DENVER – Public health agencies in several metro Denver counties said Tuesday they do not share the names of people who have tested positive for COVID-19 with local law enforcement, which The Associated Press reported Tuesday was the case in Colorado.
As testing and contact tracing are being stepped up to try to better track the COVID-19 outbreak, concerns over data sharing and tracking have been raised by groups and people across the country. The Associated Press reported Tuesday that civil liberty groups and some community activists were concerned about data sharing that could lead to potential profiling among communities of color.
The AP reported that at least 35 states allow state or local health departments to track who received COVID-19 tests in their region and to provide that information to local dispatchers. But it also reported that Colorado was one of “at least 10 states” that share the names of people as well.
A Colorado Department of Public Health and Environment spokesperson said Tuesday that any information sharing was done directly between law enforcement agencies and local public health agencies, which would “provide the minimum amount of personal identifying information possible in order to protect the privacy of the individuals.”
“At no point did CDPHE or CDPS provide this information to law enforcement, as it was always done at a local level,” CDPHE spokesperson Ian Kahn said. “This information was only intended to be shared on an as-needed basis for the safety of first responders as they respond to calls.”
Kahn said that the state attorney general’s office had issued guidance in late March, based on guidance from the U.S. Department of Health and Human Services, on how local public health agencies care share information about the addresses of people with confirmed COVID-19 cases with fire, law enforcement and EMS so they could prepare to respond to those calls safely.
The guidance says that those entities are “required to make reasonable efforts to disclose the ‘minimum necessary' [personal health information] to accomplish the intended purpose for the disclosure.”
It further says that public health authorities and covered entities, like public health departments and law enforcement, paramedics and first responders, are not bound by the HIPAA Privacy and Security Laws.
“It would be inappropriate for law enforcement agencies to access and use the data to target individuals for enforcement,” Kahn said.
ACLU of Colorado Legal Director Mark Silverstein said that if the AP report is true, that would be “somewhat concerning.”
“Whenever information is disseminated in a way that undermines personal privacy, there’s also a tremendous potential for misuse of the information unless it’s disseminated under very carefully-crafted guidelines,” Silverstein said in an interview.
He said the cell phone data that Colorado State University and other officials are studying to track mobility and social distancing during the outbreak was aggregate data that did not identify particular people and called that “different than this.”
“We just know the median time that devices in [an] area spent at home or the number of visits to King Soopers, but nothing about the individuals,” CSU’s Jude Bayham said about the university’s data tracking.
Officials from the Denver Department of Public Health and Environment and Tri-County Health Department, which covers Arapahoe, Adams and Douglas counties in Denver’s suburbs, told Denver7 Tuesday that none of the data that was shared included anyone’s names.
A DDPHE spokesperson said the department “only provides the address to first responders so they are aware and can don the appropriate protective gear if they are called to that address.”
Aurora Police Department spokesperson Officer Matthew Longshore said APD also only receives addresses every day of households containing people that have tested positive for COVID-19.
“What is never included in these emails/lists are any personal information about the patients who test positive,” Longshore said.
He said that after the daily list is received, a supervisor will flag the address to notify responders that extra PPE should be worn if they have to go to that address. And he added that no specific illness types or exposure are every put down in the CAD system that tracks calls for service when officers are noted they need to take extra precautions on a call.
Longshore said that the daily emails also include addresses that are no longer a risk which are then removed from the system by a supervisor.
Tri-County Health Department Director of Emergency Preparedness, Response, and Communicable Disease Surveillance Michele Askenazi said the health department only ever shares address information – which came after a verbal agreement between the department’s executive director and the sheriffs of Arapahoe, Adams and Douglas counties at the beginning of the outbreak, she said.
Askenazi said the daily lists are sent through encrypted email and include wording about the information being confidential. She said that the department also provides information about clearing out addresses in a certain number of days.
She said that the program started when PPE was still in short supply at the onset of the outbreak so that first responders weren’t burning through the equipment when it wasn’t necessary.
Arapahoe County is no longer requesting the daily information, however, according to Askenazi, though the department continues to send reports to the county emergency manager. The information sharing between the department and Adams and Douglas counties continues, Askenazi said.
Kahn echoed similar sentiments about the reason for the information sharing in the first place being to preserve as much PPE as possible early on.
“Once Colorado had widespread community transmission of COVID-19, this process became irrelevant due to the large number of positive cases; law enforcement changed their approach to assume that any person they were interacting with could be infectious, and many enacted enhanced safety protections for their staff such as requiring masks for all interactions and PPE for any close interactions,” he told Denver7.
