Molecular HIV surveillance: public health tool or weapon?

By: Jeffrey R. Lewis

There is a longstanding, inherent value in the assurance of privacy in our healthcare system. Among other things, it is the keystone of the physician-patient relationship (Holman, 2017); it improves treatment adherence (Heath, 2017); and it has been proven to promote better health outcomes (2013). An ambitious new initiative to combat HIV/AIDS in the United States, however, employs technology that places patients’ privacy protections at risk.

President Trump’s “End the Epidemic by 2030” (EtE) initiative focuses on the 46 (out of 3,000) counties in the United States that account for more than half of new HIV infections. The Administration's plan also provides the opportunity to evaluate the ongoing rise in sexually transmitted diseases, which include worrying trends reported by the U.S. Centers for Disease Control and Prevention (CDC). Examples of the rise of STDs include  a 19% increase in Chlamydia, 63% increase in Gonorrhea, and 71% increase in Syphilis (CDC, 2019).

It is through this initiative that HIV stakeholders are getting an important glimpse into a potentially useful, but troubling, new tool being used by our public health infrastructure – namely, molecular HIV surveillance.

Photo Source: CDC

Molecular HIV surveillance involves data collection and sharing between healthcare practitioners and public health departments to track individual treatment resistance, as well as trends in HIV infections. It also leverages cluster detection to identify new infections of “people normally out of reach to public health” (McClelland, 2019). This information is shared with the CDC, which in turn uses the data to determine funding allocations for state and local health departments combating HIV (CDC, 2017). But at what cost to patients already living with HIV?

What’s troubling is that there is no informed consent by patients for data collected using individuals’ blood samples. State and local health departments report de-identified data to the CDC, but there are obvious patient privacy concerns.

Major health data breaches have become a problem in recent years. In 2016, patients enrolled in California’s AIDS Drug Assistance Program (“ADAP”) (Gorman, 2018); in 2017, patients served by CVS Pharmacy under Ohio’s ADAP  (Hassan, 2018), and Aetna patients in Pennsylvania  (Gordan, 2018), all had their privacy violated. It is not outside the realm of possibility that a data breach could also happen on a larger scale, exposing people living with HIV to further stigma.

Photo Source: Insurance Journal

Although the CDC’s data collection is governed by federal guidelines which intend to protect the privacy of individuals, for those living in the shadows of the nation’s long, dark history of HIV-related stigma, these provide little comfort. The fact remains that negative attitudes toward HIV/AIDS persist.

According to the Kaiser Family Foundation, nearly one in five Americans are somewhat or very uncomfortable working with someone who is living with HIV. One in five Americans is also somewhat or very uncomfortable having a close friendship with someone who is living with HIV. And a staggering two out of five Americans report being somewhat or very uncomfortable sharing a living space with someone who is living with HIV (Kirzinger, 2019). These attitudes are from current data -  not from the early 1980s!

Because molecular HIV surveillance identifies where clusters of people living with HIV reside, there are concerns that it will further fuel HIV-related stigma, which is already high and continues to grow. Worse, patient advocacy groups and legal scholars fear the potential exists for more unfair criminal prosecutions under outdated state HIV criminalization laws that allow prosecution of those who fail to disclose their HIV status.

The CDC has defended the use of this strategy, claiming it is “important to identify growing clusters of recent and rapid transmission to intervene to interrupt transmission” (Oster, 2017). According to their data through December 2015, such clusters have surfaced in each region of the United States, with 1,923 clusters identified, ranging in size from 2-22 cases (Oster, 2017).

Some of these clusters have gained national attention, namely ones in Scott County, Indiana, and San Antonio, Texas. The former resulted in more than 200 diagnoses of new HIV infections, whereas the latter helped to identify a cluster of 24 Latino gay and bisexual men (O’Neill Institute, 2019). What is often overlooked in the discussion over both of these clusters is whether and how syringe exchange programs could have effectively prevented many new infections.

