Dr. Robert C. Harder, Secretary
Dept. of Health and Environment
Landon State Office Building, Suite 904
Topeka, Kansas 66612-1290
Dear Dr. Harder:
You have requested our opinion regarding the coverage of the confidentiality requirements set forth in Kansas laws relating to HIV/AIDS testing. Specifically, you ask:
"1. Is it a violation of Kansas law for a laboratory to report the name of a person who requested a laboratory test when it is known that the recipient of such information will use the information to attempt to learn the identity of the person tested?
"2. Must laboratories located in Kansas comply with Kansas reporting and confidentiality laws, when those laws conflict with the laws of other states and the persons being tested and the person requesting the test are not residents of Kansas?"
The Kansas statutes which, when read together, require that laboratory information related to HIV/AIDS testing remain confidential are K.S.A. 65-1,108a, as amended by L. 1994, ch. 262, sec. 3, K.S.A. 65-6002 and K.S.A. 65-6003.
K.S.A. 65-1,108a, as amended by L. 1994, ch. 262, § 3, provides that:
"(a) Information obtained through tests performed under 42 C.F.R. Part 493 and amendments thereto (CLIA 1988) or tests to evaluate biological specimens for the presence of controlled substances included in schedules 1 or 2 of the uniform controlled substances act or metabolites thereof, conducted by a laboratory approved . . . by the secretary of health and environment to perform such tests shall be confidential and shall not be disclosed or made public . . ., except that such laboratory test results shall be released only to: (1) the person who ordered such tests be made; (2) the secretary of health and environment if required by the secretary as part of the approval of the laboratory under K.S.A. 65-1,107 and 65-1,108 and amendments thereto; and (3) the secretary of health and environment for data collection purposes so long as such information is released in such a manner that the information will not reveal the identity of the person who is the subject of the information. . . ." (Emphasis added).
42 C.F.R. Part 493 sets forth the qualifications and requirements a "laboratory" must meet to perform tests. "Laboratory" is defined as:
"a facility for the biological, microbiological, serological, chemical, immunohematological, hematological, biophysical, cytological, pathological, or other examination of material derived from the human body for the purpose of providing information for the diagnosis, prevention, or treatment of any disease or impairment of, . . . human beings . . . ."
Therefore, K.S.A. 65-1,108a requires any of the prescribed tests, including those which might detect HIV/AIDS infection, "shall be confidential" except that results may be released to the person who requested the test or the KDHE. However, the information can only be released to these parties if the information does not "reveal the identity of the person who is the subject of the test. . . ." Id.
K.S.A. 65-6002 limits the use of AIDS testing information. It provides that:
"(a) Whenever any physician has information indicating that a person is suffering from or has died from AIDS, such knowledge or information shall be reported immediately to the secretary, together with the name and address of the person who has AIDS, . . . . Any laboratory director shall report all positive reactions to an AIDS test to the secretary. Any physician who is in receipt of a report indicating a positive reaction to a test for HIV infection resulting from the examination of any specimen provided to a laboratory by such physician shall report all such positive reactions to the secretary. Reports by physicians and laboratory directors . . . shall designate the type of test or tests performed, the date of performance of the test or tests, the results of the test or tests, the sex, date of birth, county of residence and racial/ethnic group of the person tested. For the purpose of reporting HIV infection only, the name of the patient shall not be reported.
. . . .
"(c) Information required to be reported under subsection (a) and information obtained through laboratory tests conducted by the department of health and environment relating to HIV or AIDS and persons suffering therefrom or infected therewith shall be confidential and shall not be disclosed or made public . . . beyond the disclosure necessary under subsection (a) or under subsection (a) of K.S.A. 65-6003 and amendments thereto or the usual reporting of laboratory tests results to persons specifically designated by the secretary as authorized to obtain such information." (Emphasis added).
Generally, prohibitions on disclosure apply "to those persons and entities initially having custody of test results, as well as those to which disclosure has been made. . . ." Michael G. Macdonald, et. al., Treatise on Health Care Law, § 16.04 [3][e][i] (1994). Based upon this, K.S.A. 65-6002(c) requires that all information relating to HIV/AIDS tests obtained by physicians or laboratories is confidential while it is in their possession, as well as after it is reported to the KDHE.
Next, K.S.A. 65-6002(c) sets forth the only situations in which information may be disclosed. Information may only be disclosed:
"(1) If no person can be identified in the information to be disclosed and the disclosure is for statistical purposes;
"(2) If all persons who are identifiable in the information to be disclosed consent in writing to its disclosure;
"(3) If the disclosure is necessary, and only to the extent necessary, as specified by rules and regulations of the secretary, to protect the public health;
"(4) If a medical emergency exists and the disclosure is to medical personnel qualified to treat AIDS or HIV infection. . .; or
"(5) If the information to be disclosed is required in a court proceeding involving a minor or the information is disclosed in camera." Id.
K.S.A. 65-6003 allows the secretary to adopt and enforce rules and regulations for the prevention and control of AIDS. It further provides:
"(b) Any information relating to persons who have AIDS which is required to be disclosed or communicated under subsection (a) shall be confidential and shall not be disclosed or made public beyond the disclosure necessary under subsection (a) or under subsection (a) of K.S.A. 65-6002 and amendments thereto . . . except as otherwise permitted by subsection (c) of K.S.A. 65-6002 and amendments thereto." (Emphasis added).
