Legal Considerations

Introduction

A core duty and primary function of any government is protection of the public's health and safety. Field epidemiology—including investigation of disease outbreaks and clusters—is a critical, basic government function conducted by public health agencies at the state and federal levels. The federal government's authority to protect public health and safety is found in the US Constitution. And while states address the protection of public health and safety in their individual constitutions, each state is also vested with "police powers," that is, inherent authority to impose restrictions on private rights for the sake of public welfare, order, and security. Both federal and state authorities are subject to the limitations and restraints of the US Constitution. These legal authorities enable public health officials to take certain actions during epidemiologic investigations, such as obtaining clinical specimens and data from persons affected by an outbreak; obtaining data from healthcare facilities; collecting environmental samples; protecting the privacy of personal information; and implementing and enforcing control measures, such as vaccination, chemoprophylaxis, quarantine, or even seizure or destruction of private property.A

This chapter provides an overview of legal considerations relating to field epidemiology and, more specifically, epidemiologic investigations. It discusses the interplay of federal and state laws; legal issues related to data collection, analysis, and dissemination, including health information privacy; special or unique jurisdictions; and state and federal cooperation in emergency responses, including investigations of disease outbreaks that may be terrorism-related.

General Legal Authorities

Article 1, Section 8, of the US Constitution authorizes Congress to impose taxes to provide for "the general Welfare of the United States"B and to regulate interstate commerce.C The epidemiologic investigations conducted by the Centers for Disease Control and Prevention (CDC) and members of the US Public Health Service are examples of federal activities that are generally supported by these authorities. Under the authority of the US Constitution's Commerce Clause, the federal government also oversees such health-related activities as the inspection of meat, poultry, and other foods; the regulation of drugs, biological products, and medical devices; and the regulation of biological agents that have the potential to pose a severe threat to public health and safety. Although the provisions in the US Constitution are broad, the activities of the federal government relating to health and welfare nonetheless must fit within these enumerated powers. Additionally, the Bill of RightsD can restrain the exercise of federal authority.

By contrast, a state's authority to protect public health—often included in the authorities referred to as "police powers"—is extensive.1 "The police power is the natural authority of sovereign governments to regulate private interests. We define police power as the inherent authority of the state (and, through delegation, local government) to enact laws and promulgate regulations to protect, preserve, and promote the health, safety, morals, and general welfare of the people. To achieve these communal benefits, the state retains the power to restrict, within federal and state constitutional limits, private interests; personal interests in autonomy, privacy, association, and liberty as well as economic interests in freedom to contract and uses of property".2 "A state's police power . . . may be lawfully resorted to for the purpose of preserving the public health, safety or morals, or the abatement of public nuisances, and a large discretion is necessarily vested in the legislature to determine not only what the interests of the public require, but what measures are necessary for the protection of such interests" (notes omitted)3. In many instances, a state has delegated its public health authority to county, parish, or municipal governments to examine, treat, and, in the event of certain contagious diseases, even quarantine citizens to protect the public health.

The authority of federal and state governments to enact laws protecting public health extends to the promulgation of regulations, the issuance of executive orders, and the publication of directives from health authorities that may have the force and effect of law (see Health Authorities below).

The exercise of a state's public health police powers has limitations. The US Constitution provides safeguards to ensure that the exercise of these powers is not excessive or unrestrained. For example, the Fourth Amendment protects citizens from unreasonable searches and seizures. Whereas the Fifth Amendment prohibits the federal government from depriving any person of life, liberty, or property without due process of law, the Fourteenth Amendment imposes similar due process protection on the individual states. "The guaranty of due process . . . demands only that the law shall not be unreasonable, arbitrary or capricious, and that the means selected shall have a real and substantial relation to the object sought to be attained".4 The basic elements of due process include notice to the person involved and opportunity for a hearing or similar proceeding.