To fully understand why public identification of these clusters is problematic, one must view the current situation in the context of its potential legal implications. Draconian HIV-specific criminalization laws still exist in 34 states; another 24 states have used general criminal statutes against people living with HIV for “HIV exposure” or non-disclosure of HIV status (CHLP, 2019). These laws relegate people living with HIV to second-class citizenship for numerous reasons. According to the Center for HIV Law and Policy, state HIV criminalization laws “criminalize non-disclosure of HIV status or exposure of a third party to HIV; make exceptions to confidentiality and privacy rights of people living with HIV; provide for sentence enhancements for people living with HIV convicted of underlying crimes such as prostitution and solicitation; and require sex offender registration for people living with HIV” (CHLP, 2019).

Lambda Legal,  considered the leading advocacy organization for the LGBTQ community, takes it a step further in characterizing the harm done by state HIV criminalization laws, speculating that these laws harm public health by creating disincentives for people to get tested for HIV and  prevent others who are HIV-positive from seeking care and treatment. Lambda argues that “information from healthcare providers is often used to prosecute,” which undermines the keystone of the physician-patient relationship (Lambda Legal, 2013).

Photo Source: SERO

It isn’t hard to imagine a worst-case scenario in which molecular HIV surveillance data makes its way into a courtroom and contributes to the “unjust prosecutions” (Lambda Legal, 2013), or into the court of public opinion to “stigmatize and oppress” people living with HIV (Lambda Legal, 2013). While molecular HIV surveillance alone cannot be used in court to establish HIV transmission (Schneider, 2019), it can be used as evidence, and that alone should cause considerable concern.

People living with HIV see very little difference between molecular HIV surveillance as an effective “tool” fighting the epidemic and HIV criminalization. They see it more as  a weapon aimed at further isolating, stigmatizing, and punishing people living with HIV. We should be listening to them rather than trying to reassure them.

In our quest to eradicate HIV/AIDS in the United States (and across the globe), it is important to keep the ongoing struggle in perspective. As we pursue new approaches toward ending the epidemic – including leveraging new technologies that can pinpoint HIV clusters and link more people to care – we must not become over-zealous and ignore the very real concerns expressed over molecular HIV surveillance by our family, friends, colleagues, neighbors, and even strangers living with HIV.

HIV-positive people should be afforded the very same privacy protections as their HIV-negative counterparts. That is what this community expect, deserves, and should be guaranteed.

Editor's Note: Mr. Lewis has worked on issues impacting the HIV/AIDS community for many years. The views expressed our his own. He can be reached at jeffreyrobertlewis@gmail.com.

References:

• Centers for Disease Control & Prevention (2017). Surveillance Overview. U.S. Department of Health & Human Services. Retrieved online at https://www.cdc.gov/hiv/statistics/surveillance/index.html. 
• Centers for Disease Control & Prevention (2019). Sexually Transmitted Disease Surveillance 2018. U.S. Department of Health & Human Services. Retrieved online at https://www.cdc.gov/std/stats18/default.htm. 
• Center for HIV Law and Policy (March 2019). HIV Criminalization in the United States: A Sourcebook on State and Federal HIV Criminal Law and Practice (Third Edition). Retrieved online at http://www.hivlawandpolicy.org/sourcebook. 
• Eustace-McMillan, Loni (1999, December 17). Protecting Private Medical Information: Liability for Unauthorized Disclosure. University of Houston Law Center. Retrieved online at https://www.law.uh.edu/healthlaw/perspectives/Privacy/991217Protecting.html. 
• Gorman, Anna (2018, April 6). Former California State Contractor Sued Over Breach Of HIV Patient Privacy. California Healthline. Retrieved online at https://californiahealthline.org/news/former-california-state-contractor-sued-over-breach-of-hiv-patient-privacy/. 
• Gordon, Elena (2018, January 17). Aetna Agrees To Pay $17 Million In HIV Privacy Breach. NPR. Retrieved online at https://www.npr.org/sections/health-shots/2018/01/17/572312972/aetna-agrees-to-pay-17-million-in-hiv-privacy-breach. 
• Hassan, Carma (2018, April 1). Lawsuit claims CVS unintentionally revealed HIV status of 6,000 customers. CNN. Retrieved online at https://www.cnn.com/2018/04/01/health/cvs-lawsuit-hiv-status-customers/index.html. 
• Heath, Sara (2017, August 22). 5 Ways to Improve Medication Adherence in Chronic Care Patients; Providers need to uncover the patient barriers to help improve medication adherence in chronically sick patients. Patient Engagement Hit. Retrieved online at https://patientengagementhit.com/news/5-ways-to-improve-medication-adherence-in-chronic-care-patients. 
• Holman, Tayla (2017, June 27). How to Build Patient Trust to Improve the Doctor-Patient Relationship. Dignity Health. Retrieved online at https://www.dignityhealth.org/articles/how-to-build-patient-trust-to-improve-the-doctor-patient-relationship. 
• Kempner, Martha (2019, March 4). New Study Triggers Concerns Over Use of Molecular HIV Surveillance. TheBodyPro. Retrieved online at https://www.thebodypro.com/article/concerns-over-use-of-molecular-hiv-surveillance. 
• Kirzinger, Ashley, Lunna Lopes, Bryan Wu, and Mollyann Brodie (2019, March 26). KFF Health Tracking Poll – March 2019: Public Opinion on the Domestic HIV Epidemic, Affordable Care Act, and Medicare-for-all. Kaiser Family Foundation. Retrieved online at https://www.kff.org/health-reform/poll-finding/kff-health-tracking-poll-march-2019/. 
• Lambda Legal (2013, December 13). 15 Ways HIV Criminalization Laws Harm Us All. Retrieved online at https://www.lambdalegal.org/publications/15-ways-hiv-criminalization-laws-harm-us-all. 
• Macsata, Brandon M. (2019, May 2) The ADAP Blog. When State & Local Public Health "Policies" Fuel HIV Stigma. ADAP Advocacy Association. Retrieved online at https://adapadvocacyassociation.blogspot.com/2019/05/when-state-local-public-health-policies.html. 
• McClelland, Alexander, Adrian Gula, and Marilou Gagnon (2019, February 10). The rise of molecular HIV surveillance: implications on consent and criminalization. Critical Public Health. Retrieved online at https://www.tandfonline.com/doi/citedby/10.1080/09581596.2019.1582755?scroll=top&needAccess=true. 
• Mesika, Robert (2012, July). The Ethics of HIV Criminalization. ETHICAL INQUIRY: JULY 2012. International Center for Ethics, Justice and Public Life. Retrieved online at https://www.brandeis.edu/ethics/ethicalinquiry/2012/July.html. 
• O’Neill Institute for National & Global Health Law (2019, Augsut). Quick Take: Using Cluster Detection to End the HIV Epidemic. Georgetown Law. Retrieved online at https://oneill.law.georgetown.edu/wp-content/uploads/Quick-Take_HIV-Cluster-Detection_August-2019.pdf. 
• Oster, M.D., Alexa, et. al. (2017, March 24). National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention. Use of molecular surveillance data to identify clusters of recent and rapid HIV transmission. U.S. Centers for Disease Control & Prevention. Retrieved online at https://www.seaetc.com/wp-content/uploads/2017/01/Use-of-Molecular-Surveillance-Data-to-Identify-Alexandra-Oster.pdf. 
• Schneider, Jacon (2019, September 12). Is HIV Molecular Surveillance Worth The Risk? The Center for HIV Law & Policy. Retrieved online at http://www.hivlawandpolicy.org/fine-print-blog/hiv-molecular-surveillance-worth-risk. 
• Serenko*, Natalia, and Lida Fan (2013). Patients’ perceptions of privacy and their outcomes in healthcare. Int. J. Behavioural and Healthcare Research, Vol. 4, No. 2. Retrieved online at http://aserenko.com/IJBHR_Serenko_Fan.pdf. 

