LEGAL AND ETHICAL ISSUES

Legal standards are set forth in the form of written laws passed by governments. Ethical considerations are based on the principles of right and wrong and guide how laws can be obeyed. These issues include confidentiality and anonymity, informed consent, criminalization laws, disability and discrimination, and HIV reporting requirements.

Confidentiality

Confidentiality is a paramount concern for people with HIV/AIDS. States have adopted different regulations regarding protection of the confidentiality of information in people living with HIV; however, all states fall under the federal Health Insurance Portability and Accountability Act (HIPAA), which prohibits disclosure of a person’s HIV status except in limited instances. If a state law is less stringent than HIPAA, then HIPAA supersedes it.

HIPAA establishes national standards to protect an individual’s medical records and other personal information and states that all medical records are confidential and must be maintained in a manner that protects that confidentiality. Protected health information is any individually identifiable health information, whether electronic, paper, or oral, and includes:

• Health records (physical and mental)
• Health histories
• Lab test results
• Medical bills

Entities covered by HIPAA include:

• Health plans that provide or pay the cost of medical care (Health plans that have fewer than 50 participants and are self-funded and self-administered are exempt from HIPAA requirements.)
• Healthcare clearinghouses that act as third-party intermediaries between providers of healthcare and those who pay for healthcare
• Healthcare providers
• Business associates who perform functions on behalf of, or provide services to, a covered entity that involves access to protected health information
  (HIPAA Journal, 2020a)

According to the HIPAA Privacy Rule, a covered entity may not use or disclose protected health information except either:

• As the Privacy Rule permits or requires, or
• As the individual who is the subject of the information or the individual’s personal representative authorizes in writing

Health providers are required to disclose protected health information when:

• Individuals or their personal representative request access
• The Department of Health and Human Services requests information
  (HHS.gov, 2020)

BREACH OF CONFIDENTIALITY

Breach of confidentiality is an impermissible use or disclosure that compromises the security of an individual’s private health information. Covered entities must notify the Department of Health and Human Services promptly when a breach occurs. Breach of confidentiality includes:

• Accessing confidential information, in any form, without a “need to know” to perform assigned duties
• Assisting an unauthorized user to gain access to secured information
• Leaving confidential information unattended in a nonsecure area
• Disclosing confidential information without proper authorization
• Discussing confidential information in the presence of those who do not have the “need to know”
• Improper disposal of confidential information
• Disclosing that a patient or employee is receiving care
• Transferring confidential information in any form without both parties having a need to know
  (CMS, 2018)

Individuals who breach confidentiality are subject to corrective action up to and including termination of employment. In addition, civil and criminal penalties can be assessed under HIPAA for personal health information violations, ranging from fines of $100 up to $1.5 million and prison terms of 1 year up to 10 years, depending on the extent to which the HIPAA-covered entity was aware that HIPAA rules were violated (HIPAA Journal, 2020b).

CONFIDENTIAL TESTING

Confidential testing means that the person’s name and other identifying information will be attached to the test results, will go into the medical record, and may be shared with the person’s healthcare providers and health insurance company. Otherwise, the test results are protected by state and federal privacy laws and can only be released with the individual’s permission. Most testing is done confidentially.

With confidential testing, when an individual tests positive for HIV, the test result and the person’s name are reported to the state or local health department to help public health officials better estimate rates of HIV infection in the state. The state health department then removes all personal information about the person and shares the remaining nonidentifying information with the CDC. The CDC does not share this information with anyone else, including insurance companies (HIV.gov, 2018).

As a follow up to a positive HIV test, the local health department may contact the person to ensure test results have been received and are understood and to find out if the person received referrals to and has received HIV medical care and treatment (HIV.gov, 2018).

ANONYMOUS TESTING

Anonymous testing means that nothing ties the test results to the person. When the person takes an anonymous HIV test, they receive a unique identifier that allows the person to obtain the test results. These tests are not available at every place that provides HIV testing (HIV.gov, 2018).