In the exercise of its public health police powers, a state must use the least restrictive alternative that will achieve the state's interest, particularly when the exercise involves limitation of an individual's liberty. The standard used to determine that a government's exercise of its public health police powers is appropriate is whether the government action is necessary, uses reasonable means, is proportional, and avoids harm.5

State and Federal Legal Authorities

Field epidemiology is defined generally as the application of epidemiologic methods to unexpected health problems when an epidemiologic investigation is needed6. As field epidemiologists conduct such investigations, they should be cognizant of the legal authorities and potential legal parameters around their work to maximize the benefit of the work and minimize possible legal risks.

State Legal Authorities

A state's inherent "police powers" provide state and local health officials broad authority to conduct field epidemiology.E As a practical matter, institutions and individuals generally voluntarily cooperate in epidemiologic investigations. However, just as many field investigations require support from competent laboratory staff, a field investigation also may require support from competent legal staff when voluntary cooperation is not forthcoming. If an investigator meets with resistance, state and local public health officials may need the assistance of their general counsel or their state's attorney general for such actions as applying for a court order to compel an entity (or individual) to grant investigators access to premises or records.F Although assistance from legal counsel might never be needed, it is a good idea nonetheless to identify the attorney or legal office that can supply legal advice and support before the epidemiologic investigation begins.

In addition to the legal authorities that enable health agencies to undertake epidemiologic investigations, myriad related considerations exist regarding responsibilities and authorities for the individual elements of an investigation. Such considerations encompass the authorities necessary to

• Obtain microbiological and other laboratory specimens from hospitals and private laboratories;
• Review patients' medical records kept in the offices of physicians, dentists, and other healthcare providers;
• Administer questionnaires to and collect specimens from persons affected in the outbreak;
• Administer questionnaires to unaffected persons who might serve as controls in analytic studies and/or as important sources of information;
• Retain information about medical histories and laboratory results;
• Protect confidentiality;
• Implement a variety of measures intended to control the immediate problem, prevent recurrences, and evaluate the effectiveness of interventions;
• Collect additional data on an ongoing basis;
• Recall an implicated product;
• Close a business or otherwise restrict activities relating to the source of an outbreak;
• Use isolation or other forms of restrictions of activities of affected persons;
• Quarantine exposed persons;
• Vaccinate or administer antibiotics to exposed groups.

Public health surveillance systems in the United States are established as an exercise of the states' police powers. These state-based systems are designed for reporting of diseases and conditions of public health interest by healthcare professionals and laboratories. All states have laws and regulations that mandate the reporting of a list of diseases and conditions, as well as prescribing the timing and nature of information to be reported and the penalties for noncompliance with the reporting laws.7 Required disease reporting varies greatly among states and territories. Some states have general statutes that empower the health commissioner or state boards of health to create, monitor, and revise the list of reportable diseases and conditions.8 Some states require reports under both statutes and health department regulations9. Reporting may be required of a variety of professionals and organizational entities, including physicians and other healthcare providers, diagnostic laboratories, clinical facilities, and schools and daycare centers.71011

The scope and nature of reporting requirements vary considerably by state, differing, for example, by the number of conditions required for reporting, time periods within which conditions must be reported, agencies to which reports must be submitted, and persons or sources required to report. Moreover, despite the legal requirements for reporting, adherence to and completeness of reporting also vary substantially by infectious disease agent, ranging from 6% to 90% for different common infectious conditions12. The deficiencies in reporting by physicians are accounted for, in part, by limitations in physicians' knowledge of reporting requirements and procedures, as well as the assumption that laboratories have reported cases of infectious diseases713.

Federal Legal Authorities

Federal public health officials have limited statutory authorities to initiate independent epidemiologic investigations. One general statutory authority that applies to federal epidemiologic investigations is section 301(a) of the Public Health Service Act (PHSA) (42 USC § 241(a))14, which provides

The Secretary [of the US Department of Health and Human Services (HHS)] shall conduct in the [Public Health] Service, and encourage, cooperate with, and render assistance to the other appropriate public authorities, scientific institutions, and scientists in the conduct of, and promote the coordination of, research, investigations, experiments, demonstrations, and studies relating to the causes, diagnosis, treatment, control, and prevention of physical and mental diseases and impairments of man.

