AIDSWEEKLY Plus; Monday, December 28, 1998
Daniel J. DeNoon, Senior Editor

The recommendation comes in the draft version of the CDC's "Guidelines for National HIV Case Surveillance, Including Monitoring for HIV Infection and Acquired Immunodeficiency Syndrome (AIDS)," released on December 10, 1998. They are not unexpected, given strong hints at the February 1998 Retrovirus conference by Kevin M. De Cock, director of the CDC's Division of HIV/AIDS Prevention, Surveillance, and Epidemiology, that the agency favored name-based reporting (see AIDS Weekly, February 16, 1998).

Thirty-two states currently require name reporting of people who test positive on serologic HIV tests. At press time, California appeared to be on the verge of passing similar legislation.

The new guidelines stop short of requiring that all states adopt similar programs. But they strongly recommend it.

"CDC has concluded that name-based HIV/AIDS surveillance systems are the most likely to meet the necessary performance standards," the guidelines state. "Therefore, CDC advises that State and local surveillance programs use the same name-based approach for HIV surveillance as is currently used for AIDS surveillance nationwide. However, CDC recognizes that some States have adopted, and others may elect to adopt, non-name case identifiers for the public health reporting of HIV infection."

AIDS activists are enormously suspicious of name-based reporting. They fear that there can be no guarantees of patient confidentiality and that those who test positive would be exposed to discrimination. These fears run deep: in early 1998 one AIDS organization, Gay Men's Health Crisis, issued a statement that appeared to support name-based reporting. Under pressure from other patient organizations, the statement quickly was withdrawn. The gay and lesbian political action committee, Human Rights Campaign, in 1998 endorsed HIV reporting based on unique identifiers rather than names.

The CDC's rejection of unique identifiers is based on several factors:

* A review of statistics from six health departments (Louisiana, Michigan, Nebraska, new Jersey, Tennessee, and Nevada) showed that rates of HIV testing among high-risk individuals did not significantly decline after adoption of name-based reporting (Nakashima et all, JAMA, 1998;280:1421-6).

* Surveys in selected states showed that fewer than 20 percent of high-risk persons are concerned about "reporting to the government" (Hecht et al., J Gen Intern Med, 1997;12(suppl.1):108).

* Evaluations by two states that implemented coded-unique-identifier reporting based on social-security numbers suggested that such systems resulted in incomplete reporting. "The willingness of health care providers to accept the additional disease reporting burden of constructing unique-identifier codes, maintaining logs, and adopting the level of security necessary to reduce the potential for a breach of confidentiality from such logs, are important considerations in assessing the utility and acceptability of unique-identifier HIV case surveillance systems," the CDC guidelines conclude.

The CDC appears confident that states will be able to protect the confidentiality of HIV records. It notes, in a less-than-reassuring observation, that name-based AIDS surveillance has been in place since 1981 and that "few breaches of security have resulted in the unauthorized release of data."

Nevertheless, the CDC acknowledges that security is a paramount concern, and the guidelines set forth strict rules and recommendations intended to prevent disclosure of the names of people with HIV infection:

* State and local programs must describe their security programs in federal-funding applications and must open these programs to external review.

* Data should be maintained on a single electronic registry. Other data must be destroyed.

* No personal identifiers should be included in data forwarded to the CDC.

* Records that no longer serves a public-health purpose should be purged of names.

* States should improve their health-data confidentiality laws. These laws should name the objectives of collecting personal identifying information; identify the public health officials with access to the information; define procedures and time frames for purging personal identifiers from data; prescribe safeguards for protecting data; and provide "significant civil or criminal penalties for breaches of confidentiality." The CDC, the Council of State and Territorial Epidemiologists (CSTE), the National Conference of State Legislatures, and the Georgetown/Johns Hopkins Public Health Law Project are developing model language for state confidentiality laws; the project is expected to be completed in early 1999.

* The CDC insists that data should be encrypted for computer transfer; that it should be stored in a physically secured area; that access be limited to a minimum number of authorized staff; that use of data for research must be approved by appropriate institutional review boards; and that all potential breaches of confidentiality be investigated and immediately reported to the CDC.

* The CDC suggests, but does not require, that states encrypt computer records using a two-key system. The information would be encrypted using the first key, and decoded using the second key. The second key would be held by the CDC under federal statutes protecting its confidentiality.

Perhaps the most severe sanction in the guidelines is the threat that federal surveillance funding depends on states' ability to ensure that HIV case reports are kept confidential and physically secure.

The most controversial issue in HIV prevention is contact tracing. The CDC continues to recommend voluntary partner notification.

"CDC advises that the decision about linkage between surveillance systems and prevention and care services, such as partner counseling and referral services (i.e., partner notification activities), be made at the local level," the guidelines state. "Such linkages should neither compromise the quality and security of the surveillance system nor compromise the quality, confidentiality, and voluntary nature of HIV prevention services. The primary function of HIV and AIDS surveillance remains the provision of accurate epidemiologic data for public health information, planning, and evaluation."

The standard data set required by the CDC would contain the patient identifier; earliest date HIV infection was diagnosed; earliest date of AIDS; and demographic information including date of birth, race/ethnicity, sex, and city/state of residence; HIV risk exposure; facility of diagnosis; and date/location of death.

The new guidelines also make an important change in the 1993 AIDS case definition: DNA and RNA tests for HIV detection are now included.

The CDC estimates that 220,000 HIV infected individuals currently reside in states (including California) that do not now require name- based reporting. It warns that national implementation of the guidelines may therefore result in a sudden increase in HIV case reports, although a more gradual increase is most likely.
981228
AW981216

AEGiS presents published material, reprinted with permission and neither endorses nor opposes any material. All information contained on this website, including information relating to health conditions, products, and treatments, is for informational purposes only. It is often presented in summary or aggregate form. It is not meant to be a substitute for the advice provided by your own physician or other medical professionals. Always discuss treatment options with a doctor who specializes in treating HIV.

Copyright ©1980, 1998. AEGiS. All materials appearing on AEGiS are protected by copyright as a collective work or compilation under U.S. copyright and other laws and are the property of AEGiS, or the party credited as the provider of the content. .