Pursuant to the authority granted to the secretary by these statutes, the secretary has enacted regulations regarding the reporting of HIV/AIDS infection. These regulations require that AIDS results be reported in accordance with K.S.A. 65-118, K.S.A. 65-128 and K.S.A. 65-6002. K.A.R. 28-1-2. The regulations also require Kansas hospitals to report incidences of AIDS, on specific forms, to the department of health and environment for registration. K.A.R. 28-1-4. All of these reports are to remain confidential. K.A.R. 28-1-4(b).
Reporting in accordance with the aforementioned regulations is required by K.A.R. 28-1-22(a). The regulation further requires physicians and individuals in charge of clinical laboratories, approved by the department of health and environment to perform HIV antibody tests, who have evidence or reports of positive reactions to AIDS tests, "indicating HIV infection of a Kansas resident," to report the positive reactions. Id. at (b), (c). Laboratories must also include in this report the name and address of the physician who requested the test. Id. The regulation further provides that:
"(d) All reports pursuant to this regulation shall be reported to the secretary of the Kansas department of health and environment on forms provided by the department and shall be confidential and not open to public inspection." Id.
It is apparent from the aforementioned statutes and regulations that Kansas is concerned with the confidentiality of individuals requesting HIV/AIDS tests. K.S.A. 65-6002(c) provides the only circumstances in which such information may be released by laboratories, physicians or the KDHE. Individual's confidentiality is further protected by the requirement that any information released cannot identify the person unless they consent or the disclosure is for statistical purposes. Id. at (c)(1). It can be inferred from these measures that the Kansas legislature's primary goal is protecting the identity of individuals who seek to discover their HIV/AIDS status.
Therefore, we opine that it is a violation of Kansas law for a Kansas laboratory to report the name of a person requesting a lab test when it is known that the recipient of such information will use the information to attempt to identify the person being tested. It should be noted that any person breaching the confidentiality of an individual being tested in violation of "K.S.A. 65-6001 through 65-6004 or of the rules and regulations adopted by secretary for prevention and control of AIDS shall be guilty of a class C misdemeanor." K.S.A. 65-6005.
We also note that it has been held that a physician who releases information which is confidential, whether statutorily or by agreement, can be held liable for punitive damages. Doe v. Roe, 599 N.Y.S.2d 350 (1993). In Doe, a doctor revealed a patient's HIV positive status when his records were subpoenaed by a Pennsylvania worker's compensation court. Id. at 351. In ruling the plaintiff could bring an action for breach of confidentiality and violation of the New York statutes prohibiting HIV status disclosure, the court held New York's law, weighted strongly with public policy considerations, was controlling over Pennsylvania's. Id. at 353. Based upon this case and K.S.A. 65-6002, a laboratory might also be subject to punitive damages for releasing information which the statute makes confidential.
Similar to the conflict between the laws in Doe v. Roe, you further ask our opinion as to whether laboratories located in Kansas must comply with the reporting and confidentiality laws of this state or of the state where the person who requested the test resides. You indicate this conflict has arisen because laboratories within the state of Kansas are performing tests for individuals in other states. The states in which those individuals reside have laws which require laboratories which test their citizens to disclose the individual's identity.
These differences in reporting requirements reflect the different policy concerns of states. Some states identify "their primary concern as epidemiological and do not wish to discourage participation in the state's voluntary testing program which participation might be deterred by the reporting of identifying information." William P. Schurgin and Paul E. Berg, Legal Aspects of AIDS, § 8:19 (1991). Evidence from several studies indicates that contact tracing and partner notification policies might deter individuals from being tested for HIV/AIDS altogether. Roger Doughty, The Confidentiality of HIV-Related Information: Responding to the Resurgence of Aggressive Public Health Interventions in the AIDS Epidemic, 82 Cal. L. Rev. 111, 129 (1994). Kansas appears to follow this public policy as evidenced by the statutes which repeatedly stress the confidentiality of the HIV/AIDS tests information.
Other states believe "the reporting of the names of test subjects have justified this requirement on the need for information to facilitate notifying individuals if drugs become available and on the need to engage in contact tracing." William P. Schurgin and Paul E. Berg, Legal Aspects of AIDS, § 8:19 (1991). These states seek the identity of those requesting the test and the individual who was tested so they may notify anyone who may have contracted the disease from the tested individual. Michael G. Macdonald, et. al., Treatise on Health Care Law, § 16.04 [3][l] (1994).
This puts Kansas' and other states' public policies regarding confidentiality of HIV/AIDS test results in conflict. For the other states laws to be enforced within our state, a court would be required to exercise comity. Comity is "a principal by which the courts of one state or jurisdiction give effect to the laws . . . of another." Head v. Platt County, Mo., 242 Kan. 442 (1988).
However, comity is not required, but is exercised "out of deference and respect." Id. It has been held that "the substantive law of a foreign state is entitled to comity in a Kansas court . . . unless contrary to Kansas public policy." (Emphasis added). Dow Chemical Corp. v. Weevil-Cide Co., Inc., 630 F.Supp. 125 (d) (Kan. 1986). Furthermore, disclosing the identity of individuals tested for HIV/AIDS for purposes outside those delineated in K.S.A. 65-6002 would "render nugatory the provisions of our statute in relation thereto. The rule of giving operation to the laws of other states as a matter of comity only is never extended to such cases." Mackey et al. v. Pettyjon, 6 Kan.App. 57 (1897).
Therefore, based on the principles of comity and based on the fact that Kansas laboratories must comply with Kansas confidentiality laws we opine that Kansas laboratories may not reveal information which would be a violation of our HIV/AIDS reporting and confidentiality laws, despite the fact that such nondisclosure conflicts with the laws of other states and the person being tested and the person requesting the test are not residents of Kansas.
RTS:JLM:LJL:bas