Disclaimer: Guest blogs do not necessarily reflect the views of the ADAP Advocacy Association, but rather they provide a neutral platform whereby the author serves to promote open, honest discussion about public health-related issues and updates.

DHHS Reports That Majority Of Data Breaches Expose Non-Health-Related Data

By: Marcus J. Hopkins, Policy Consultant

The U.S. Department of Health and Human Services released on September 23rd, 2019, a report in the Annals of Internal Medicine that found that the majority of information accessed in the over 1,500 protected health information (PHI) breaches reported over the last decade has been sensitive demographic information (e.g. – driver’s license number and Social Security Numbers – SSNs) and financial information including billing and payment information (Hlavinka, 2019). Only 2% of data breaches were found to expose sensitive medical information, such has HIV status, cancer diagnoses, or substance abuse, but 65% of these breaches exposed general medical or clinical information (Hlavinka).

According to the findings, over half of data breaches reported to HHS could be attributed to healthcare providers’ personal mistakes or negligence. This could include anything from failing to encrypt laptops, to using “CC” instead of “BCC” when E-mailing patients (Hlavinka).

Photo Source: evidencesolutions.com

HHS proposed regulatory, in March 2019, that would modernize the way that health information is shared by implementing certain provisions of the 21st Century Cures Act, including increasing the amount of data that is entered and shared electronically. The fundamental tradeoff of this modernization, however, is that health data will naturally become more susceptible to exposure. This last point is increasingly concerning considering the recent increase in so-called “Ransomware” cyber-attacks against public computer systems. Campbell County Health in Gillette, Wyoming, was hit, this month, with one such cyber-attack affecting all 1,500 of the systems computers, including the E-mail server, which resulted in the CCH having to divert patients from ERs starting on September 20th, 2019, as well as cancelling many exams, procedures, and new patient admissions (Landi, 2019).

Healthcare systems remain one of the largest targets of hackers, and while ransomware attacks, themselves, do not access private information, instead denying access to information, the potential exists for hackers to jump from denying access to exposing sensitive data if ransoms are not paid.

These data presented by HHS come on the heels of a recent settlement announcement in the state of Ohio between state AIDS Drug Assistance Program (ADAP) clients and CVS Health, the company contracted to provide prescription drug benefits, after a CVS mailer to OHDAP (Ohio’s ADAP program) clients in an envelope that clearly announced clients’ HIV status (Hopkins, 2017). In our August 2017 coverage of this issue, one of the plaintiffs, Eddie Hamilton, head of the ADAP Educational Initiative, shared with us the envelope he received (unredacted) which clearly listed his ID number as: “PM 6402 HIV”.

“In our case, CVS used our Ryan White CAREWare numbers as their subscriber numbers,” Hamilton told me. “It has our birthdates embedded in that URN (Unique Record Number), which is not HIPAA compliant. So, not only was our HIV status on the mailer, but our names, addresses, and birthdates all visible to anyone who looked at the envelope. I do not think that the Health Resources and Services Administration (HRSA) is even aware that those numbers are being used for public consumption.”

The CVS settlement, which has yet to receive approval from a judge, agrees to pay out $4.4 million to settle the class-action lawsuit filed in June 2018 by the roughly 4,500 patients impacted. Under the settlement, each recipient of the mailer would receive a minimum of $400, those who can show they suffered non-financial harm can get as much as $2,500, and those who can prove they suffered financial harm can receive up to $10,000. The lawyers representing the plaintiffs may receive up to $1.46 million – over a third of the overall reward (Anderson, 2019).