In addition, subsection 6 of section 301(a) of the PHSA authorizes the HHS Secretary to "make available to health officials, scientists, and appropriate public health and other nonprofit institutions and organizations, technical advice and assistance on the application of statistical methods to experiments, studies, and surveys in health and medical fields." Although these provisions are broadly worded and are permissive rather than compulsory, they nonetheless provide legal authority for assistance by federal epidemiologists in disease outbreaks and other instances in which such assistance is requested. In practice, local and state public health officials often request federal assistance in epidemiologic investigations. Federal public health employees who collaborate with state and local public health authorities in such investigations generally are assisting the state or local investigation under the state's authority.

Legal Issues Related to Public Health Data Collection, Analysis, and Dissemination

Before undertaking epidemiologic field investigations, investigators should be aware of particular legal issues related to data collection, analysis, and dissemination that their investigatory work might implicate. Some important questions to consider are

• Who is asking for these data to be collected, analyzed, and/or disseminated?
• Why are these data being collected, analyzed, and/or disseminated?
• What type of data (e.g., state, county, geographic codes, individual names, social security numbers, or other personally identifiable codes) are being collected, analyzed, and/or disseminated?
• Under what legal authority are the data being collected, analyzed, and/or disseminated?
• How will the data be stored, secured, and maintained?
• Who will have access to the data and for what purposes?

Answers to these questions can identify which laws—federal and/or state—might apply to the field investigator undertaking the work, to the data being collected, and to any resultant response. For example, when a state public health official requests assistance from a CDC field investigator about an outbreak within a state, both federal and state laws could apply to various aspects of the investigation. At times, those laws may appear to conflict, especially where each respective jurisdiction has coordinated but separate roles and responsibilities. Each party (federal and state) in the investigation must ensure compliance with all laws that apply to it or its actions in the given circumstances. The remainder of this section addresses some of the primary legal issues and laws relevant to data collected as part of a field investigation.

Concepts Related to Public Health Data Collection, Protection, and Dissemination

• "Health information privacy" broadly refers to the rights of individuals to control the acquisition, uses, or disclosures of their identifiable health data.
• The closely related concept of "confidentiality" refers to the obligations of persons who receive information to respect the privacy interest of individuals who are the subjects of the data.
• "Security" refers to technologic or administrative safeguards or tools to protect identifiable health data from unauthorized or unwarranted access or disclosure.

Federal Laws Related to Public Health Data Collection, Protection, and Dissemination

Federal officials have limited authority to initiate epidemiologic investigations. In fact, many CDC authorities are permissive rather than compulsory; thus, CDC's involvement in state and local public health investigations usually is intended to assist the state or local investigator rather than exercise a specific federal authority. Field investigators need to be aware of the following laws, regulations, and legal provisions:

• The regulations found in part 46 of title 45 of the Code of Federal Regulations (CFR)15 require that data collections deemed to be research require approval by an institutional review board and informed consent by research participants. These regulations protect the rights, welfare, and well-being of research participants. However, most epidemiologic investigations generally fall outside the scope of these regulations.
• The Paperwork Reduction Act of 199516 and its implementing regulations17 (PRA) may apply if a federal agency, including CDC, conducts or sponsors a data collection involving 10 or more respondents during a 12-month period. The purpose of the PRA is to ensure that federal agencies do not overburden the public with federally sponsored data collections, with duplicate data collections, and/or with data collections that are not necessary to conduct government business. Data collections subject to the PRA require approval by the White House Office of Management and Budget.
• The Privacy Act of 197418 is the federal law that protects the confidentiality of individually identifiable information when records are maintained by a federal agency in a system of records in which the information is retrieved by a person's name, identification number, or other unique identifier. The Privacy Act has four basic policy objectives:
  • To restrict disclosure of personally identifiable records maintained by agencies;
  • To grant individuals increased right of access to agency records maintained on themselves;
  • To grant individuals the right to seek amendment of agency records maintained on themselves upon showing that the records are not accurate, timely, or complete; and
  • To establish a code of "fair information practices" that requires agencies to comply with statutory norms for collection, maintenance, and dissemination of records.
• The Freedom of Information Act19 (FOIA) "provides that any person has a right, enforceable in court, to obtain access to federal agency records, except to the extent that such records (or portions of them) are protected from public disclosure by one of nine exemptions or by one of three special law enforcement record exclusions. The FOIA thus established a statutory right of public access to Executive Branch information in the federal government"20.
  • FOIA exemption 3 protects information prohibited from disclosure by another federal statute provided that the statute either requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue or establishes particular criteria for withholding or refers to particular types of matters to be withheld. Examples are found in the Trade Secrets Act, PHSA section 308(d), and newly amended PHSA section 301(d).
  • FOIA exemption 5 protects inter-or intra-agency memoranda or letters that would not be available by law to a party other than an agency in litigation with the agency. Courts have construed this language to exempt those documents, and only those documents, that are normally privileged from discovery in civil litigation21.
  • FOIA exemption 6 protects personal privacy interests by exempting records in personnel and medical files and similar files when the disclosure of such information would constitute a clearly unwarranted invasion of personal privacy.
• The Federal Records Act of 195022232425 requires all federal agencies to make and preserve records containing adequate and proper documentation of their organization, function, policies, decisions, procedures, and essential transactions.
• The Health Insurance Portability and Accountability Act of 1996 (HIPAA)26 was enacted in part to provide legal privacy protections for certain individually identifiable health information called protected health information (PHI). Specifically, HIPAA set out Standards for Privacy of Individually Identifiable Health Information, commonly known as the HIPAA Privacy Rule2728. The HIPAA Privacy Rule provides national standards for protecting the privacy of health information and regulate how certain "covered entities" (health plans, healthcare clearinghouses, and healthcare providers who engage in certain electronic transactions) use and disclose protected health information29. Pursuant to the HIPAA Privacy Rule, these covered entities must provide certain assurances to patients and safeguards for securing patient records. However, appreciating the critical need for public health to use PHI to identify, address, and monitor the public's health, the HIPAA Privacy Rule expressly permits PHI to be shared for specified public health purposes. For example, covered entities may disclose PHI, without individual authorization, to a public health authority legally authorized to collect or receive the information for the purpose of preventing or controlling disease, injury, or disability. See 45 CFR § 164.512(b). Further, the HIPAA Privacy Rule permits covered entities to make disclosures that are required by other laws, including laws that require disclosures for public health purposes30.
• HIPAA also enacted Security Standards for Protection of Electronic Protected Health Information, commonly known as the HIPAA Security Rule3132. The HIPAA Security Rule sets technical standards for ensuring proper access to electronic protected health information by authorized users and provides comprehensive security implementation requirements and specifications. Entities that transmit HIPAA-covered data need to ensure that methods of transmission, storage, and disposition comply with the Security Rule.
• Section 301(d) of the PHSA provides that persons engaged in certain research where identifiable, sensitive information is collected shall receive a certificate of confidentiality from HHS to protect the privacy of individual subjects of such research if the research is funded in whole or in part by the US government or may receive such a certificate from HHS where the research is funded by other parties. The use of this provision may require consultation with the appropriate offices within the respective HHS agency providing funding for the research.
• Sections 308(d) and 924(c) of the PHSA3334 provide protection for identifiable information collected respectively by CDC and the HHS' Agency for Healthcare Research and Quality3536. "Assurances of Confidentiality" under section 308(d) can be used to protect individuals and institutions providing information, and provides that "No [identifiable] information . . . may be used for any purpose other than the purpose for which it was supplied unless such establishment or person has consented." The use of this provision may require consultation with appropriate offices within the respective HHS agency.
• The E-Government Act of 200237 in part protects the confidentiality of federal government statistical collections of identifiable information, including health information. The Act restricts the use of information gathered for statistical uses to the purposes for which it is gathered and penalizes unauthorized disclosures. It also requires federal agencies to conduct "privacy assessments" before developing or procuring information technology that collects, maintains, or disseminates identifiable information.
• Titles II and III of the E-Government Act of 2002 require that agencies evaluate systems that collect personally identifiable information to determine that the privacy of this information is adequately protected. Office of Management and Budget Memorandum M-07-1638 is guidance to the federal Executive Branch that defines personally identifiable information as "information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother's maiden name, etc." Each federal agency will have an established policy to identify, manage, and respond to suspected or confirmed breaches of personally identifiable information.
• The regulations found at 42 CFR Part 239 implement section 543 of the PHSA (42 USC §290dd-2)40 and provide for confidentiality of alcohol and drug abuse patient records regulations, more specifically, the confidentiality of the identity, diagnosis, prognosis, or treatment of any patient records maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research.
• The Genetic Information Nondiscrimination Act of 2008 (Pub. L. 110-233, 122 Stat. 881)41 is a federal law that protects individuals against discrimination based on their genetic information in health coverage (Title I) and in employment (Title II). Various regulatory provisions implement the Genetic Information Nondiscrimination Act: for the Department of Labor (29 CFR Part 2590)42, for Department of the Treasury (26 CFR Part 54)43, for HHS/Centers for Medicare and Medicaid (45 CFR Parts 144, 146, and 148)444546, for HHS/Office of Civil Rights (45 CFR Parts 160 and 164)4748 and for the Equal Employment Opportunity Commission (29 CFR Part 1635)49.

