak Investigations 3) Year End Summary Reports A) I think this is a real risk B) This would only happen with a breach in

security C) I have no concerns

Question #6

What do you feel is the appropriate threshold to disclose PHI for public health benefit?

A. Only a raging epidemic of a deadly disease with

thousands affected. (eg TB,HIV, malaria) B. An epidemic of a deadly disease with 100s of

individuals affected (Ebola, polio) C. Any raging epidemic of infectious origin (eg

influenza, west nile virus) D. Prevention of any infectious disease (eg norwalk

virus, MRSA)

Question #7

If you could predict which individuals were at risk for transmitting or acquiring HIV using viral sequence data, would it be reasonable to act on this information (i.e., prioritize prevention and treatment services to these individuals)?

A. Yes B. No

Case #1

On 2-11-2005 the NYC Dept of Health reported that a 46 yo MSM using crystal methamphetamine and regularly having unprotected sex was found to have acquired multidrug resistant HIV that rapidly progressed to AIDS (Patient X)

MMWR July 28, 2006

Case #1

Timeline showing total lymphocyte count and serologic testing results (arrows). Infection is presumed to have occurred ~October 2004 (double line)

Markowitz et al, Lancet 2005

Case #1

• Host and viral genotyping results


**Virus was 36% more fit than wild type HIV (i.e., potential for increased virulence)

Case #1

“Rare strain of multi-drug resistant HIV that rapidly progresses to AIDS.”

The potential for transmission of a highly virulent virus was deemed an emergency by the NYC Dept of Health!

NewYorkTimes.com

Tom Freiden

Case #1

CDC and NYCDOH requested that Patient X’s pol sequence be compared to sequences from

1) Sequence databases of the 28 laboratories conducting HIV genotyping in NYC

2) CDC sequence database 3) New York State Department of Health Wadsworth

Center sequence database 4) Databases from 3 large US commercial laboratories 5) Databases from 2 laboratories in Canada 6) Database from a commercial lab in Europe

Case #1

NYC providers were asked to report any new HIV and recent MDR HIV to authorities

NYCDOH then performed - Partner tracing on 14 identified partners - 10/14 previously known to be HIV positive

- Genotypes different - Other 4 unavailable, HIV negative, or refused

Case #1 What did the molecular epidemiology show? -- 3 individuals identified with >95%

sequence similarity to Patient X. All had attended similar venues or events as Patient X, but no direct contact. All 3 were stable on ARV


Case #1

1) Did the molecular epidemiology analysis provide useful information?

Case #1

Many cases when Molecular Epidemiology has provided important information

1) Detection of Enterobacteriaceae Isolates Carrying

Metallo-Beta-Lactamase --- United States, 2010 - MMWR Weekly June 25, 2010 / 59(24);750

2) Listeria Cantalope, Multistate Outbreak of Listeriosis

Associated with Jensen Farms Cantaloupe --- United States, August--September 2011,

- MMWR Weekly October 7, 2011/ 60(39);1357-1358

Personal.psu.edu Pritzkerlaw.com

Case #1

2) Was the Department of Public Health justified in using phylogenetic analysis to identify and investigate potential source-partner pairs involving this hypervirulent strain as a matter of public health concern?

When looking back at epidemiologic data, 1/1000 HIV infected individuals have this type of rapid infection.

Case #2

In 2020 - Dept. of Public Health has access to

everyone’s vaccination records. -The city launches a campaign to find

individuals delinquent on their vaccinations in the name of public health.

- Each time a person is identified that has missed at least one vaccine dose, the county van drives to his/her house.

Case #2

1) What is the public health benefit gained by getting everyone completely vaccinated (e.g. Mumps, Measles)

Case #2

• Marginal benefit depends upon R0, vaccination rate in the population, and severity of disease

Cohen et al. Medical Decision Making 2013

Case #2

Cohen et al. Medical Decision Making 2013

Case #2

2) Was the benefit to the public outweighed by the privacy issues associated with notification?

Depends upon 1) Disease --- variations in severity and R0

2) Vaccination rate in the population 3) The negative consequence of privacy loss

Case #3

A young woman in her mid to late 20s is called by the Department of Public Health. She is notified that she may be at risk for syphilis, and that she should come to the agency to get tested and treated.