Photo Source: UpGuard

The agreement language, itself, include some troubling clauses, such as clause 10.19 which reads:

"10.19 Non-Disparagement. The Parties and their counsel agree that neither the fact that Caremark entered into this Settlement Agreement nor its terms shall at any time, directly or indirectly, be used to disparage Caremark’s administration of OhDAP. For purposes of this Section, the term “disparage” shall mean to make comments or statements that would adversely affect the business or professional reputation of Caremark. Nothing in this Paragraph or any other Paragraph of the Agreement, precludes the Parties or their Counsel from (a) referring to public information about the above-captioned litigation, Settlement, or other publicly available documents; (b) responding to any subpoena, legal process or request for information from any governmental authority; (c) testifying truthfully under oath pursuant to any lawful court order or subpoena; or (d) pursuing any legal right they may have against each other. Nothing in this paragraph or any other paragraph of this Agreement precludes Counsel for Plaintiffs from making statements regarding signatories to this Agreement in the context of pursuing a claim or lawsuit. Nothing in this paragraph or any other paragraph of the Agreement shall be construed to restrict the right to practice in violation of applicable Rules of Professional Conduct."

Non-Disparagement clauses are frequently used as tools to prevent those who agree to settle from going public with their personal stories, particularly in the event that they come to feel that the amount they received in the settlement is not sufficient to cover their injury.

In addition to the Non-Disparagement clause, the settlement includes no admission of guilt – a common practice in settlement agreements. This, to my way of thinking, is unconscionable. CVS’ negligence in this matter had the potential to result in long-lasting impacts, both personally and financially, for those whose statuses were exposed in their mailers. That no party involved in the decision to use “HIV” in the member ID numbers – not OHDAP, not the Ohio Department of Health, and certainly not CVS Caremark – is willing to admit to wrongdoing despite clearly having done wrong is worthy of disparagement.

The reality of living in the 21st Century is that, the further along we go, the more information about us is going to be accessible to others. Data breaches have always occurred and oftentimes, it can be the result of a simple mistake. The question then becomes, “How much security are we willing to sacrifice in the name of expedience?”

Personally, because I’m very vocal and open about my status and personally invite any hacker to try to use my SSN to gain access to credit (best of luck, suckers! The joke’s on you [Marcus goes to cry over his poor credit rating]), as well as the fact that I have a tendency to relocate pretty frequently, I prefer the ease of data mobility. Others, however, are not so open, and for them, the risk of exposure – while, according to the HHS data, is slim – presents a far more daunting choice.

References:

• Anderson, Maia. (2019, September 13). CVS to pay $4.4M settlement over inadvertent HIV disclosure of 4,500 patients. Chicago, IL: Becker’s Healthcare: Becker’s Hospital Review: Pharmacy. Retrieved from: https://www.beckershospitalreview.com/pharmacy/cvs-to-pay-4-4m-settlement-over-inadvertent-hiv-disclosure-of-6-000-patients.html
• Hlavinka, E. (2019, September 23). Health Data Breaches Give Up SSN, Not HIV Status - Just 2% involved sensitive medical information. New York, NY: MedPage Today, LLC: MedPage Today: Public Health & Policy: Practice Management. Retrieved from: https://www.medpagetoday.com/publichealthpolicy/practicemanagement/82332
• Hopkins, M.J. (2017, August 28). HIPAA: Healthcare mailers violate privacy rights of people living with HIV. Washington, DC: Community Access National Network: HEAL Blog. Retrieved from: https://communityaccessnationalnetwork.wordpress.com/2017/08/28/1498/
• Landi, H. (2019, September 23). Wyoming health system hit with ransomware attack, diverts ER patients and cancels services. Framingham, MA: Questex, LLC: Fierce Healthcare: Tech. Retrieved from: https://www.fiercehealthcare.com/tech/campbell-county-health-wyoming-hit-ransomware-attack-diverts-er-patients

Disclaimer: Guest blogs do not necessarily reflect the views of the ADAP Advocacy Association, but rather they provide a neutral platform whereby the author serves to promote open, honest discussion about public health-related issues and updates.