State Laws Related to Public Health Data Collection, Protection, and Dissemination

State officials generally have broader authorities than federal officials with respect to the conduct of epidemiologic investigations within their jurisdiction, in particular regarding the roles and responsibilities of respective state and local officials and the rights and protections afforded to citizens within the jurisdiction. These authorities vary, however, from state to state, and sometimes even within a state, and find their basis in a range of federal, state, and local laws, regulations, and policies. For example, although many states have statutory laws similar to the federal Privacy Act and FOIA, and a few have passed additional privacy protections, most do not have comprehensive statutes regulating the acquisition, use, and disclosure of individual health data. Rather, state privacy laws tend to regulate specific data recipients (e.g., public health agencies, health insurers); certain medical tests, diseases, or conditions (e.g., genetic tests, HIV status, mental disorders); or particular data sources (e.g., nursing or healthcare facilities).

In addition, many healthcare organizations and entities that may contribute data or otherwise be engaged in an outbreak investigation may be considered "covered entities" subject to the HIPAA Privacy Rule. Although the HIPAA Privacy Rule expressly permits the disclosure without individual authorization of protected health information to public health authorities authorized by law to receive such information in the performance of their public health activities,G this disclosure is permissive and not mandatory. In addition, as covered entities, and depending on the level of data to be shared, with whom the data may be shared, and any relevant state laws, these entities may have to enter into data-sharing or other types of agreements to be able to provide the data, even for the investigation.

Considerations for Special Jurisdictions

An important step in investigating disease outbreaks is obtaining permission and cooperation from the appropriate authorities to conduct the investigation. In addition to identifying local, state, federal, and/or international health agencies involved, epidemiologists should also consider agencies with special jurisdiction50. Although the following government entities each have special jurisdiction, agencies' jurisdictions often overlap and create complex cases. These special jurisdictions have autonomy and maintain their own public health programs that can address outbreaks. However, they also can request assistance from other health agencies to increase resources and decrease the time to contain an outbreak.

• US Department of Defense (DoD). Military commanders have jurisdiction over their bases and facilities. Public health responsibilities are vested in the DoD and the branch of the military (e.g., Department of the Army) affected by an outbreak. During an outbreak investigation at a military base, the field investigator must communicate and cooperate with the military base commander51. The DoD has established the position of the Public Health Emergency Officer (PHEO). The PHEO is a uniformed services officer or a DoD civilian who is a member of a military service medical department and must be a clinician. The PHEO has relevant training in emergency management and experience in public health. In addition to being the advisor to the commander, the PHEO works with the installation and medical treatment facility emergency managers on all phases of public health emergency management. These personnel communicate with local and state health departments. The PHEO is the advisor to the installation/regional/geographic combatant commander on public health emergencies52.
• Tribal governments. Tribal governments generally have complete sovereignty and autonomy over reservation lands. Nontribal groups can join an investigation only at the tribe's request. Investigations of outbreaks are led by tribal health staff, Indian Health Service (IHS),H or state health departments. The IHS can implement investigation measures and control but only with the authorization of the tribal government.
• State and federal departments of correction. State and federal prison systems have health policies and health departments with the responsibility to maintain prisoner health. Prison systems are insular, and their individual department of corrections may request public health assistance in an outbreak investigation53.I Some prisons are run by the prison system of the state, but the Federal Bureau of Prisons has jurisdiction over federal correctional facilities and employs a Health Services Division54.
• US Department of the Interior (Interior Department). The Interior Department has jurisdiction over federal lands and natural resources. It employs scientists in its Office of Public Health, and members of the Public Health Service are assigned to the National Park Service for investigations. These staff are knowledgeable about their jurisdictions and should be collaborated with when federal lands are involved in the outbreak investigation.