Case #3

The woman has only been sexually active with one individual in the last 5 years. The information provided by the Department of Public Health was HIPAA compliant, yet personal identifying information was unintentionally released as a part of the partner notification program.

Case #3

Given this information by Public Health

She knows that Brian, her partner 1) Has syphilis 2) Has not been in a monogamous relationship with her

Case #3 What is HIPAA?

1 Name 2 Geographic subdivision smaller than State* 3 All dates related to an individual (except year) and age if 89 or older** 4 Phone number 5 Fax number 6 Electronic mail address 7 Social Security number 8 Medical record number 9 Health plan beneficiary number 10 Account numbers 11 Certificate/License number 12 Vehicle Identifiers and serial numbers 13 Device identifiers and serial numbers 14 Web Universal Resource Locators (URLs) 15 Internet Protocol (IP) address numbers 16 Biometric identifiers 17 Facial photographs 18 Any other unique identifier, characteristic or code

*street address, city, county, precinct, zip code **birth date, admission date, discharge date, date of death

Case #3

What is wrong with HIPAA?

Case #3

1) Excess paperwork 2) Complicates patient care

3) But does it even work?

-HIPAA was followed in this case, but disclosure resulted

-Not only can actual data broach privacy… but the process in which data is released can as well

Case #3

Another Example Gymrek et al (Science, Jan 2013) deduced the

identity of individuals from personal genome information

Case #3 • Subjects -

– individuals donating samples for genetic analysis, and signing releases that they understood privacy breach was a potential risk

• Resources – Free Genealogy Databases (eg ysearch, SMGF)

• Associate Y-chromosome tandem repeats (Y-STR) with surname

– Genetic databases: include age, state of residence • Not HIPAA identifiers

– Public record search engines • Can search for people by age, state and surname

Case #3

• With these resources were able to identify a median of 12 individuals associated with a genetic sample

• Focusing on 3 individuals with published genomes

Gymrek, 2013

Case #3

• Next – Evaluated the Utah Residents with

Northern and Western European Ancestry (CEU) Database

– 10 Y-STR haplotypes from Illumina seqs from 1000 genomes project

– 8 of 10 were associated with Mormon Ancestry using ysearch, SMGF

– In 5 cases – able to identify and link not only subject but paternal distant relatives

Case #3

Genetic Information • Advances in technology have not kept pace

with guidelines for use of genetic data that minimize privacy risks

• Genetic Information Non-discrimination Act of 2008 (GINA) was written to prevent discrimination based on genetic information

• GINA does not address: community level genetic information or non-host genetic information.

Case #3

Questions 1) Do alternatives to HIPAA exist? 2) Is there anyway to protect privacy when

using partner notification?

Case #3

Public Health Perspective: “Good quality partner notification should not

compromise rights to confidentiality but should give practical support to disclose in a safe way. Increasing our skills and practice in this area will go a long way to solving the problems associated with non-disclosure. Moralising about the responsibilities of individuals living with HIV will not.”

-Sarah Radcliffe (senior policy officer)

BMJ 2013;346:f2148

Case #3

How do you balance Risk to Privacy vs Public Health Benefit?

Risk = Probability X Quality X Magnitude 1) Probability – Probability of Risk Occurring 2) Quality – How severe is the risk to the individual 3) Magnitude – How significant a breech will it be

Case #4

An individual who frequents prostitutes is diagnosed with HIV.

- He becomes irate and wants to find the person that has given him the disease.

- He finds out that he can figure this out using viral sequence data.

- He gets his own virus sequenced and then gets access to the local resistance database

-He finds a sequence that is very similar to his own, from a woman living in Encinitas.

Case #4

He remembers vaguely that he had slept with a prostitute from Encinitas in the last couple of weeks.

Case #4

Partner Tracing – If it is acceptable in the context of Public Health

(with the associated risk of privacy breach), then should individuals be able to collect these same data.

Case #4

1) If our subject wanted to pursue charges against the prostitute, would this information be sufficient for a case?

Case #4

German Singer Arrested for Spreading HIV

Singer arrested in 2009 for “inflicting grievous bodily harm” by sleeping with three men when she knew she was HIV+, infecting one of them. Received two-year suspended sentence and 300 hours of community service.

Questions again!