PARTNER NOTIFICATION AND SEXUAL ASSAULT CONFIDENTIALITY

As follow up to a positive test result, the local health department representative may talk with the person about the need to inform sexual or needle-sharing partner(s) about possible exposure to HIV. They may also offer partner services to assist in those conversations. The health department, at the request of the person, can attempt to locate any or all of the person’s partners to let them know they may have been exposed to HIV. They will be able to help those individuals get tested and give them information about PrEP, PEP, and other ways they can protect themselves and access prevention and care services (HIV.gov, 2018).

Informed Consent

HIV testing is governed by a range of federal and state laws that vary widely in the degree of protection provided. Unlike testing for most other infectious diseases, testing for HIV involves possible risks, benefits, and consequences that may not be apparent to the patient, and therefore requires informed consent.

Informed consent is a legal concept, not a medical concept, and is characterized by a process of communication between a patient and physician that results in the patient’s authorization or agreement to undergo a specific medical intervention (CHLP, 2020a).

MINORS

Minors are persons who do not have the legal rights and responsibilities of an adult. Minors’ ability to access HIV testing and pre- and postexposure prophylaxis treatment without parental or guardian consent varies throughout the United States. In all 50 states and the District of Columbia, the CDC finds there is no jurisdiction that explicitly prohibits minors’ access to PrEP without parental/guardian consent (CDC, 2018b).

HIV Criminalization Laws

As of 2019, 34 states had laws that criminalized HIV exposure. Criminalization of potential HIV exposure is largely a matter of state law, with some federal legislation addressing criminalization in areas such as blood donation and prostitution. These laws vary as to what behaviors are criminalized or what behaviors result in additional penalties.

In 21 states, laws require persons who are aware that they have HIV to disclose their status to sexual partners, and 12 states require disclosure to needle-sharing partners. Several states criminalize one or more behaviors that pose a low or negligible risk for HIV transmission.

The maximum sentence for violating an HIV-specific statute is also a matter of state law. Some states have a maximum sentence as high as life in prison, while others have maximum sentence lengths less than 10 years. Only seven states have laws that account for HIV prevention measures that reduce transmission risk, such as condom use and antiretroviral therapy (CDC, 2020l).

Disability and Discrimination

HIV infection and AIDS are medical disabilities, and people living with HIV or AIDS are protected under the federal Rehabilitation Act of 1973 and the Americans with Disabilities Act of 1990 against discrimination by:

• Employers
• Places of accommodation (includes businesses that are open to the public)
• State and local government entities

Section 504 prohibits health and human service programs or organizations that receive federal funds or assistance from discriminating against HIV/AIDS patients. These entities may include:

• Hospitals
• Clinics
• Social services agencies
• Drug treatment centers
• Nursing homes
• Doctors’ offices
• Dentists’ offices
• Daycare providers
• Public pools
• Fitness gyms

The federal Fair Housing Act prohibits discrimination against people living with HIV/AIDS in many different types of dwellings (HIV.gov, 2017a).

In 2008, Congress passed the Americans with Disabilities Amendments Act (ADAA), which made it easier for those with HIV to meet the definition of disability under federal antidiscrimination laws. Under the ADAA, those with HIV/AIDS can demonstrate that they have a covered disability simply by showing that their unmedicated HIV/AIDS substantially limits the functions of their immune system. The determination of whether the normal functioning of an individual’s immune system is substantially limited is done by evaluating their health when not taking medication (CHLP, 2020b).

Employees who feel they are being discriminated against should first document the discrimination, speak with their supervisor, and follow the entity’s internal process to file a discrimination charge. However, it is not necessary to file an internal grievance. If these remedies do not work, the employee should contact the federal Office for Civil Rights, U.S. Department of Health and Human Services, or appropriate department in their state. An aggrieved person can also file directly in state court.

HIV Reporting Requirements

All 50 states require reporting of positive HIV test results. Results are to be reported to the state’s health department, which will then remove all personal information from the test results and send the information to the U.S. Centers for Disease Control and Prevention, the agency responsible for tracking national public health trends (HIV, 2017b).