Terrorism-Related Investigation

During the course of several weeks beginning September 18, 2001, letters containing live anthrax spores were mailed to several news media offices and to two US Senators. Five people died and 17 others were infected. These anthrax attacks increased recognition of the potential for criminal behavior and other deliberate actions to cause disease outbreaks and crystalized the concept of "forensic epidemiology." Forensic epidemiology has been characterized as "the use of epidemiologic methods as part of an ongoing investigation of a health problem for which there is suspicion or evidence of possible intentional acts or criminal behavior as factors contributing to the health problem"55. The operational challenges during concurrent public health and law enforcement investigations have stimulated interdisciplinary collaboration that has resulted in the creation of joint agreements between law enforcement and public health authorities and publication of the Federal Bureau of Investigation's (FBI) Joint Criminal and Epidemiological Investigations Handbook56. To assist in the development of local joint agreements, CDC's Public Health Law Program makes available two model memoranda of understanding (MOU)57. One such MOU is the Model MOU for Joint Public Health/Law Enforcement Investigations (2008), which is designed as a starting point in setting forth the major gaps and problems in cross-sectoral and cross-jurisdictional emergency preparedness planning, as well as identifying some key opportunities for addressing them. A copy of the MOU can be obtained by contacting state and local public health officials or FBI Weapons of Mass Destruction coordinators in FBI field offices or by sending an email request to phlawprogram@cdc.gov. Another is the Framework for Improving Cross Sector Coordination. This document outlines the major gaps and problems in cross-sectoral and cross-jurisdictional emergency preparedness planning, as well as key opportunities for addressing them.

Officials conducting public health investigations also need to be aware that the possession of certain biological agents and toxins determined by the HHS Secretary to have the potential to pose a severe threat to public health and safety is regulated under part 73 of title 42 Code of Federal Regulations58. A list of these "biological select agents and toxins" (BSAT) is found at 42 CFR §§ 73.3, 73.459. Anyone in possession of or having access to BSAT is required to be registered with the federal government and undergo an FBI security risk assessment. Unregistered or nonapproved persons in possession of BSAT could be subject to civil monetary penalties60 and/or criminal prosecution61. However, exemptions exist for clinical or diagnostic laboratories and other entities that possess a BSAT contained in a specimen presented for diagnosis or verification provided that certain regulatory conditions are met62. The HHS Secretary can temporarily exempt an individual or entity from the BSAT regulations on the basis of a determination that the exemption is necessary to provide for the timely participation of the individual or entity in response to a domestic or foreign public health emergency. In addition, BSAT seized by a federal law enforcement agency is excluded from the BSAT regulations provided that certain conditions are met59. Information about the Federal Select Agent Program is available at http://www.selectagents.gov/.

Conclusion

Epidemiologists engaged in field work need to understand the scope of the legal authority of public health officials to investigate diseases. Federal and state laws provide authority for federal and state officials to have access to medical and other records for purposes of public health investigations. These same laws also protect the individual's interest in privacy by placing strict limits on access to medical, hospital, and public health records. Although public health investigations usually rely on the voluntary cooperation of individuals and institutions, federal and state laws do provide authority for the use of compulsory measures when necessary to protect the public health and safety.

Epidemiologists are not expected to know every facet of public health law. However, the use of legal resources that support field work requires an appreciation of the legal issues that pertain to surveillance, privacy of medical records, and the legal responsibilities in the involved jurisdiction(s).